Automated Collection Rule Generation for Web Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security devices are unable to detect new variants of web application layer attacks until they are manually analyzed, leading to a vulnerability window where networks are exposed to attacks until new security rules can be implemented.
Innovation Solution
An automated system generates collection rules from packets carrying web application layer request messages to perform additional analysis, allowing for the generation of new security rules that can detect unknown attacks without human intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis of attack packets is used to create security rules, then detection accuracy for known attacks is improved, but response time is significantly delayed due to human intervention requirements
Solution Approach 1:
The system performs preliminary automated analysis of attack packets immediately upon detection, extracting attack characteristics and generating security rules without waiting for manual intervention. This preliminary action closes the vulnerability window by proactively creating detection capabilities as attacks are observed, rather than after human analysis completes.
Solution Approach 2:
The patent replaces the mechanical human analysis process with an automated electronic system that extracts attack characteristics from packets, identifies attack types, and generates security rules through computational algorithms. This substitution eliminates human intervention delays while maintaining or improving detection accuracy through consistent automated analysis.
2Speed
If automated rule generation is implemented, then response speed to new attacks is improved, but system complexity increases due to automated analysis requirements
Solution Approach 1:
The automated analysis system is segmented into distinct functional modules: packet capture module, attack characteristic extraction module, attack type identification module, and security rule generation module. Each module performs a specific task, making the overall complex system manageable through modular design where each segment can be independently developed, tested, and maintained.
Solution Approach 2:
The system employs universal attack characteristic extraction mechanisms that can identify multiple attack types (SQL injection, cross-site scripting, buffer overflows) using the same underlying analysis framework. This multi-functionality reduces complexity by avoiding separate specialized systems for each attack type, instead using a single automated system that adapts to various threat patterns.
3Adaptability or versatility
If comprehensive traffic analysis is performed to detect all attack variants, then detection coverage is improved, but processing overhead and false positives increase
Solution Approach 1:
The system applies local quality by focusing analysis on specific attack-relevant characteristics within packets rather than examining all traffic uniformly. Different analysis techniques are applied to different packet types and protocols based on their specific threat profiles, improving detection coverage for each attack variant while minimizing unnecessary processing of benign traffic that would generate false positives.
Solution Approach 2:
The automated system dynamically adjusts analysis parameters such as inspection depth, packet sampling rates, and detection thresholds based on observed traffic patterns and threat levels. This adaptability allows comprehensive analysis when attacks are detected while reducing processing overhead during normal operation, thereby maintaining high detection coverage while minimizing false positives through context-aware parameter adjustment.
Data Source
AI summary
A computing device is described that is coupled to a set of web application layer attack detectors (ADs), which are coupled between clients and web application servers. The ADs apply security rules to traffic between clients and servers and send alert packages to the computing device in response to triggering one or more security rules, which identify web application layer attacks. The computing device automatically generates attribute identifier-value pairs based on alert packages and uses the attribute identifier-value pairs along with collection rule templates to generate collection rules, which are used to inspect traffic for additional analysis. The ADs apply the collection rules to traffic and send collection packages to the computing device in response to triggering one or more collection rules.