Website Security Detection via HTTP Packet Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing website vulnerability scanners are unable to timely scan new online domain names and detect vulnerabilities on 'island pages' due to their reliance on crawler technology, which limits their ability to monitor website security in real-time and discover security vulnerabilities efficiently.
Innovation Solution
A method and apparatus for detecting website security that performs bypass interception to snatch HTTP request packets, acquires and prioritizes new links or domain names for scanning, and conducts vulnerability scanning on a to-be-scanned queue, enabling real-time monitoring and detection of security vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If crawler technology is used to scan website links, then the scanning process can cover existing website structure, but new online domain names and island pages cannot be detected timely
Solution Approach 1:
The system performs preliminary actions by intercepting HTTP request packets before they reach the target website, extracting links and domain names in advance, and adding them to a scanning queue proactively. This allows new domain names to be detected as soon as they are accessed, eliminating the delay inherent in traditional crawler-based approaches that wait for links to be discovered through normal browsing.
Solution Approach 2:
The patent introduces an intermediary mechanism (HTTP packet interception module) that mediates between the network traffic and the vulnerability scanning system. By capturing HTTP request packets at an intermediate point in the network, the system can extract new domain names and links without relying on crawlers to discover them, thus improving both detection completeness and timeliness.
2Reliability
If more information security professionals are allocated to perform security tests, then more comprehensive security coverage can be achieved, but the cost and complexity of the system increases
Solution Approach 1:
The system implements self-service by automatically intercepting HTTP packets, extracting domain names and links, prioritizing new entries, and queueing them for vulnerability scanning without human intervention. This automation replaces the need for multiple security professionals to manually perform these tasks, maintaining comprehensive security coverage while reducing system complexity and operational costs.
Solution Approach 2:
The patent changes the operational parameters of the security system by shifting from manual security testing to automated packet interception and analysis. This parameter change enables the system to process significantly more domain names and links with the same or fewer resources, improving security coverage without proportionally increasing system complexity.
3Reliability
If traditional vulnerability scanning is performed on all links, then comprehensive security checking is achieved, but the scanning efficiency decreases due to processing all links equally
Solution Approach 1:
The system applies local quality by differentiating the treatment of different links based on their characteristics. New domain names and recently added links are prioritized and scanned first, while existing known links are scanned with lower priority or skipped if already verified. This localized quality adjustment ensures that security checking remains comprehensive while significantly improving scanning efficiency by focusing resources on the most critical targets.
Solution Approach 2:
The system performs preliminary classification of links by analyzing HTTP packets to identify new domain names and links before the scanning process begins. By pre-sorting and prioritizing the scanning queue based on recency and importance, the system ensures that critical security vulnerabilities are detected first, improving overall scanning efficiency without compromising comprehensive security checking.
Data Source
AI summary
The present invention discloses a method and an apparatus for detecting website security. The method includes: performing bypass interception on a network to snatch a hypertext transfer protocol request packet; acquiring a link corresponding to the hypertext transfer protocol request packet; inserting the link into a to-be-scanned queue as a priority task to be scanned if the link is determined to be new; and/or extracting a domain name corresponding to the link, inserting the domain name into the to-be-scanned queue as a priority task to be scanned if the domain name is determined to be new; and performing vulnerability scanning on the task to be scanned in the to-be-scanned queue.