HTTP Request Behavior Profiling for Zero-Day Worm Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for Web applications are ineffective in detecting and blocking zero day worm attacks without prior knowledge of the worm's signature, as they rely on signature detection, which is slow to update, and protocol anomaly detection, which is unreliable, especially for worms exploiting buffer-overflow vulnerabilities.
Innovation Solution
A method and system that parse HTTP requests to extract parameters and compare them against a normal behavior profile (NBP) to identify deviations, such as unauthorized URLs, host headers, and missing session identifiers, generating alerts and blocking packets to prevent zero day worm attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature detection is used to detect worm attacks, then detection accuracy is improved, but response time deteriorates because signature updates take several days
Solution Approach 1:
The system performs preliminary analysis of HTTP requests by comparing them against a normal behavior profile before allowing access. This pre-screening mechanism identifies deviations from normal patterns (such as unusual URLs, host headers, or missing session identifiers) in real-time, enabling immediate detection of zero-day worm attacks without waiting for signature updates.
2Loss of time
If protocol anomaly detection is used to detect worm attacks, then response time is improved, but reliability deteriorates especially for buffer-overflow exploits
Solution Approach 1:
The system introduces a normal behavior profile as an intermediary reference for comparing HTTP requests. Instead of relying solely on protocol compliance or signature matching, the profile serves as a mediator that captures the essential characteristics of legitimate traffic patterns. This enables reliable detection of anomalies (such as worms exploiting buffer-overflow vulnerabilities) by comparing against the established behavioral baseline.
3Reliability
If URL access restriction is used to block worm attacks, then security is improved, but usability deteriorates as users cannot freely access Web applications
Solution Approach 1:
The system dynamically evaluates each HTTP request against the normal behavior profile rather than applying static URL restrictions. This dynamic approach allows legitimate user access patterns to pass through while automatically blocking malicious requests that deviate from the profile, thereby maintaining both security and usability without requiring predetermined access lists.
Data Source
AI summary
A method for detection and blocking of zero day worm attacks is disclosed. A zero day worm attack is the initial appearance of a new or revised Web worm. The method compares a hypertext transfer protocol (HTTP) request sent from an attacking computer (or server) to a predefined behavior profile of a protected Web application in order to detect a worm attack. A zero day worm attack based on the first data packet of an HTTP request can be detected.