Command Injection Analysis Using Emulated Attack Intent Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to identify the intention of OS command injection attacks, making it difficult to effectively countermeasure the potential damage.
Innovation Solution
An analysis device that extracts and executes attack command strings, determines the intention of the attack using an emulator, and outputs the identified intention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a web application firewall is used to detect OS command injection attacks, then attack detection capability is improved, but the ability to identify attack intention deteriorates
Solution Approach 1:
The patent introduces an emulator as an intermediary component between the WAF and the analysis system. The emulator executes the extracted attack command strings in a controlled virtual environment, allowing the system to observe the actual behavior and effects of the commands without directly impacting the target system. This intermediary execution layer provides detailed information about the attack intention that cannot be obtained through pattern matching alone.
Solution Approach 2:
The patent creates a virtual copy of the target system environment through the emulator. Instead of analyzing the actual target system, the system analyzes a replicated environment where attack commands can be safely executed. The emulator reproduces the necessary system calls, file operations, and network behaviors, allowing comprehensive analysis of attack intentions without risking the integrity of the real system.
2Loss of information
If attack command strings are extracted and executed to identify attack intention, then attack intention identification is improved, but system complexity increases
Solution Approach 1:
The patent divides the analysis system into distinct functional modules: a WAF module for detecting command injection attacks, an extraction module for isolating attack command strings from requests, an emulator module for executing commands in a virtual environment, and an analysis module for determining attack intentions. This segmentation allows each component to be developed, maintained, and optimized independently, reducing overall system complexity despite the sophisticated functionality.
Solution Approach 2:
The emulator serves as an intermediary that handles the complexity of command execution and environment simulation. By offloading the complex tasks of interpreting and executing various OS commands in different system contexts to the specialized emulator component, the rest of the system can focus on higher-level detection and analysis functions, thereby managing overall system complexity.
3Reliability
If detailed analysis of attack commands is performed, then countermeasure effectiveness is improved, but analysis time increases
Solution Approach 1:
The patent performs preliminary extraction and classification of attack command strings before full execution analysis. The WAF pre-identifies potential command injection patterns and extracts the malicious command portions, preparing them for emulation. This preliminary processing filters out benign traffic early and prepares only suspicious commands for detailed emulation, reducing the overall analysis time while maintaining thoroughness for actual attacks.
Solution Approach 2:
The system implements a tiered analysis approach where obviously malicious commands are quickly identified and flagged without full emulation, while ambiguous cases receive more detailed analysis. The WAF uses pattern matching to rapidly filter and prioritize commands, skipping detailed emulation for clearly benign or obviously malicious cases, and reserving resource-intensive emulation for borderline cases that require deeper inspection.
Data Source
AI summary
When an attack by command injection is detected, an analysis device (10) extracts an attack command string inserted for the attack from an attack request transmitted in the attack, and acquires information obtained by executing the extracted attack command string. Also, the analysis device (10) determines an intention of the attack by the command injection using the acquired information, and outputs information indicating the determined intention of the attack.