SaaS Traffic Detection Using URI Tokenization and ML Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing signature-based approaches fail to accurately detect Software-as-a-Service (SaaS) applications due to changes in application configurations, such as altered URIs or HTTP payload patterns, leading to misclassification and unclassified traffic.
Innovation Solution
A combination of URL ranking-based and machine learning-based application classification techniques is employed, utilizing tokenization to identify keywords in URIs, followed by a machine learning pipeline to verify classifications, ensuring accurate detection even with changing access paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based approaches are used to detect SaaS applications, then detection speed is fast, but detection accuracy deteriorates due to configuration changes
Solution Approach 1:
The patent implements dynamic detection by continuously monitoring URI patterns and HTTP payloads to adapt to configuration changes. The system dynamically updates detection signatures based on observed traffic patterns, transitioning from static signature matching to dynamic pattern learning that can evolve with SaaS application configurations.
Solution Approach 2:
The system incorporates feedback mechanisms where detected traffic patterns are fed back into the detection system to refine and update signatures. This feedback loop enables continuous improvement of detection accuracy by learning from actual traffic behavior and adjusting detection rules accordingly.
2Reliability
If traditional signature-based detection is used, then implementation is simple, but it fails to detect unclassified traffic due to changing access paths
Solution Approach 1:
The system performs preliminary analysis by collecting and analyzing network traffic data before final classification decisions are made. It pre-processes URI patterns and HTTP payloads to identify characteristics that can be used for reliable detection, preparing detection rules in advance based on observed patterns.
Solution Approach 2:
The patent detects changes in detection parameters by monitoring variations in URI patterns, HTTP headers, and payload structures. When configuration changes are detected, the system updates its detection parameters to maintain reliable identification, adapting to new access paths and configurations.
3Measurement precision
If dynamic detection with ML and tokenization is implemented, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent segments the detection process into distinct stages: URI tokenization, feature extraction, machine learning classification, and verification. This segmentation allows each component to be optimized independently and enables parallel processing of different detection tasks, reducing overall processing time while maintaining accuracy.
Solution Approach 2:
The system applies partial action by using machine learning models that can make predictions with varying levels of computational intensity based on traffic characteristics. For common or low-risk traffic patterns, the system uses lighter verification processes, reserving more intensive analysis for uncertain or high-risk cases.
Data Source
AI summary
The present application discloses a method, system, and computer system for classifying stream data at an edge device. The method includes (i) monitoring network traffic, wherein the monitored network traffic is stored in a network traffic log, (ii) determining an application identifier (ID) associated with a URL obtained from the network traffic log based at least in part on a combination of a URI ranking and a machine learning based URI application classification, and (iii) enforcing a policy with respect to network traffic based at least in part on the application ID.