Request Control Device Using Sandbox for Attack Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional NIDS systems face challenges in determining whether detected attack codes are executed and valid, and HIDS requires changes to web servers to acquire system call data, making it difficult to accurately and efficiently detect attacks without modifying the actual web server environment.
Innovation Solution
A request control device that uses a sandbox to reproduce the server environment, inspecting incoming requests, and only allowing legitimate requests to proceed to the server, thereby intercepting and blocking potential attacks without altering the web server configuration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If NIDS is used to detect attack codes from network traffic, then attack detection capability is improved, but it becomes difficult to determine whether the attack code is executed and whether the attack is valid
Solution Approach 1:
The patent creates a virtual copy (sandbox) of the server environment to execute and analyze attack codes. Instead of only analyzing network packets externally, the system replicates the target server environment and runs the detected attack code within this isolated virtual environment, allowing observation of actual execution behavior and determining whether the attack is valid without affecting the real server.
2Measurement precision
If HIDS is used to detect attacks using system calls, then detection accuracy is improved, but changes must be made to the web server to acquire system call data
Solution Approach 1:
The patent creates a virtual copy (sandbox) of the server environment that replicates the necessary system call interfaces and behaviors. This virtual environment allows the system to capture and analyze system calls generated by attack code execution without requiring any modifications to the actual web server, as the sandboxed environment independently provides the required system call capabilities.
3Measurement precision
If a sandbox is used to reproduce server environment for inspection, then attack detection accuracy is improved, but processing time increases due to virtualization overhead
Solution Approach 1:
The patent pre-configures the sandbox environment with the necessary server components, system calls, and attack code repositories before actual attack detection begins. By preparing the virtual environment in advance with all required resources and configurations, the system minimizes initialization overhead during actual attack inspection, reducing the time penalty associated with virtualization.
Solution Approach 2:
The patent implements optimized execution paths within the sandbox that allow rapid processing of attack code. The virtual environment is designed to quickly execute and analyze malicious code, using efficient resource allocation and prioritized processing to minimize the time required for sandbox inspection while maintaining detection accuracy.
Data Source
AI summary
A request control device, when receiving a request issued from a client to a Web system, causes a sandbox in which an environment of the Web system is reproduced to inspect the request. The request control device transfers the request to the Web system if an inspection result of the request in the sandbox does not indicate detection of an attack. The request control device does not transfer the request to the Web system if the inspection result of the request indicates detection of an attack.