Session Log Analysis for Blind Attack Success Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to determine whether a blind attack has succeeded, as traces of such attacks do not appear in the response, making it difficult to differentiate between successful and unsuccessful attacks.
Innovation Solution
A determination device that extracts communication logs of the same session, detects blind attacks using URL request destinations, specifies attack targets and contents, and determines success based on multiple types of attack content and response status codes and sizes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all attacks are detected and alerts are issued, then attack detection coverage is improved, but maintenance persons or monitoring persons may overlook the alerts
Solution Approach 1:
The system changes the detection parameter from binary attack detection to success/failure differentiation by analyzing response status codes and response sizes. This allows the system to issue alerts only for successful attacks, improving alert management efficiency while maintaining detection coverage through precise success determination.
2Ease of manufacture
If attack detection is based on response content inspection, then simple implementation is achieved, but blind attacks without explicit traces cannot be detected
Solution Approach 1:
The system introduces response status codes and response sizes as intermediary indicators to detect blind attacks. Instead of directly inspecting attack traces in response content, the system uses these intermediary parameters to infer attack success, enabling detection of attacks without explicit traces while maintaining implementation simplicity.
Solution Approach 2:
The system replaces the mechanical approach of inspecting response content for attack traces with a statistical approach analyzing patterns in response status codes and sizes. This substitution enables detection of blind attacks that leave no explicit traces in the response content.
3Measurement precision
If success determination requires multiple types of attack content and response variations, then detection accuracy is improved, but processing complexity increases
Solution Approach 1:
The system segments the attack detection process into distinct phases: extracting communication logs, identifying blind attacks, extracting attack content, and determining success through pattern matching. This segmentation organizes the complex processing logic into manageable steps, improving accuracy while controlling complexity through structured analysis.
Data Source
AI summary
A determination device includes processing circuitry configured to extract a series of communication logs of a same session from a communication log in which an attack is to be detected, detect a communication log of a blind attack using a URL of a request destination of the communication log and specify an attack target location of the blind attack and content of the attack from the communication log in which the blind attack has been detected, and extract communication logs in which attack target locations of the blind attack match among the extracted series of communication logs of the same session and determine that the blind attack has succeeded by communication indicated by the series of communication logs in a case where it is determined that there are a plurality of types of the content of the attack and a plurality of response status codes and response sizes.