Runtime Agent Security Rules via K-Means Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for protecting web applications against attacks, such as Runtime Application Self-Protection (RASP) and Web Application Firewalls (WAF), require manual fine-tuning, which is time-consuming and prone to human errors, and are ineffective in protecting production software, especially against unknown attack vectors.
Innovation Solution
Implementing a runtime analysis technology that uses k-means clustering and density estimation to automate the characterization of normal traffic patterns, generating rules to differentiate between good and bad traffic, and employing a runtime agent to monitor and enforce these rules in real-time, thereby reducing the need for manual fine-tuning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual fine-tuning is used to configure security rules, then security accuracy can be improved, but time consumption and human error increase significantly
Solution Approach 1:
The system performs self-characterization of normal traffic patterns through automated machine learning processes. The runtime agent automatically collects usage information, partitions it into clusters using k-means, generates density estimation models, and creates security rules without human intervention. This self-service approach eliminates manual fine-tuning while maintaining high security accuracy.
Solution Approach 2:
The patent replaces the mechanical manual configuration process with an automated machine learning system. Instead of security analysts manually analyzing traffic patterns and creating rules, the system uses k-means clustering and density estimation algorithms to automatically characterize normal traffic and generate security policies, significantly reducing time consumption.
2Reliability
If manual fine-tuning is used to configure security rules, then security accuracy can be improved, but human errors increase
Solution Approach 1:
The system eliminates human error by performing self-characterization of traffic patterns through automated machine learning. The runtime agent automatically collects usage information, partitions it into clusters, generates density estimation models, and creates security rules without human intervention, ensuring consistent and error-free configuration.
Solution Approach 2:
The patent replaces the error-prone manual configuration process with an automated machine learning system. The mechanical process of manual rule creation is substituted with algorithmic processes including k-means clustering and density estimation, which objectively characterize traffic patterns without human error.
3Reliability
If traditional security methods are used, then protection against known attacks is provided, but protection against unknown attack vectors is ineffective
Solution Approach 1:
Instead of creating security rules based on known attack patterns (blacklisting), the patent inverts the approach by characterizing normal traffic patterns and creating rules for what is acceptable (whitelisting). Anything deviating from the characterized normal behavior is automatically flagged as suspicious, providing protection against unknown attack vectors while maintaining effectiveness against known attacks.
Solution Approach 2:
The system performs preliminary characterization of normal traffic patterns during a training phase before actual security enforcement begins. The runtime agent collects usage information and generates density estimation models in advance, creating a baseline of acceptable behavior that enables detection of both known and unknown attacks during production operation.
4Extent of automation
If automated machine learning is used to characterize traffic patterns, then manual fine-tuning is reduced, but system complexity increases
Solution Approach 1:
The patent segments the security system into distinct functional modules: a runtime agent for collecting usage information, a training phase for generating models, and a production phase for enforcement. This segmentation manages complexity by organizing the automated machine learning process into manageable, well-defined components with clear interfaces.
Solution Approach 2:
The patent introduces a runtime agent as an intermediary component that bridges the application and the security analysis system. This intermediary collects usage information from the application, transmits it to the training phase, and receives generated rules for enforcement, simplifying the overall system architecture by centralizing the automation logic in a dedicated component.
Data Source
AI summary
Example embodiments disclosed herein relate to determining permissible activity in an application. Application programming interfaces (APIs) of an application are monitored using a runtime agent. Information about the APIs is provided to a rules engine. A set of rules describing permissible activity is received from the rules engine.