Web Request Routing for Multi-Categorized Sites
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic routing systems face inefficiencies and security threats due to manual and semi-automated processes for categorizing websites, leading to delays and incorrect application of network policies, especially for non-categorized and multi-categorized websites, which can result in data leakage and other threats.
Innovation Solution
A computing platform with a threat analysis database engine and proxy content filtering engine redirects web requests to determine threat scores and apply appropriate network actions, using threat intelligence and machine learning to categorize and block or allow traffic, and automatically updates firewall rules and categorizations to enhance security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual or semi-automated processes are used to categorize websites, then categorization can be performed, but processing delays occur and productivity is reduced
Solution Approach 1:
The system performs preliminary categorization actions by maintaining a pre-populated database of website categories and threat scores. When a web request arrives, the system first checks if the website is already categorized in the database before initiating any analysis processes, enabling rapid lookup and decision-making without real-time processing delays
Solution Approach 2:
The system creates and maintains a local copy of categorization data and threat intelligence information in a database. This copied data allows the system to make routing decisions based on pre-analyzed information rather than performing real-time analysis for each request, significantly improving processing speed while maintaining accuracy
2Adaptability or versatility
If a website is categorized into multiple categories, then comprehensive classification is achieved, but incorrect network policies may be applied resulting in security threats
Solution Approach 1:
The system assigns different levels of quality or priority to different categories based on their security relevance. Threat scores are assigned to each category, allowing the system to weight certain categories more heavily than others when determining the appropriate network policy, ensuring that security-critical categories have greater influence on policy decisions
Solution Approach 2:
The system implements a feedback mechanism where threat scores and categorization data are continuously updated based on emerging threats and security intelligence. The proxy content filtering engine receives feedback about policy effectiveness and adjusts categorizations and threat scores accordingly, improving policy application accuracy over time
3Reliability
If threat analysis is performed for every uncategorized website, then security is improved, but processing time increases
Solution Approach 1:
The system performs partial threat analysis by first checking against the pre-populated database for exact matches. Only when no match is found does the system initiate full threat analysis processes. This partial approach handles the majority of requests quickly while maintaining security for unknown websites through selective deep analysis
Solution Approach 2:
Threat intelligence information and categorization data are prepared in advance and stored in the database before actual web requests need to be processed. This preliminary preparation includes pre-calculating threat scores and categorizations for known websites, enabling rapid response to common requests without real-time analysis overhead
Data Source
AI summary
Aspects of the disclosure relate to traffic routing. The computing platform may receive a first web request, requesting access to a first website. The computing platform may identify that the first website is associated with multiple categorizations. Based on identifying that the first website is associated with the multiple categorizations, the computing platform may redirect the first web request to a threat analysis database engine, which may be configured to output a first network action rule for the first website. The computing platform may access, from the proxy content filtering engine, the first network action rule. The computing platform may execute the first network action, which may include blocking or allowing traffic to the first website.