Application firewalls based on self-modeling service flows

Patent metadata

Field	Value
Publication number	US-11831608-B2
Application number	US-202016773322-A
Country	US
Kind code	B2
Filing date	Jan 27, 2020
Priority date	Jan 27, 2020
Publication date	Nov 28, 2023
Grant date	Nov 28, 2023

Abstract

In various examples, firewalls may include machine learning models that are automatically trained and applied to analyze service inputs submitted to input processing services and to identify whether service inputs are desirable (e.g., will result in an undesirable status code if processed by a service). When a service input is determined by a firewall to be desirable, the firewall may push the service input through to the input processing service for normal processing. When a service input is determined by the firewall to be undesirable, the firewall may block or drop the service input before it reaches the input processing service and/or server. This may be used to prevent the service input, which is likely to be undesirable, from touching a server that hosts the input processing service (e.g., preventing a crash).

First claim

What is claimed is:

1. A method comprising:
receiving, from one or more network communications, first data representative of a service input and an application identifier that indicates a service for processing the service input, the application identifier being of an application corresponding to the service;
intercepting, by a firewall system the service input prior to a computing system processing the service input;
selecting, based at least on the application that corresponds to the service, a schema from a plurality of schemas;
generating, according to the schema, a representation of the service input;
selecting by the firewall system, using the application identifier and from a plurality of machine learning models (MLMs), a machine learning model (MLM) to evaluate the service input;
providing the representation of the service input as an input to the MLM selected from the plurality of MLMs;
evaluating, by the firewall system, using the MLM selected from the plurality of MLMs, the representation of the service input to generate a confidence score corresponding to one or more status codes for the service input, wherein the MLM is trained to predict the one or more status codes that would be generated as output by the computing system responsive to the computing system processing the service input using the service;
comparing, by the firewall system, the confidence score with a predefined threshold value; and
blocking, by the firewall system, the service from initiating the processing of the service input based at least on the comparing indicating the confidence score is below the predefined threshold value.

2. The method of claim 1 , wherein the generating the representation of the service input includes:
vectorizing the service input using the schema to generate a vectorized representation of the service input.

3. The method of claim 1 , wherein the MLM is further trained to predict one or more likelihoods that the one or more status codes for the service input would be valid, and the blocking is based at least on determining, using the one or more likelihoods, the one or more status codes are invalid for the service input.

4. The method of claim 1 , wherein the MLM is trained using ground truth labels for a plurality of service inputs, the ground truth labels including a plurality of status codes output by one or more instances of the service responsive to the one or more instances processing the plurality of service inputs.

5. The method of claim 1 , wherein the MLM is trained using output by one or more instances of the service and a second MLM of the plurality of MLMs is trained using second output by one or more instances of a second service.

6. The method of claim 1 , wherein the one or more status codes correspond to one or more of a predicted fault occurring in the computing system, a predicted error being generated in the computing system, or a predicted crash occurring in the computing system.

7. The method of claim 1 , wherein the one or more status codes include one or more HyperText Tra nsfer Protocol status codes.

8. The method of claim 1 , wherein the MLM is trained using data representing one or more outputs produced by the computing system as one or more ground truth outputs for the MLM.

9. The method of claim 1 , wherein the MLM comprises at least one of a discriminator of a Generative Adversarial Network (GAN) or a multi-step-ahead forecasting model.

10. A processor comprising:
one or more circuits to:
receive, from one or more network communications, first data representative of a service input and an application identifier that indicates a service for processing the service input, the application identifier being of an application corresponding to the service;
intercept, by a firewall system the service input prior to a computing system processing the service input;
select, based at least on the application that corresponds to the service, a schema from a plurality of schemas;
generate, according to the schema, a representation of the service input;
select by the firewall system, using the application identifier and from a plurality of machine learning models (MLMs), a machine learning model (MLM) to evaluate the service input;
provide the representation of the service input as an input to the MLM selected from the plurality of MLMs;
evaluate, by the firewall system, using the MLM selected from the plurality of MLMs, the representation of the service input to generate a confidence score corresponding to one or more status codes for the service input, wherein the MLM is trained to predict the one or more status codes that would be generated as output by the computing system responsive to the computing system processing the service input using the service;
compare, by the firewall system, the confidence score with a predefined threshold value; and
block, by the firewall system, the service from initiating the processing of the service input based at least on the comparing indicating the confidence score is below the predefined threshold value.

11. The processor of claim 10 , wherein the firewall system corresponds to a front end of the computing system and receives the MLM from a back end of the computing system for the evaluating of the representation of the service input.

12. The processor of claim 10 , wherein the blocking is based at least on applying security rules to one or more predictions generated using the MLM.

13. The processor of claim 10 , wherein the MLM includes a discriminator that predicts the confidence score.

14. The processor of claim 10 , wherein the blocking is based at least on at least one status code of the one or more status codes indicating a server error would result from the computing system processing the service input.

15. The processor of claim 10 , wherein the one or more status codes correspond to one or more of a predicted fault occurring in the computing system, a predicted error being generated in the computing system, or a predicted crash occurring in the computing system.

16. The processor of claim 10 , wherein the MLM is trained using data representing one or more outputs produced by the computing system as one or more ground truth outputs for the MLM.

17. A system comprising:
one or more hardware processing devices to cause instantiation of a firewall system to perform operations including:
receiving, from one or more network communications, first data representative of a service input and an application identifier that indicates a service for processing the service input, the application identifier being of an application corresponding to the service;

intercepting the service input prior to a computing system processing the service input;
selecting, based at least on the application that corresponds to the service, a schema from a plurality of schemas;
generating, according to the schema, a representation of the service input;
selecting, using the application identifier and from a plurality of machine learning models (MLMs), a machine learning model (MLM) to evaluate the service input;
providing the representation of the service input as an input to the MLM selected from the plurality of MLMs;
evaluating, using the MLM selected from the plurality of MLMs, the representation of the service input to generate a confidence score corresponding to one or more status codes for the service input, wherein the MLM is trained to predict the one or more status codes that would be generated as output by the computing system responsive to the computing system processing the service input using the

Assignees

• Nvidia Corp

Inventors

• Schneider Christopher
• Bartig William
• Rohrer Daniel
• Woodard Andrew

Classifications

• G06N3/09

  Supervised learning · CPC title

• G06N3/094

  Adversarial learning · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06N3/0475

  Generative networks · CPC title

• H04L63/0245 Primary

  Filtering by information in the payload · CPC title