Accelerated policy assessment for requests
A computer-implemented method, according to one approach, is performed in response to intercepting an application request. The computer-implemented method includes forwarding a first copy of the application request to a policy agent, and forwarding a second copy of the application request to a sketch algorithm. The sketch algorithm extracts metadata from the second copy of the application request. Moreover, the policy agent applies a security policy to the first copy of the application request and the metadata extracted by the sketch algorithm. Furthermore, the application request is dispositioned based at least in part on whether the first copy of the application request and/or the metadata extracted by the sketch algorithm satisfy the security policy.
1 . A computer-implemented method (CIM), comprising:
in response to intercepting an application request:
causing a first copy of the application request to be forwarded to a policy agent,
causing a second copy of the application request to be forwarded to a sketch algorithm, wherein the first copy and second copy of the application request are forwarded to the policy agent and the sketch algorithm simultaneously; and
causing the sketch algorithm to extract metadata from the second copy of the application request includes:
accessing Layer 7 metadata in the second copy of the application request; and
applying a width while summarizing the streaming traffic of the Layer 7 and wherein the width is determined while training the sketch algorithm, by:
causing the policy agent to forward network traffic to the sketch algorithm; and
in response to detecting diverse active network traffic, causing the sketch algorithm to dynamically increase the width;
in response to detecting lean active network traffic, causing the sketch algorithm to dynamically decrease the width;
causing the policy agent to apply a security policy to the first copy of the application request and the metadata extracted by the sketch algorithm; and
dispositioning the application request based at least in part on whether the first copy of the application request and/or the metadata extracted by the sketch algorithm satisfy the security policy, wherein the application request is intercepted by a proxy.
2 . The CIM of claim 1 , wherein the width is determined while training the sketch algorithm, by:
causing the policy agent to forward all network traffic to the sketch algorithm;
causing the sketch algorithm to observe the network traffic for a predetermined amount of time; and
identifying a width that most effectively summarizes the network traffic.
3 . The CIM of claim 1 , wherein the width is dynamically updated over time, by:
observing active network traffic for a predetermined amount of time; in
response to detecting diverse active network traffic, increasing the width; and in
response to detecting lean active network traffic, decreasing the width.
4 . The CIM of claim 1 , wherein the Layer 7 metadata is selected from the group consisting of: service names, authentication tokens, Uniform Resource Locator (URL) paths, session tokens, cookies, and HTTP response codes.
5 . The CIM of claim 1 , wherein the dispositioning of the application request, includes:
in response to determining the first copy of the application request and/or the metadata extracted by the sketch algorithm satisfy the security policy, causing the application request to be forwarded to a target application for implementation.
6 . The CIM of claim 5 , wherein the dispositioning of the application request, includes:
in response to determining the first copy of the application request and/or the metadata extracted by the sketch algorithm do not satisfy the security policy, causing the application request to be rejected.
7 . A computer program product (CPP), comprising:
a set of one or more computer-readable storage media; and
program instructions, collectively stored in the set of one or more storage media, for causing a processor set to perform the following computer operations:
in response to intercepting an application request:
cause a first copy of the application request to be forwarded to a policy agent, and
cause a second copy of the application request to be forwarded to a sketch algorithm
cause the sketch algorithm to:
extract metadata from the second copy of the application request includes:
accessing Layer 7 metadata in the second copy of the application request;
and applying a width while summarizing the Streaming traffic of the Layer 7; and
store the metadata extracted by the sketch algorithm in a designated portion of memory allocated to the sketch algorithm, the designated portion of memory having a width determined while training the sketch algorithm;
cause the policy agent to apply a security policy to the first copy of the application request and the metadata extracted by the sketch algorithm; and
disposition the application request based at least in part on whether the first copy of the application request and/or the metadata extracted by the sketch algorithm satisfy the security policy wherein the width is dynamically updated over time, by:
observing active network traffic for a predetermined amount of time; in response to detecting diverse active network traffic, increasing the width of the designated portion of memory allocated to the sketch algorithm; and
in response to detecting lean active network traffic, decreasing the width of the designated portion of memory allocated to the sketch algorithm.
8 . The CPP of claim 7 , wherein the first and second copies of the application request are forwarded to the policy agent and the sketch algorithm simultaneously.
9 . The CPP of claim 7 , wherein the application request is intercepted by a proxy.
10 . The CPP of claim 7 , wherein the width is determined while training the sketch algorithm, by:
causing the policy agent to forward all network traffic to the sketch algorithm;
causing the sketch algorithm to observe the network traffic for a predetermined amount of time;
determining an amount of the memory that most effectively summarizes the network traffic for the predetermined amount of time; and
presetting the width as the determined amount of the memory.
11 . The CPP of claim 7 , wherein the Layer 7 metadata is selected from the group consisting of: service names, authentication tokens, Uniform Resource Locator (URL) paths, session tokens, cookies, and HTTP response codes.
12 . The CPP of claim 7 , wherein the dispositioning of the application request, includes:
in response to determining the first copy of the application request and/or the metadata extracted by the sketch algorithm satisfy the security policy, causing the application request to be forwarded to a target application for implementation.
13 . The CPP of claim 12 , wherein the dispositioning of the application request, includes:
in response to determining the first copy of the application request and/or the metadata extracted by the sketch algorithm do not satisfy the security policy, causing the application request to be rejected.
14 . A computer system (CS), comprising:
a processor set;
a set of one or more computer-readable storage media;
program instructions, collectively stored in the set of one or more storage media, for causing the processor set to perform the following computer operations:
in response to intercepting an application request:
cause a first copy of the application request to be forwarded to a policy agent, and
cause a second copy of the application request to be forwarded to a sketch algorithm
cause the sketch algorithm to:
extract metadata from the second copy of the application request includes:
accessing Layer 7 metadata in the second copy of the application request;
and applying the width while summarizing the Streaming traffic of the Layer 7; and
store the metadata extracted by the sketch algorithm in a designated portion of memory allocated to the sketch algorithm, the designated portion of memory having a width determined while training the sketch algorithm;
cause the policy agent to apply a security policy to the first copy of the application request and the metadata extracted by the sketch algorithm; and
disposition the application request based at least in part on whether the first copy of the application request and/or the metadata extracted by the sketch algorithm satisfy the security policy wherein the width is dynamically updated over time, by:
observing active network traffic for a predetermined amount of time; in response to detecting diverse active network traffic, increasing the width of the designated portion of memory allocated to the sketch algorithm; and
in response to detecting lean active network traffic, decreasing the width of the designated portion of memory allocated to the sketch algorithm.