Techniques for securing computing interfaces
A system and method for identifying computing interface calls using communications protocols. A method includes extracting data from a communications session involving communication between a first computing interface and a second computing interface, wherein the communication between the first computing interface and the second computing interface is implemented via a plurality of communication protocol layers, wherein extracting the data from the communications session further comprises building at least one layer of the plurality of communication protocol layers based on a portion of the data extracted from at least one other layer of the plurality of communication protocol layers; duplicating traffic for the communications session based on the extracted data, wherein duplicating the traffic further comprises converting the extracted data into a unified data modeling format; and identifying at least one computing interface call based on the duplicated traffic.
1. A method for identifying computing interface calls using communications protocols, comprising:
extracting data from a communications session involving communication between a first computing interface and a second computing interface, wherein the communication between the first computing interface and the second computing interface is implemented via a plurality of communication protocol layers, wherein extracting the data from the communications session further comprises building at least one layer of the plurality of communication protocol layers based on a portion of the data extracted from at least one other layer of the plurality of communication protocol layers;
duplicating traffic for the communications session based on the extracted data to produce duplicated traffic, wherein duplicating the traffic includes converting the extracted data into a unified data modeling format that at least in part is protocol-agnostic such that at least some of the duplicated traffic is protocol-agnostic; and
identifying at least one computing interface call based at least in part on the protocol-agnostic duplicated traffic.
2. The method of claim 1 , further comprising:
detecting an anomaly based on the identified at least one computing interface call.
3. The method of claim 2 , further comprising:
determining a configuration of the first computing interface and of the second computing interface based on the duplicated traffic, wherein the detected anomaly is an invalid configuration of the first interface or of the second interface.
4. The method of claim 2 , wherein the detected anomaly is an anomalous value, wherein the anomalous value is anomalous with respect to a plurality of values of a plurality of historical computing interface communications, wherein instances of the anomalous value appear in the plurality of values below a threshold.
5. The method of claim 1 , wherein the data is extracted from each of the plurality of communication protocol layers using a respective set of extraction rules for the layer, wherein the extraction rules for each layer include rules for identifying the data to be extracted from the layer.
6. The method of claim 1 , wherein the plurality of layers includes a transport layer, an application layer, an invocation layer, and a translation layer.
7. The method of claim 1 , wherein the method is performed by a system deployed out of path of the first computing interface and the second computing interface, wherein the communication between the first computing interface and the second computing interface includes a plurality of requests and a plurality of responses, wherein duplicating the traffic further comprises:
enabling traffic mirroring between the first computing interface and the second computing interface in order to obtain a plurality of mirrored packets,
determining at least one missing portion of the plurality of requests and the plurality of responses based on the plurality of mirrored packets; and
performing a full session reconstruction based on the extracted data and the at least one missing portion.
8. The method of claim 7 , wherein the at least one missing portion is determined based on the plurality of requests, the plurality of responses, and correlations between field-value combinations of historical computing interface communications.
9. The method of claim 8 , wherein each of the plurality of requests and each of the plurality of responses further includes a plurality of fields and a plurality of values, further comprising:
identifying a miscorrelation based on the plurality of fields and the plurality of values of each of the plurality of requests and each of the plurality of responses.
10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
extracting data from a communications session involving communication between a first computing interface and a second computing interface, wherein the communication between the first computing interface and the second computing interface is implemented via a plurality of communication protocol layers, wherein extracting the data from the communications session further comprises building at least one layer of the plurality of communication protocol layers based on a portion of the data extracted from at least one other layer of the plurality of communication protocol layers;
duplicating traffic for the communications session based on the extracted data to produce duplicated traffic, wherein duplicating the traffic includes converting the extracted data into a unified data modeling format that at least in part is protocol-agnostic such that at least some of the duplicated traffic is protocol-agnostic; and
identifying at least one computing interface call based at least in part on the protocol-agnostic duplicated traffic.
11. A system for identifying computing interface calls using communications protocols, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
extract data from a communications session involving communication between a first computing interface and a second computing interface, wherein the communication between the first computing interface and the second computing interface is implemented via a plurality of communication protocol layers, wherein extracting the data from the communications session further comprises building at least one layer of the plurality of communication protocol layers based on a portion of the data extracted from at least one other layer of the plurality of communication protocol layers;
duplicate traffic for the communications session based on the extracted data to produce duplicated traffic, wherein duplicating the traffic includes converting the extracted data into a unified data modeling format that at least in part is protocol-agnostic such that at least some of the duplicated traffic is protocol-agnostic; and
identify at least one computing interface call based at least in part on the protocol-agnostic duplicated traffic.
12. The system of claim 11 , wherein the system is further configured to:
detect an anomaly based on the identified at least one computing interface call.
13. The system of claim 12 , wherein the system is further configured to:
determine a configuration of the first computing interface and of the second computing interface based on the duplicated traffic, wherein the detected anomaly is an invalid configuration of the first interface or of the second interface.
14. The system of claim 12 , wherein the detected anomaly is an anomalous value, wherein the anomalous value is anomalous with respect to a plurality of values of a plurality of historical computing interface communications, wherein instances of the anomalous value appear in the plurality of values below a threshold.
15. The system of claim 11 , wherein the data is extracted from each of the plurality of communication protocol layers using a respective set of extraction rules for the layer, wherein the extraction rules for each layer include rules for identifying the data to be extracted from the layer.
16. The system of claim 11 , wherein the plurality of layers includes a transport layer, an application layer, an invocation layer, and a translation layer.
17. The system of claim 11 , wherein the system is deployed out of path of the first computing interface and the second computing interface, wherein the communication between the first computing interface and the second computing interface includes a plurality of requests and a plurality of responses, wherein the system is further configured to:
enable traffic mirroring between the first computing interface and the second computing interface in order to obtain a plurality of mirrored packets,
determine at least one missing portion of the plurality of requests and the plurality of responses based on the plurality of mirrored packets; and
perform a full session reconstruction based on the extracted data and the at least one missing portion.
18. The system of claim 17 , wherein the at least one missing portion is determined based on the plurality of requests, the plurality of responses, and correlations between field-value combinations of historical computing interface communications.
19. The system of claim 18 , wherein each of the plurality of requests and each of the plurality of responses further includes a plurality of fields and a plurality of values, wherein the system is further configured to:
identify a miscorrelation based on the plurality of fields and the plurality of values of each of the plurality of requests and each of the plurality of responses.