CSRF Detector Analyzing HTTP Accept Headers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods, such as web reputation services, are ineffective in detecting Cross-Site Request Forgery (CSRF) attacks as they cannot differentiate between legitimate and malicious websites and lack real-time protection, especially against newly compromised sites.
Innovation Solution
A CSRF detector analyzes HTTP communications to identify unauthorized access attempts by intercepting and examining HTTP requests and responses for inconsistencies, such as malicious HTML tags or script executions, and blocks suspicious communications to prevent unauthorized account access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web reputation services are used to guard against malicious websites, then user protection is provided, but real-time protection against newly compromised websites is not achieved
Solution Approach 1:
The system performs preliminary analysis of HTTP responses by examining accept header fields before the user is affected. The CSRF detector pre-analyzes incoming HTTP responses to identify malicious content patterns, so when a user visits a compromised website, the damage is prevented immediately rather than waiting for reputation database updates.
Solution Approach 2:
The invention introduces a CSRF detector as an intermediary component between the web browser and websites. This detector intercepts HTTP communications, analyzes accept header fields for inconsistencies, and blocks malicious content before it reaches the user's browser, providing real-time protection without relying on external reputation databases.
2Reliability
If web reputation services are used to block malicious websites, then some protection is provided, but differentiation between legitimate and compromised legitimate websites is not achieved
Solution Approach 1:
Instead of treating all websites uniformly, the system applies localized analysis to specific HTTP response elements. The CSRF detector examines the accept header field of individual HTTP responses to identify localized inconsistencies that indicate CSRF code injection, allowing precise detection of compromised legitimate websites without false positives from reputable sites.
Solution Approach 2:
The system changes the parameter being monitored from website reputation (a coarse-grained metric) to HTTP accept header field consistency (a fine-grained parameter). By analyzing whether the accept header field matches the expected content type based on the request, the system achieves precise detection of CSRF attacks on legitimate websites while maintaining high accuracy.
Data Source
AI summary
Methods and apparatus for detecting cross-site request forgery (CSRF) attacks include a CSRF detector that analyzes HTTP communications for information indicative of a CSRF attack. The CSRF detector may analyze HTTP responses from a website for CSRF code that automatically performs unauthorized access of an online account of a user of a user computer upon receipt and execution of the CSRF code in the user computer. The CSRF detector may also analyze HTTP requests from a web browser for information indicative of a CSRF attack.