Web Application Attack Detector Attribute Value Generation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current security systems face challenges in detecting and preventing web application layer attacks, particularly in automatically generating attribute values for security rules and addressing 'zero-day' attacks, which creates a vulnerability window before new protections can be implemented.

Innovation Solution

A method and system for automatically generating new attribute values for security rules in a web application layer attack detector, using alert packages to identify and adapt to changing attack patterns without relying on web application layer response messages, enabling continuous detection and prevention of attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If security rules use fixed attribute values, then the rule structure is simple and easy to manage, but the system cannot adapt to new attack variants

Engineering Contradiction:

Improveadaptability to new attack variantsVSAvoidcomplexity of rule management

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system pre-generates multiple possible attribute values for each attribute identifier before they are needed. When a new attack is detected, the system can immediately use pre-generated values without waiting for manual creation, reducing the vulnerability window while maintaining manageable complexity through automated preprocessing

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system automatically generates and manages attribute values without requiring manual intervention. The attribute value generation module continuously creates new values and the system self-updates its rule sets, enabling adaptation to new attacks while keeping the management process simple and automated

Inventive Principle:

Principle #25Self-service

2Reliability

If manual updates to security rules are used, then the system is easy to control, but there is a delay in protecting against zero-day attacks

Engineering Contradiction:

Improveprotection effectivenessVSAvoidvulnerability window duration

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system implements automated feedback loops where attack detection results are immediately fed back into the attribute value generation module. This closed-loop system continuously learns from new attacks and automatically updates protection rules, ensuring reliable protection while eliminating the time delay associated with manual updates

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The attribute value generation operates continuously rather than periodically or on-demand. The system maintains an ongoing process of generating, validating, and updating attribute values, ensuring that protection is always current and the vulnerability window is minimized while maintaining controlled reliability

Inventive Principle:

Principle #20Continuity of useful action

3Speed

If the system waits for web application layer response messages to generate attribute values, then the detection process is simple, but the response time is too slow for real-time protection

Engineering Contradiction:

Improveattribute value generation speedVSAvoidcomplexity of detection process

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The system generates attribute values in advance based on alert packages and lower-layer packet information, eliminating the need to wait for web application layer response messages. This preliminary generation occurs during the alert processing stage, significantly speeding up attribute value availability while managing complexity through structured preprocessing

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of generating attribute values after receiving response messages (traditional approach), the system inverts the sequence by generating values from alert packages and lower-layer data before response messages are available. This reversal enables real-time protection while managing complexity through alternative data sources

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS11063960B2Automatic generation of attribute values for rules of a web application layer attack detector

Publication Date: 2021.07.13 IMPERVA INC

AI summary

According to one embodiment, a web application layer attack detector (AD) is coupled between an HTTP client and a web application server. Responsive to receipt of a set of packets from the HTTP client carrying a web application layer message that violates a condition of a security rule, the AD transmits an alert package to an automatic attribute value generation and rule feedback module (AVGRFM). The AVGRFM uses the alert package, and optionally other alert packages from the same AD or other ADs, to automatically generate a new set of attribute values for each of a set of attribute identifiers for use, by the AD or other ADs, in a different security rule than the violated security rule. The new set of attribute values may be used in an attack specific rule to detect a previously unknown web application layer attack.