Network Attack Script Detection via Deception and Adaptation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate in distinguishing and mitigating unauthorized automated attacks on websites and mobile applications, as attackers can easily create and test malicious scripts before launching large-scale attacks, making it difficult to differentiate between real users and attackers.
Innovation Solution
A detector is configured to differentiate between actual attacks and script testing phases using transaction rate checks, user history analysis, IP location checks, and behavioral checks, allowing the script to continue running with limited access, thereby providing a false indication of success to the attacker, and preparing the system for a potential attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current detection methods (Captchas, device identification, IP tracking) are used to block automated attacks, then attack detection capability is improved, but false positive rate increases and legitimate users are blocked
Solution Approach 1:
Instead of blocking all automated traffic, the system inverts the approach by allowing potentially malicious scripts to run and appear successful, then uses machine learning to analyze patterns and distinguish true attacks from legitimate automated interactions retrospectively
Solution Approach 2:
The system changes the parameter being measured from immediate blocking decisions to temporal pattern analysis, using historical behavior data and transaction rates over time to distinguish attacks from legitimate users
2Reliability
If aggressive blocking is implemented to prevent attacks, then security is improved, but attacker adaptation speed increases as they rotate through different attack vectors
Solution Approach 1:
The system implements feedback loops where machine learning models continuously analyze attack patterns and user behavior, then adjust detection thresholds and blocking decisions dynamically based on learned patterns, preventing attackers from successfully adapting their vectors
Solution Approach 2:
The system performs preliminary analysis of script behavior patterns before making blocking decisions, using transaction rate checks and behavioral analysis to identify attack scripts early in their execution cycle, preventing successful attacks before they can scale
3Measurement precision
If machine learning-based detection is deployed to distinguish attacks from legitimate users, then detection accuracy is improved, but system complexity and computational resources increase
Solution Approach 1:
The system applies machine learning selectively to specific detection scenarios and uses ensemble methods combining multiple simpler models rather than one complex model, reducing overall system complexity while maintaining high detection accuracy
Solution Approach 2:
The detection system is segmented into multiple independent components (transaction rate checks, behavioral analysis, machine learning models) that can be deployed and scaled independently, managing complexity through modular architecture
Data Source
AI summary
This disclosure describes a technique to slow down or block creation of automated attack scripts by configuring a detector to discriminate whether particular attack-like activity is a true attack, or simply a hacker “testing” his or her automated attack script, and then permitting any such test script to continue working (attacking) the site, albeit on a limited basis. In this manner, the hacker receives an indication that his or her automated attack script is already working. Thereafter, when the detector later detects a launch of an actual attack based on or otherwise associated with the automated attack script (previously under test), the attack fails either because the script was not a working script in the first instance, or because information learned about the script is used to adjust the site as necessary to then prepare adequately for a true attack.