Real-Time URL Parameter Anomaly Detection from Request Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional rule-based protection strategies in Web Application Firewalls (WAFs) struggle to effectively detect web attacks with unusual or non-obvious characteristics, leading to increased cybersecurity incidents and economic losses.
Innovation Solution
A URL parameter value anomaly detection method and system that analyzes real-time request logs, classifies parameter values, generates a key based on domain name, request URI, and parameter name, and matches these with a pre-stored parameter feature library to identify anomalous requests, using historical data to build a parameter feature library for rapid detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based protection strategies are deployed on WAF, then obvious malicious attacks can be effectively blocked, but strange or non-obvious attacks cannot be detected
Solution Approach 1:
The patent changes the detection parameter from fixed rule matching to dynamic parameter value analysis. By extracting parameter values from request logs, classifying them into categories (pure number, pure English, URL, EMAIL), and comparing against a pre-stored parameter feature library, the system adapts to detect both obvious and strange attacks without requiring predefined rules for each attack type.
Solution Approach 2:
The patent performs preliminary action by pre-storing a parameter feature library built from historical request logs before real-time detection. The library contains categorized parameter values and their confidence levels, which are prepared in advance to enable rapid comparison and anomaly detection during real-time operations, eliminating the need for complex real-time analysis of attack patterns.
2Measurement precision
If real-time request logs are analyzed without pre-processing, then detection accuracy may improve, but processing time and system load increase
Solution Approach 1:
The patent performs preliminary data cleaning and parameter extraction on historical request logs to build the parameter feature library in advance. This pre-processing includes filtering invalid parameters, classifying parameter values into categories, and storing them with confidence levels. During real-time detection, the system only needs to extract parameters and compare against the pre-built library, significantly reducing processing time while maintaining high accuracy.
Solution Approach 2:
The patent segments the detection process into distinct phases: offline library building and online real-time detection. The offline phase handles heavy pre-processing work (data cleaning, parameter extraction, classification, library construction), while the online phase focuses on rapid parameter comparison. This segmentation separates computationally intensive operations from time-critical operations, optimizing both accuracy and speed.
3Reliability
If comprehensive parameter analysis is performed on all requests, then detection coverage improves, but system complexity and resource consumption increase
Solution Approach 1:
The patent applies local quality by focusing analysis only on relevant parameter values in request logs rather than processing entire requests uniformly. Different parameter values are classified into different categories (pure number, pure English, URL, EMAIL) and compared against corresponding entries in the parameter feature library. This targeted approach improves detection coverage while reducing system complexity by avoiding unnecessary processing of irrelevant data.
Solution Approach 2:
The patent creates a simplified copy of request parameters in the form of the parameter feature library, which stores only the essential categorized parameter values and their confidence levels from historical data. During detection, the system compares current parameters against this pre-built copy rather than analyzing complete historical logs, significantly reducing computational complexity while maintaining comprehensive detection coverage.
Data Source
AI summary
Disclosed are a URL parameter value anomaly detection method and system. The method includes obtaining a real-time request log; analyzing the real-time request log to generate one or more parameter values; classifying each parameter value based on a preset parameter value classification category to determine a parameter value category of a request URL in the real-time request log; generating a key according to a domain name, a request URI, and a parameter name in the real-time request log; retrieving a target dataset corresponding to the key from a pre-stored parameter feature library; and matching the parameter value category of the request URL in the real-time request log with a category and a category confidence level of the target dataset; and when they are not matched, it can be determined that the parameter value of the request URL in the real-time request log is anomalous.