Browser Plug-in Propagation Graph for Worm Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current worm detection techniques are ineffective in distinguishing between benign and malicious HTTP requests, particularly in the context of self-propagating JavaScript worms that exploit cross-site scripting vulnerabilities, and are prone to false positives due to polymorphic or obfuscated payloads, leading to potential resource exhaustion and user frustration.
Innovation Solution
A system that monitors requests and replies to a server, creating a propagation graph with uniquely tagged data to track causality links between client systems, allowing for the identification of potential worm propagation by analyzing the graph's structure and size, thereby containing further uploads and preventing worm spread.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If server-side detection is used to distinguish benign from malicious HTTP requests, then worm detection capability is improved, but the system cannot differentiate between user-performed and worm-performed requests leading to false positives
Solution Approach 1:
The patent introduces a browser plug-in as an intermediary component between the user's browser and the web server. This plug-in is responsible for attaching session IDs to HTTP requests and maintaining the propagation graph, thereby enabling precise tracking of request origins without burdening the server with detection logic. The plug-in acts as a mediator that bridges client-side behavior tracking and server-side worm detection needs.
Solution Approach 2:
The detection system is segmented into distinct components: a browser plug-in running on the client side that attaches session IDs to requests and maintains local propagation graphs, and a server-side component that receives propagation graph data and performs worm detection analysis. This segmentation allows each component to specialize in its strength - the plug-in in precise request tracking and the server in comprehensive worm pattern recognition.
2Reliability
If filtering solutions relying on worm signatures are used, then worm detection is improved, but polymorphic or obfuscated payloads cause false negatives and overly strict filters cause false positives
Solution Approach 1:
The system performs preliminary action by attaching session IDs to HTTP requests before the requests reach the server, and by maintaining propagation graphs that track the origin and flow of requests. This proactive tracking enables the system to identify worm propagation patterns based on request relationships rather than payload content, allowing detection of worms regardless of their obfuscation or polymorphic transformations.
Solution Approach 2:
The system implements feedback mechanisms where the server receives propagation graph data from multiple clients and uses this information to identify worm propagation patterns. The detection results can feed back into updating detection rules or alerting system administrators, creating a continuous improvement loop that adapts to new worm variants without requiring manual signature updates.
3Reliability
If comprehensive monitoring of all HTTP requests is implemented, then worm propagation detection is improved, but system overhead and resource consumption increase
Solution Approach 1:
The patent extracts the heavy lifting of request tracking and propagation graph maintenance from the server and places it in the browser plug-in. The server only receives pre-processed propagation graph data for analysis, significantly reducing its computational overhead. This extraction allows comprehensive monitoring to be performed with minimal server resource consumption while maintaining high detection reliability.
Solution Approach 2:
The browser plug-in performs self-service by automatically attaching session IDs to requests, maintaining local propagation graphs, and sending relevant data to the server without requiring server-side intervention for each request. This self-service approach enables comprehensive monitoring while keeping server overhead minimal, as the server only needs to process periodic propagation graph submissions rather than analyzing every individual HTTP request.
Data Source
AI summary
Embodiments gather historical information about data propagation by monitoring requests to and replies from a server. When a request is received from a client system to upload code onto a web site, a user identity associated with the client system is determined and a tag that uniquely identifies the uploaded data is created and mapped with the user identity into a propagation graph. The propagation graph includes nodes and edges associated with a number of client systems that made similar requests such that each node of the propagation graph corresponds to both a tag and user identity of a client system and edges within the propagation graph represent causality links between the nodes. The propagation graph can then be used for finding long propagation chains, which can be useful for detecting worm-like propagation activity.