Adaptive Security Policy Generation via Sitemap Crawling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for web applications are inadequate in efficiently blocking malicious attacks, as they rely on static security policies that cannot cover all vulnerabilities, especially those characterized by unknown patterns or zero-day attacks, and manual updates are challenging due to dynamic changes in applications.
Innovation Solution
A system generates a security sitemap of the protected application-layer entity using crawlers, analyzers, and repositories to create an adaptive security policy with enforcement rules for resources and client-side input parameters, ensuring comprehensive coverage and dynamic updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual security policy definition is used, then security policy can be customized, but it cannot cover all vulnerabilities and requires frequent updates
Solution Approach 1:
The system enables self-service by automatically generating security policies through sitemap crawling and analysis. The security policy generator autonomously discovers application resources, identifies security rules, and creates enforceable policies without manual intervention, allowing the system to adapt to application changes automatically
Solution Approach 2:
The system performs preliminary action by proactively crawling and analyzing the application sitemap before attacks occur. Security policies are generated in advance based on the discovered application structure, enabling preventive security enforcement rather than reactive updates
2Reliability
If static security policies are enforced, then policy enforcement is simple, but the protected applications remain vulnerable to new attacks
Solution Approach 1:
The system implements dynamics by making security policies adaptive to application changes. When the sitemap is re-crawled and updated, the security policy generator automatically updates the enforcement rules to match the new application structure, ensuring continuous protection against evolving threats
Solution Approach 2:
The system uses feedback by continuously monitoring application changes through sitemap crawling and using this information to update security policies. The loop of crawling → analyzing → generating policies → enforcing creates a feedback mechanism that maintains security effectiveness
3Difficulty of detecting and measuring
If scanners are used to detect flaws, then some vulnerabilities can be identified, but they cannot cover the entire application and miss zero-day attacks
Solution Approach 1:
The system achieves universality by making the security policy enforcement applicable to all discovered application resources through sitemap crawling. Rather than scanning for specific vulnerability patterns, the system generates comprehensive security rules covering all accessible application paths, parameters, and resources
4Ease of operation
If security policies are updated manually, then control over policy changes is maintained, but updates cannot keep pace with dynamic application changes
Solution Approach 1:
The system eliminates manual policy updates by implementing self-service automation. The security policy generator automatically discovers application changes through sitemap crawling and generates updated security policies without human intervention, maintaining both ease of operation and timeliness
Data Source
AI summary
A system for generating a security policy for protecting an application-layer entity. The system comprises a security sitemap generator for generating a security sitemap of a protected application-layer entity, the security sitemap is stored in a first repository connected to the security sitemap generator; and a policy builder for generating a security policy for the application-layer entity based on the security sitemap, the security policy is stored in a second repository connected to the policy builder, wherein the security policy includes a plurality of enforcement rules for at least one of a resource, a group of resources, and a client-side input parameter of at least a portion of the protected application-layer entity.