Implemented New API Security Sampling mechanism #8178
+211
−206
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ValentinZakharov
changed the title
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 52 metrics, 11 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.46.0-SNAPSHOT~bc70627cbd, baseline=1.46.0-SNAPSHOT~9efa100588
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.049 s) : 0, 1049450
Total [baseline] (8.683 s) : 0, 8683227
Agent [candidate] (1.04 s) : 0, 1040398
Total [candidate] (8.657 s) : 0, 8656741
section iast
Agent [baseline] (1.179 s) : 0, 1179261
Total [baseline] (9.281 s) : 0, 9281257
Agent [candidate] (1.179 s) : 0, 1178646
Total [candidate] (9.265 s) : 0, 9264785
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.169 s) : 0, 1169243
Total [baseline] (9.223 s) : 0, 9222932
Agent [candidate] (1.177 s) : 0, 1177352
Total [candidate] (9.28 s) : 0, 9279727
section iast_TELEMETRY_OFF
Agent [baseline] (1.167 s) : 0, 1167160
Total [baseline] (9.226 s) : 0, 9226406
Agent [candidate] (1.166 s) : 0, 1165774
Total [candidate] (9.26 s) : 0, 9260408
gantt
title insecure-bank - break down per module: candidate=1.46.0-SNAPSHOT~bc70627cbd, baseline=1.46.0-SNAPSHOT~9efa100588
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (720.714 ms) : 0, 720714
BytebuddyAgent [candidate] (715.99 ms) : 0, 715990
GlobalTracer [baseline] (242.078 ms) : 0, 242078
GlobalTracer [candidate] (240.16 ms) : 0, 240160
AppSec [baseline] (55.8 ms) : 0, 55800
AppSec [candidate] (56.615 ms) : 0, 56615
Remote Config [baseline] (723.041 µs) : 0, 723
Remote Config [candidate] (720.773 µs) : 0, 721
Telemetry [baseline] (14.731 ms) : 0, 14731
Telemetry [candidate] (11.564 ms) : 0, 11564
section iast
BytebuddyAgent [baseline] (841.715 ms) : 0, 841715
BytebuddyAgent [candidate] (839.954 ms) : 0, 839954
GlobalTracer [baseline] (232.992 ms) : 0, 232992
GlobalTracer [candidate] (232.39 ms) : 0, 232390
IAST [baseline] (25.648 ms) : 0, 25648
IAST [candidate] (25.901 ms) : 0, 25901
AppSec [baseline] (54.177 ms) : 0, 54177
AppSec [candidate] (55.508 ms) : 0, 55508
Remote Config [baseline] (622.393 µs) : 0, 622
Remote Config [candidate] (656.858 µs) : 0, 657
Telemetry [baseline] (8.741 ms) : 0, 8741
Telemetry [candidate] (8.759 ms) : 0, 8759
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (834.525 ms) : 0, 834525
BytebuddyAgent [candidate] (840.018 ms) : 0, 840018
GlobalTracer [baseline] (230.682 ms) : 0, 230682
GlobalTracer [candidate] (232.022 ms) : 0, 232022
IAST [baseline] (27.179 ms) : 0, 27179
IAST [candidate] (27.332 ms) : 0, 27332
AppSec [baseline] (52.254 ms) : 0, 52254
AppSec [candidate] (53.279 ms) : 0, 53279
Remote Config [baseline] (617.95 µs) : 0, 618
Remote Config [candidate] (616.647 µs) : 0, 617
Telemetry [baseline] (8.708 ms) : 0, 8708
Telemetry [candidate] (8.663 ms) : 0, 8663
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (831.572 ms) : 0, 831572
BytebuddyAgent [candidate] (830.701 ms) : 0, 830701
GlobalTracer [baseline] (230.799 ms) : 0, 230799
GlobalTracer [candidate] (230.821 ms) : 0, 230821
IAST [baseline] (23.87 ms) : 0, 23870
IAST [candidate] (24.338 ms) : 0, 24338
AppSec [baseline] (56.276 ms) : 0, 56276
AppSec [candidate] (55.466 ms) : 0, 55466
Remote Config [baseline] (625.939 µs) : 0, 626
Remote Config [candidate] (608.744 µs) : 0, 609
Telemetry [baseline] (8.72 ms) : 0, 8720
Telemetry [candidate] (8.521 ms) : 0, 8521
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.46.0-SNAPSHOT~bc70627cbd, baseline=1.46.0-SNAPSHOT~9efa100588
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.043 s) : 0, 1042589
Total [baseline] (10.534 s) : 0, 10534162
Agent [candidate] (1.041 s) : 0, 1041043
Total [candidate] (10.505 s) : 0, 10505175
section appsec
Agent [baseline] (1.186 s) : 0, 1186174
Total [baseline] (10.776 s) : 0, 10776443
Agent [candidate] (1.19 s) : 0, 1189611
Total [candidate] (10.803 s) : 0, 10802686
section iast
Agent [baseline] (1.17 s) : 0, 1169591
Total [baseline] (11.056 s) : 0, 11056292
Agent [candidate] (1.169 s) : 0, 1169060
Total [candidate] (10.962 s) : 0, 10961509
section profiling
Agent [baseline] (1.268 s) : 0, 1268467
Total [baseline] (10.96 s) : 0, 10960445
Agent [candidate] (1.259 s) : 0, 1259066
Total [candidate] (10.838 s) : 0, 10837701
gantt
title petclinic - break down per module: candidate=1.46.0-SNAPSHOT~bc70627cbd, baseline=1.46.0-SNAPSHOT~9efa100588
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (717.481 ms) : 0, 717481
BytebuddyAgent [candidate] (714.608 ms) : 0, 714608
GlobalTracer [baseline] (240.584 ms) : 0, 240584
GlobalTracer [candidate] (240.375 ms) : 0, 240375
AppSec [baseline] (56.025 ms) : 0, 56025
AppSec [candidate] (57.132 ms) : 0, 57132
Remote Config [baseline] (730.986 µs) : 0, 731
Remote Config [candidate] (721.165 µs) : 0, 721
Telemetry [baseline] (12.463 ms) : 0, 12463
Telemetry [candidate] (12.932 ms) : 0, 12932
section appsec
BytebuddyAgent [baseline] (736.004 ms) : 0, 736004
BytebuddyAgent [candidate] (737.61 ms) : 0, 737610
GlobalTracer [baseline] (238.477 ms) : 0, 238477
GlobalTracer [candidate] (239.142 ms) : 0, 239142
AppSec [baseline] (176.556 ms) : 0, 176556
AppSec [candidate] (177.597 ms) : 0, 177597
Remote Config [baseline] (658.336 µs) : 0, 658
Remote Config [candidate] (684.471 µs) : 0, 684
Telemetry [baseline] (8.32 ms) : 0, 8320
Telemetry [candidate] (8.315 ms) : 0, 8315
IAST [baseline] (21.636 ms) : 0, 21636
IAST [candidate] (21.742 ms) : 0, 21742
section iast
BytebuddyAgent [baseline] (833.816 ms) : 0, 833816
BytebuddyAgent [candidate] (833.049 ms) : 0, 833049
GlobalTracer [baseline] (231.346 ms) : 0, 231346
GlobalTracer [candidate] (230.669 ms) : 0, 230669
AppSec [baseline] (53.883 ms) : 0, 53883
AppSec [candidate] (55.061 ms) : 0, 55061
Remote Config [baseline] (619.934 µs) : 0, 620
Remote Config [candidate] (614.745 µs) : 0, 615
Telemetry [baseline] (8.822 ms) : 0, 8822
Telemetry [candidate] (8.749 ms) : 0, 8749
IAST [baseline] (25.743 ms) : 0, 25743
IAST [candidate] (24.865 ms) : 0, 24865
section profiling
ProfilingAgent [baseline] (97.038 ms) : 0, 97038
ProfilingAgent [candidate] (95.403 ms) : 0, 95403
BytebuddyAgent [baseline] (710.465 ms) : 0, 710465
BytebuddyAgent [candidate] (705.181 ms) : 0, 705181
GlobalTracer [baseline] (353.369 ms) : 0, 353369
GlobalTracer [candidate] (351.413 ms) : 0, 351413
AppSec [baseline] (55.449 ms) : 0, 55449
AppSec [candidate] (55.117 ms) : 0, 55117
Remote Config [baseline] (715.128 µs) : 0, 715
Remote Config [candidate] (724.169 µs) : 0, 724
Telemetry [baseline] (8.978 ms) : 0, 8978
Telemetry [candidate] (8.891 ms) : 0, 8891
Profiling [baseline] (97.065 ms) : 0, 97065
Profiling [candidate] (95.429 ms) : 0, 95429
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 13 metrics, 15 unstable metrics. Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~bc70627cbd, baseline=1.46.0-SNAPSHOT~9efa100588
dateFormat X
axisFormat %s
section baseline
no_agent (1.35 ms) : 1331, 1368
. : milestone, 1350,
appsec (1.744 ms) : 1720, 1767
. : milestone, 1744,
appsec_no_iast (1.754 ms) : 1728, 1779
. : milestone, 1754,
iast (1.53 ms) : 1506, 1553
. : milestone, 1530,
profiling (1.49 ms) : 1467, 1514
. : milestone, 1490,
tracing (1.498 ms) : 1474, 1523
. : milestone, 1498,
section candidate
no_agent (1.359 ms) : 1340, 1379
. : milestone, 1359,
appsec (1.742 ms) : 1718, 1765
. : milestone, 1742,
appsec_no_iast (1.777 ms) : 1753, 1801
. : milestone, 1777,
iast (1.522 ms) : 1498, 1546
. : milestone, 1522,
profiling (1.497 ms) : 1473, 1520
. : milestone, 1497,
tracing (1.484 ms) : 1460, 1509
. : milestone, 1484,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~bc70627cbd, baseline=1.46.0-SNAPSHOT~9efa100588
dateFormat X
axisFormat %s
section baseline
no_agent (378.789 µs) : 359, 399
. : milestone, 379,
iast (510.432 µs) : 487, 534
. : milestone, 510,
iast_FULL (743.322 µs) : 721, 765
. : milestone, 743,
iast_GLOBAL (571.597 µs) : 547, 596
. : milestone, 572,
iast_HARDCODED_SECRET_DISABLED (507.318 µs) : 485, 530
. : milestone, 507,
iast_INACTIVE (461.632 µs) : 441, 483
. : milestone, 462,
iast_TELEMETRY_OFF (508.443 µs) : 485, 532
. : milestone, 508,
tracing (458.983 µs) : 438, 480
. : milestone, 459,
section candidate
no_agent (382.204 µs) : 363, 402
. : milestone, 382,
iast (512.523 µs) : 491, 534
. : milestone, 513,
iast_FULL (741.742 µs) : 720, 764
. : milestone, 742,
iast_GLOBAL (550.786 µs) : 528, 573
. : milestone, 551,
iast_HARDCODED_SECRET_DISABLED (519.471 µs) : 496, 543
. : milestone, 519,
iast_INACTIVE (460.696 µs) : 440, 481
. : milestone, 461,
iast_TELEMETRY_OFF (496.775 µs) : 474, 519
. : milestone, 497,
tracing (457.267 µs) : 436, 479
. : milestone, 457,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~bc70627cbd, baseline=1.46.0-SNAPSHOT~9efa100588
dateFormat X
axisFormat %s
section baseline
no_agent (15.481 s) : 15481000, 15481000
. : milestone, 15481000,
appsec (15.1 s) : 15100000, 15100000
. : milestone, 15100000,
iast (18.865 s) : 18865000, 18865000
. : milestone, 18865000,
iast_GLOBAL (17.86 s) : 17860000, 17860000
. : milestone, 17860000,
profiling (14.961 s) : 14961000, 14961000
. : milestone, 14961000,
tracing (14.911 s) : 14911000, 14911000
. : milestone, 14911000,
section candidate
no_agent (15.262 s) : 15262000, 15262000
. : milestone, 15262000,
appsec (14.681 s) : 14681000, 14681000
. : milestone, 14681000,
iast (18.35 s) : 18350000, 18350000
. : milestone, 18350000,
iast_GLOBAL (18.049 s) : 18049000, 18049000
. : milestone, 18049000,
profiling (15.582 s) : 15582000, 15582000
. : milestone, 15582000,
tracing (14.854 s) : 14854000, 14854000
. : milestone, 14854000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~bc70627cbd, baseline=1.46.0-SNAPSHOT~9efa100588
dateFormat X
axisFormat %s
section baseline
no_agent (1.467 ms) : 1455, 1478
. : milestone, 1467,
appsec (2.355 ms) : 2311, 2398
. : milestone, 2355,
iast (2.098 ms) : 2043, 2153
. : milestone, 2098,
iast_GLOBAL (2.15 ms) : 2094, 2205
. : milestone, 2150,
profiling (1.956 ms) : 1912, 2000
. : milestone, 1956,
tracing (1.933 ms) : 1891, 1975
. : milestone, 1933,
section candidate
no_agent (1.462 ms) : 1451, 1474
. : milestone, 1462,
appsec (2.358 ms) : 2315, 2401
. : milestone, 2358,
iast (2.102 ms) : 2048, 2157
. : milestone, 2102,
iast_GLOBAL (2.149 ms) : 2094, 2205
. : milestone, 2149,
profiling (1.968 ms) : 1924, 2011
. : milestone, 1968,
tracing (1.943 ms) : 1901, 1986
. : milestone, 1943,
|
|
Hi! 👋 Thanks for your pull request! 🎉 To help us review it, please make sure to:
If you need help, please check our contributing guidelines. |
|
Does the motivation make sense for this PR?
|
| } | ||
|
|
||
| private long computeApiHash(String route, String method, int statusCode) { | ||
| long result = 17; |
There was a problem hiding this comment.
You can get the same with just Objects.hash(route, method, statusCode)
There was a problem hiding this comment.
I think the point here is getting a 64bit hash, rather than the default 32bit.
| public ApiAccessTracker(int capacity, long expirationTimeInMs) { | ||
| this.expirationTimeInMs = expirationTimeInMs; | ||
| this.apiAccessLog = | ||
| Collections.synchronizedMap( |
There was a problem hiding this comment.
Probably you can live without the synchronizedMap, since all the access to the map are already behind a synchronized (apiAccessLog) block.
There was a problem hiding this comment.
Improved implementation
| Collections.synchronizedMap( | ||
| new LinkedHashMap<Long, Long>() { | ||
| @Override | ||
| protected boolean removeEldestEntry(Map.Entry<Long, Long> eldest) { |
manuel-alvarez-alvarez
approved these changes
Jan 15, 2025
jbachorik
reviewed
Jan 15, 2025
| long currentTime = System.currentTimeMillis(); | ||
| long hash = computeApiHash(route, method, statusCode); | ||
|
|
||
| synchronized (apiAccessLog) { |
There was a problem hiding this comment.
I am a bit uneasy about introducing a global bottleneck at a place which might be called from many threads and rather frequently, IIUC.
I know that reducing contention here will require a more complex code because you would not be able to use the trick with the LinkedHashMap but if this is going to be called on a hot-path, the extra complexity might be unavoidable.
I wonder, do you need to keep exact capacity limit or it would be ok if the capacity is mostly obeyed (with some fluctuation around the target value due to concurrent updates/cleanups)? If the exact capacity is not required it should help with a simpler implementation.
There was a problem hiding this comment.
Reworked implementation of ApiAccessTracker to avoid bottleneck
smola
added
comp: asm waf
ValentinZakharov
force-pushed
the
vzakharov/api_sec_sampling_new
branch
from
08d9b7f to
bc70627
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Implemented new endpoint based API Security Sampling mechanism.
Motivation
For API Security we need to compute and send schemas for HTTP requests. A schema contains information about the types of data transmitted in an HTTP request.
The schemas we compute/collect:
Computing schemas is a resource-consuming task and introduces additional overhead. In the current implementation, schema computation occurs in the same thread that processes the HTTP request. The computation happens after committing the response to the client. This means that even after the response is sent, the thread remains occupied with schema computation. If all threads are busy with such computations, new requests will have to wait for a free thread. This can lead to increased response times or even a denial of service.
Requests to the same endpoint with the same method and parameters generally have a stable data structure. This makes repeated schema computations redundant in most cases. To optimize this, we introduced the Api Security Sampling mechanism, which skips redundant computations for identical schemas. Schema computation is performed only when a new unique request is encountered or when the previously cached schema has expired.
To implement Sampling, we use the ApiAccessTracker, which caches request by recording combinations of route, method, and status. These records are temporarily stored in memory, and Sampling checks them to determine whether a schema for the given combination has already been computed. If the schema is missing or has expired (more than 30 seconds have passed), it triggers a new computation.
Api Security Sampling reduces computational overhead by decreasing the number of unique schema computation operations. This decreases CPU usage and speeds up request processing.
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any usefull labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: [PROJ-IDENT]