SaaS Traffic Detection Using ML URI Tokenization for Changing Access Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing signature-based approaches for detecting Software-as-a-Service (SaaS) applications fail to accurately identify network traffic due to changes in application configurations, such as altered access URIs, leading to misclassification or unrecognized traffic patterns.
Innovation Solution
A combination of URL ranking-based and machine learning-based application classification techniques is employed, utilizing tokenization to identify keywords in URIs and a machine learning pipeline to verify classifications, ensuring accurate detection even with changing access paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based approaches are used for detecting SaaS applications, then the detection method is simple and fast, but the accuracy deteriorates when application configurations change
Solution Approach 1:
The patent implements dynamic signature updating by continuously monitoring URI patterns and automatically adapting detection signatures when configuration changes are detected. This transforms the static signature-based approach into a dynamic system that evolves with application changes, resolving the contradiction between simple detection and adaptability.
Solution Approach 2:
The system changes detection parameters by transitioning from fixed signature matching to flexible URI pattern analysis with tokenization. This parameter change enables the system to maintain high detection accuracy while adapting to configuration changes in SaaS applications.
2Adaptability or versatility
If traditional signature-based detection is used, then the system complexity is low, but the ability to handle changing access URIs deteriorates
Solution Approach 1:
The patent applies segmentation by breaking down URIs into tokens and analyzing individual components rather than treating entire URIs as fixed signatures. This segmentation approach enables flexible matching of URI patterns while maintaining manageable system complexity through modular processing.
Solution Approach 2:
The system introduces an intermediary layer of URI pattern analysis and tokenization between the raw network traffic and the detection engine. This intermediary transforms complex URI variations into standardized patterns, enabling adaptable detection without proportionally increasing system complexity.
3Reliability
If static signatures are used for SaaS application detection, then the implementation is straightforward, but misclassification increases when applications modify their access paths
Solution Approach 1:
The patent implements preliminary action by pre-processing URIs through tokenization and pattern extraction before detection. This preliminary transformation of URI data into standardized patterns improves classification reliability while keeping the implementation approach systematic and manageable.
Solution Approach 2:
The system incorporates feedback mechanisms where detection results and observed URI patterns continuously inform signature updates. This feedback loop improves classification reliability over time by learning from actual application behavior while maintaining a structured implementation through automated update processes.
Data Source
AI summary
The present application discloses a method, system, and computer system for classifying stream data at an edge device. The method includes (i) monitoring network traffic, wherein the monitored network traffic is stored in a network traffic log, (ii) determining an application identifier (ID) associated with a URL obtained from the network traffic log based at least in part on a combination of a URI ranking and a machine learning based URI application classification, and (iii) enforcing a policy with respect to network traffic based at least in part on the application ID.