Dynamic Analyzer Attack String Generation Bypassing Web Filters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for verifying web application security, including static and dynamic analysis, require extensive preparation and are limited by long analysis times and the ability of attack strings to bypass filtering logic, making it difficult to detect security vulnerabilities effectively.
Innovation Solution
A method and apparatus that utilize a dynamic analyzer to generate and analyze a final attack string, which is designed to avoid preset filtering logic by modifying parameters, allowing the string to execute specific operations through a web application, such as DDoS or XSS attacks, while determining if the string is filtered out by the web application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis or dynamic analysis methods are used to verify web application security, then security vulnerabilities can be detected, but the preparation process and analysis time become excessively long
Solution Approach 1:
The patent applies preliminary action by pre-generating multiple candidate attack strings with different parameter variations before the actual security analysis. This preparation of attack strings in advance allows the dynamic analysis to proceed more quickly without extensive real-time generation, thus reducing the overall analysis time while maintaining detection capability.
Solution Approach 2:
The patent utilizes parameter changes by systematically varying parameters within attack strings (such as encoding formats, parameter names, or values) to create diverse attack patterns. This approach enables the system to detect vulnerabilities more efficiently by testing multiple parameter variations simultaneously rather than analyzing each pattern separately, thereby reducing total analysis time.
2Object-affected harmful factors
If traditional attack strings are used, then filtering logic can block malicious content, but legitimate security testing is prevented
Solution Approach 1:
The patent applies parameter changes by modifying attack string parameters such as encoding methods, parameter names, and value formats to bypass filtering logic. By systematically varying these parameters, the system can test whether filtering rules are too restrictive and block legitimate security testing, thus improving the adaptability of security verification.
Solution Approach 2:
The patent employs inversion by reversing the approach: instead of trying to break through filters directly, it generates attack strings that appear legitimate by using valid parameter variations. This inverted approach allows security testing to bypass filtering logic that is designed to block obvious malicious content, enabling more versatile security analysis.
3Measurement precision
If reference data is generated for each new malicious behavior, then analysis accuracy improves, but the complexity and time required increase
Solution Approach 1:
The patent applies universality by creating a multi-functional attack string generation system that can handle multiple types of malicious behaviors with a single unified approach. Instead of generating separate reference data for each attack type, the system uses parameter variations within a unified framework to test various vulnerabilities, thereby reducing complexity while maintaining analysis accuracy.
Solution Approach 2:
The patent uses parameter changes to maintain measurement precision by systematically varying attack string parameters to match different malicious behavior patterns. This approach allows the system to accurately detect various vulnerability types without requiring separate reference data for each, thus reducing the complexity of reference data establishment while preserving detection accuracy.
Data Source
AI summary
Disclosed is an operation method for a dynamic analyzer for analyzing an execution state of a web application. The present invention comprises the steps of: analyzing an execution state of the web application on the basis of a final attack string including a parameter which indicates a particular operation to be executed through the web application; and performing an analysis of the execution state of the web application, wherein the final attack string is generated so as to avoid filtering logic which is designed to filter a raw attack string including a predefined parameter. Therefore, the present invention can detect a security vulnerability, which cannot be detected by the existing dynamic analyzer, through easy generation of a final attack string capable of bypassing filtering.