Application Security Signals From Performance Data Anomalies

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional vulnerability scanning for software applications is inadequate in detecting new security gaps and zero-day exploits after deployment, as it primarily occurs before production and is not continuous.

Innovation Solution

A system and method that transforms application performance data into security data, using machine learning to generate baselines and detect anomalies, allowing real-time identification of potential security threats such as DoS attacks and phishing attempts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional vulnerability scanning is performed before production deployment, then pre-production security testing is improved, but continuous security monitoring after deployment deteriorates

Engineering Contradiction:

Improvepre-production security testingVSAvoidcontinuous security monitoring

Core Design Contradiction:

ReliabilityVSDuration of action of stationary object

Solution Approach 1:

The patent implements continuous security monitoring by transforming application performance data into security signals that are continuously analyzed in real-time during production operations. The system maintains continuous detection capability through ongoing analysis of performance metrics such as response times, error rates, and traffic patterns, eliminating the gap between pre-production testing and post-deployment security oversight.

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

The patent makes performance monitoring data serve dual purposes: both application performance tracking and security threat detection. By analyzing the same performance metrics through different lenses (performance baseline vs. security anomaly), the system achieves multi-functionality that resolves the contradiction between dedicated security scanning and continuous monitoring.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Speed

If application performance data is collected continuously, then real-time security detection is improved, but data processing complexity increases

Engineering Contradiction:

Improvereal-time security detectionVSAvoiddata processing complexity

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The system leverages existing performance monitoring infrastructure and data collection mechanisms to serve dual purposes: performance optimization and security detection. By analyzing the same performance metrics (response times, error codes, traffic volumes) through different interpretative frameworks, the system avoids duplicating data collection efforts while achieving real-time security awareness.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent transforms performance parameters into security indicators by changing the interpretative lens applied to the data. Performance metrics such as response time, error rates, and transaction volumes are reinterpreted as potential security signals when they deviate from established baselines, enabling real-time detection without additional data collection complexity.

Inventive Principle:

Principle #35Parameter changes

3Quantity of substance

If performance metrics are repurposed for security analysis, then security monitoring cost is reduced, but measurement precision for security threats deteriorates

Engineering Contradiction:

Improvesecurity monitoring resourcesVSAvoidsecurity threat detection accuracy

Core Design Contradiction:

Quantity of substanceVSMeasurement precision

Solution Approach 1:

The system employs feedback mechanisms where detected anomalies trigger investigations and validation processes that refine the detection accuracy. When performance metrics indicate potential security issues, the system initiates feedback loops for verification, pattern recognition, and false positive elimination, thereby maintaining measurement precision while using repurposed performance data.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent establishes performance baselines and security thresholds in advance during the pre-production phase, preparing reference data that enables accurate security detection during production. This preliminary action includes defining normal performance ranges, identifying baseline behavior patterns, and pre-configuring alert thresholds, which facilitates precise security threat detection when using repurposed performance metrics.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250358309A1Systems and Methods for Deriving Application Security Signals from Application Performance Data

Publication Date: 2025.11.20 CISCO TECHNOLOGY INC

AI summary

In one embodiment, a method includes receiving, by a network component, application performance data. The application performance data is associated with one or more applications. The method also includes determining to transform, by the network component, the application performance data into application security data, generating, by the network component, a baseline for the application security data, and detecting, by the network component, an anomaly in the baseline. The method further includes determining, by the network component, a potential security threat based on the anomaly.