User State Tracking and Anomaly Detection in SaaS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current log management solutions for SaaS applications in cloud environments face performance bottlenecks and deficiencies in monitoring user states and dependencies due to their event-based and rule-based models, which are costly and inefficient for anomaly detection in multi-tenant environments.
Innovation Solution
A user state tracking and anomaly detector system that includes a collector module for gathering user state and dependency data, a mapper module for reducing complexity by mapping multiple states to manageable ones, and a dependency module for generating a real-time dependency graph to validate requests and report anomalies to the log management solution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional event-based log management solutions are used to monitor SaaS applications, then device monitoring capability is maintained, but performance bottlenecks occur and anomaly detection capability deteriorates
Solution Approach 1:
The patent segments the monitoring system into multiple specialized components: a state collection module that gathers user state data, a state machine module that processes state transitions, and an anomaly detection module that analyzes deviations. This segmentation allows each component to be optimized for its specific function, improving overall performance while maintaining reliable anomaly detection.
Solution Approach 2:
The patent introduces a state machine as an intermediary layer between log collection and anomaly detection. This state machine maintains user state information and processes state transitions, acting as a mediator that bridges the gap between raw log data and anomaly detection algorithms, thereby resolving the performance-capability contradiction.
2Adaptability or versatility
If rule-based monitoring approaches are used for SaaS applications, then implementation simplicity is maintained, but dependency monitoring capability and adaptability deteriorate
Solution Approach 1:
The patent implements dynamic state machines that can adapt to different SaaS application dependencies and user state transitions. Rather than using static rule-based approaches, the state machines dynamically update based on observed state changes, enabling the system to adapt to varying dependencies while managing complexity through structured state transition models.
Solution Approach 2:
The patent changes the monitoring approach from fixed rules to parameter-driven state transitions. By representing user states and dependencies as configurable parameters and state variables, the system gains adaptability to different SaaS environments while maintaining manageable complexity through standardized state machine frameworks.
3Loss of information
If HTTP-based log fetching is used in SaaS environments, then protocol compatibility is maintained, but state tracking capability deteriorates due to stateless nature
Solution Approach 1:
The patent performs preliminary state tracking by maintaining user state information in state machines before anomaly detection occurs. By pre-processing and storing state information in memory, the system compensates for HTTP's stateless nature, ensuring state information is retained and readily available for anomaly detection without complicating the HTTP interaction model.
Solution Approach 2:
The patent creates copies of user state information in state machines that persist across HTTP requests. Instead of relying on HTTP to maintain state, the system replicates necessary state data in local state machines, enabling continuous state tracking while maintaining simple HTTP-based communication with SaaS applications.
Data Source
AI summary
A user state tracking and anomaly detector for multi-tenant SaaS applications operates in association with a log management solution, such as a SIEM. A given SaaS application has many user STATES, and the applications often have dependencies on one another that arise, for example, when a particular application makes a request (typically on behalf of a user) to take some action with respect to another application. The detector includes a mapper that maps the large number of user STATES to a reduced number of mapped states (e.g., “red” and “green”), and a dependency module that generates user-resource dependency graphs. Using a dependency graph, a SaaS modeler in the detector checks whether a particular dependency-based request associated with a SaaS application is valid. State and dependency information generated by the mapper and dependency module are reported back to the log management solution to facilitate improved logging and anomaly detection.