SaaS Administrator Discovery Using Firewall Log URL Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in identifying and managing application administrators for their SaaS applications, as this information is often tribal knowledge or not easily accessible, leading to inefficiencies in setting up and enforcing information security practices.
Innovation Solution
A system and process that utilizes machine learning models, particularly Large Language Models (LLMs) and regular expression pattern matching, to analyze firewall logs and identify administrator URLs, generating scores and rankings to automatically discover application administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual methods are used to identify application administrators, then accuracy can be maintained, but time consumption and manual effort increase significantly
Solution Approach 1:
The system automatically discovers application administrators by analyzing firewall logs and URL patterns without requiring manual input or intervention. The machine learning model processes log data autonomously to identify administrators, eliminating the need for manual search while maintaining accuracy through automated pattern recognition and scoring mechanisms.
Solution Approach 2:
The patent replaces manual administrative processes with automated machine learning-based systems. The machine learning model substitutes human analysis of firewall logs and URL patterns, using computational algorithms to automatically identify administrators through pattern matching and scoring, thereby reducing manual effort and time consumption.
2Loss of time
If automated systems are implemented to discover application administrators, then time consumption is reduced, but system complexity increases
Solution Approach 1:
The system introduces a machine learning model as an intermediary component that processes firewall logs and URL patterns to automatically identify administrators. This intermediary layer simplifies the overall system architecture by providing a dedicated automated processing layer that handles the complexity of administrator discovery without requiring manual intervention or complex manual processes.
Solution Approach 2:
The patent transforms the approach by changing from manual parameter analysis to automated machine learning-based parameter extraction. The system automatically extracts and analyzes parameters such as URL patterns, access frequencies, and authentication behaviors from firewall logs, converting manual parameter analysis into automated computational processes that reduce time consumption while managing complexity through structured data processing.
3Device complexity
If tribal knowledge methods are used to manage application administrators, then existing processes are simple, but information accessibility and efficiency deteriorate
Solution Approach 1:
The system implements feedback mechanisms by continuously analyzing firewall logs and URL access patterns to automatically update administrator identification. The machine learning model processes incoming log data in real-time, providing continuous feedback that maintains accurate and up-to-date administrator information without relying on static tribal knowledge or manual updates, thereby improving information accessibility while maintaining process simplicity.
Data Source
AI summary
Various techniques for providing automatic discovery of application administrator are disclosed. In some embodiments, a system, a process, and/or a computer program product for automatic discovery of application administrator includes automatically determining an administrator for an application (e.g., a Software as a Service (SaaS) application) associated with an organization by processing logs (e.g., firewall logs) for Uniform Resource Locators (URLs) visited by a user; matching the URLs for patterns that the administrator of that application visits using a machine learning (ML) model or based on known URL patterns; and sending the determined administrator for the application associated with the organization to an external service.