Runtime Security Agent CSRF Detection via Origin and Session Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current detection techniques for Cross Site Request Forgery (CSRF) attacks often result in a high false-positive rate, failing to accurately identify such attacks and leading to unnecessary security measures.
Innovation Solution
Implementing a runtime security agent that analyzes request characteristics, including origin, session, and content information, to determine if a request is part of a CSRF attack, specifically identifying whether it was triggered from an external website and if it is for a static file type, thereby reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current detection techniques are used to identify CSRF attacks, then attack detection capability is provided, but false-positive rate increases
Solution Approach 1:
The patent segments the CSRF detection process into multiple independent analysis components: origin analysis (checking referrer headers and origin information), session analysis (verifying session validity and consistency), and content analysis (examining request characteristics and patterns). Each component independently evaluates specific aspects of the request, and only when all segments indicate malicious behavior is the request classified as a CSRF attack. This segmentation allows the system to maintain high detection accuracy while reducing false positives by requiring convergence of multiple evidence types.
Solution Approach 2:
The patent changes the parameters used for detection by moving beyond simple pattern matching to multi-dimensional parameter analysis. It examines origin parameters (referrer URL, origin header), session parameters (session ID validity, session timing consistency), and request parameters (HTTP method, content type, user agent). By analyzing multiple parameters simultaneously and evaluating their interrelationships, the system achieves more precise detection with fewer false positives compared to single-parameter detection methods.
2Measurement precision
If runtime analysis is implemented to improve detection accuracy, then measurement precision improves, but device complexity increases
Solution Approach 1:
The patent introduces intermediary analysis layers that mediate between the incoming request and the detection decision. The origin analysis module acts as an intermediary to validate request sources, the session analysis module intermediates to verify session legitimacy, and the content analysis module intermediates to assess request characteristics. These intermediary modules process and filter information before passing it to the final detection logic, enabling precise detection while maintaining manageable system complexity through modular architecture.
Data Source
AI summary
A method for attack detection includes: intercepting, by a runtime security agent, a request for a web resource; determining whether the intercepted request was triggered from an external website; determining whether the intercepted request was triggered from a current session; determining whether the intercepted request is requesting a static file type; and in response to a determination that the intercepted request was triggered from an external website and was not triggered from a current session, or a determination that the intercepted request was triggered from an external website and is not requesting a static file type, providing, by the runtime security agent, an indication of a potential attack.