Frictionless supplementary multi-factor authentication for sensitive transactions within an application session

1. A method for applying a security policy by an application security system to a transaction within an application that is monitored by the application security system, the method comprising:

monitoring transactions occurring between a client device and the application over a network;

identifying a first transaction from the transactions as a sensitive transaction at least in part by applying a supervised machine learning algorithm to identify a transaction name that is associated with the sensitive transaction, wherein the sensitive transaction is associated with an authentication policy requiring an authentication that is more trustworthy than an authentication for a non-sensitive transaction;

interrupting the application; and

prompting the client device for the authentication.

2. The method of claim 1 , further comprising:

defining the authentication policy for a class of transactions, wherein the authentication policy requires an authentication for the class of transactions, wherein the first transaction is in the class of transactions.

3. The method of claim 2 , wherein the authentication policy requires a multifactor authentication, a continuous multifactor authentication, a supplementary password authentication, a secret question authentication, a Yubikey check, or an explicit device-driven facial recognition authentication.

4. The method of claim 2 , wherein the class of transactions is defined by a transaction name, wherein the transaction name is a concatenation of a TCP socket and a URI stem, or a customized name.

5. The method of claim 1 , wherein identifying the first transaction as the sensitive transaction comprises:

configuring the application security system to classify transactions having the transaction name matching a filter or specific string as sensitive; and

matching the first transaction by its name to the filter or specific string.

6. The method of claim 5 , wherein configuring the application security system to classify the transaction further comprising:

presenting a graphical user interface listing a plurality of transactions recorded by the application security system; and

receiving a selection of a subset of the plurality of transactions in the graphical user interface, wherein the selection of the subset of the plurality of transactions is used to configure the application security system to classify transactions in the selection as sensitive.

7. The method of claim 1 , wherein interrupting the application comprises:

intercepting, by the application security system, a call to an API for sensitive transactions in a runtime environment by using Byte Code Injection into a Java Virtual Machine (JVM).

8. The method of claim 1 , after prompting the client device for the authentication, the method further comprising:

requesting at least one authentication factor from an authentication system;

receiving the at least one authentication factor from the authentication system; and

evaluating a measure of the at least one authentication factor against an authentication threshold.

9. The method of claim 1 further comprising:

before prompting the client device for the authentication, sending, by the application security system, an instruction to an authentication service effective to configure the authentication service to authenticate a user associated with the client device according to a policy; and

after prompting the client device for the authentication, receiving, by the application security system, a confirmation from the authentication service that the user associated with the client device has successfully authenticated according to the policy.

10. The method of claim 1 , further comprising:

receiving, by the application security system, a confirmation from an authentication service that a user associated with the client device has successfully authenticated according to a policy; and

allowing the transaction to proceed.

11. The method of claim 1 , further comprising:

receiving, by the application security system, a notification from an authentication service that a user associated with the client device has not authenticated according to a policy;

sending a notification to the client device indicating that an authentication threshold was not cleared, wherein the notification is configured to be presented by a browser window presenting the application, thereby the notification appears to be presented by the application; and

preventing the transaction from proceeding.

12. The method of claim 1 , wherein the application security system performs the method without altering source code for the application.

13. A system for applying a security policy by an application security system to a transaction within an application that is monitored by the application security system, the system comprising:

at least one processor; and

at least one non-transitory computer-readable medium having stored therein instructions which, when executed by the at least one processor, cause the at least one processor to perform operations comprising:

monitoring transactions occurring between a client device and the application over a network;

identifying a first transaction from the transactions as a sensitive transaction at least in part by applying a supervised machine learning algorithm to identify a transaction name that is associated with the sensitive transaction, wherein the sensitive transaction is associated with an authentication policy requiring an authentication that is more trustworthy than an authentication for a non-sensitive transaction;

interrupting the application; and

prompting the client device for the authentication.

14. The system of claim 13 , wherein the instructions, when executed by the at least one processor, further cause the at least one processor to perform operations comprising:

defining the authentication policy for a class of transactions, wherein the authentication policy requires an authentication for the class of transactions, wherein the first transaction is in the class of transactions.

15. The system of claim 14 , wherein the authentication policy requires a multifactor authentication, a continuous multifactor authentication, a supplementary password authentication, a secret question authentication, a Yubikey check, or an explicit device-driven facial recognition authentication.

16. The system of claim 14 , wherein the class of transactions is defined by a transaction name, wherein the transaction name is a concatenation of a TCP socket and a URI stem, or a customized name.

17. A non-transitory computer-readable medium having stored therein instructions for applying a security policy by an application security system to a transaction within an application that is monitored by the application security system which, when executed by a processor, cause the processor to perform operations comprising:

monitoring transactions occurring between a client device and the application over a network;

identifying a first transaction from the transactions as a sensitive transaction by applying a supervised machine learning algorithm to identify a transaction name that is associated with the sensitive transaction, wherein the sensitive transaction is associated with an authentication policy requiring an authentication that is more trustworthy than an authentication for a non-sensitive transaction;

interrupting the application; and

prompting the client device for the authentication.

18. The non-transitory computer-readable medium of claim 17 , wherein the instructions, when executed by the at least one processor, further cause the processor to perform operations comprising:

receiving, by the application security system, a confirmation from an authentication service that a user associated with the client device has successfully authenticated according to a policy; and

allowing the transaction to proceed.

19. The non-transitory computer-readable medium of claim 17 , wherein the instructions, when executed by the at least one processor, further cause the processor to perform operations comprising:

receiving, by the application security system, a notification from an authentication service that a user associated with the client device has not authenticated according to a policy;

sending a notification to the client device indicating that an authentication threshold was not cleared, wherein the notification is configured to be presented by a browser window presenting the application, thereby the notification appears to be presented by the application; and

preventing the transaction from proceeding.