RASP Plug-in Logic for Outbound Network Connection Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for preventing cross-site scripting (XSS) attacks, such as web application firewalls (WAF) and static/dynamic application security testing (SAST/DAST), are inadequate as they lack application context awareness and cannot effectively protect against unknown attacks, leading to costly management and unpatchable vulnerabilities.
Innovation Solution
Implementing a runtime application self-protection (RASP) plug-in logic that monitors and prevents unauthorized outbound network connections at the application layer, providing real-time protection by accessing application logic telemetry and limiting connections to only those intended by the application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web application firewalls (WAF) are used to prevent XSS attacks, then network-level protection is provided, but application context awareness is lost and false positives increase
Solution Approach 1:
The patent embeds security monitoring logic directly within the application layer, nesting the security function inside the application itself rather than using an external firewall. This allows the security mechanism to access application context while maintaining protection capabilities.
Solution Approach 2:
The patent introduces an intermediary security layer that sits between the application and the network, capturing outbound connections and analyzing them with application context awareness before allowing them to proceed, thus mediating between network protection and application-specific knowledge.
2Measurement precision
If static and dynamic application security testing (SAST and DAST) are implemented, then application-level security analysis is achieved, but continuous monitoring during runtime is not provided
Solution Approach 1:
The patent performs preliminary security configuration by establishing a baseline of authorized outbound connections during application deployment, enabling real-time monitoring without interfering with runtime productivity. This preliminary action allows the system to quickly evaluate connections against pre-defined security policies.
Solution Approach 2:
The patent implements continuous security monitoring that operates throughout the application's runtime lifecycle, maintaining constant protection without interrupting business operations. The security mechanism continuously evaluates outbound connections while the application processes requests.
3Reliability
If comprehensive source code analysis is performed to identify all vulnerabilities, then complete security coverage is achieved, but patching complexity and cost increase significantly
Solution Approach 1:
The patent extracts the security enforcement function from the application source code itself and implements it as a separate runtime monitoring layer. This extraction allows the application to maintain its original code without extensive modifications while still achieving comprehensive security coverage through the external security layer.
Solution Approach 2:
The patent enables the application to self-protect by implementing security monitoring within the application's own runtime environment. The application monitors and controls its own outbound connections using its contextual knowledge, eliminating the need for external patching of vulnerable code.
4Measurement precision
If application-specific security monitoring is implemented, then accurate threat identification is achieved, but system complexity and deployment difficulty increase
Solution Approach 1:
The patent merges the security monitoring function with the application's existing runtime infrastructure, combining security capabilities with the application's natural execution context. This merging reduces overall system complexity by eliminating separate security infrastructure while maintaining precise threat identification.
Data Source
AI summary
A runtime application self protection (RASP) plug-in logic monitors for, and prevents, outbound network connections that are initiated by server application logic and that are not intended by the application logic. The RASP plug-in has access to information generally available only to the application logic and identifies specific vulnerabilities within the application logic that can be patched. The vulnerabilities are identified by (i) data identifying the portion(s) of the application logic that is the source of the vulnerability and (ii) data identifying the authenticated user, if any, that is the source of the attack. The RASP plug-in catches and identifies specific attacks on the application logic in real-world, production operation.