Session Vector Analysis for Web Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web-security products are inadequate in identifying and mitigating automated and malicious processes that exploit weaknesses in web-based systems, as they primarily focus on identifying illegitimate requests at the code level and struggle to detect sophisticated attacks.
Innovation Solution
A method involving a trained artificial neural network to process new visitor sessions by determining request vectors for each web request, combining these vectors into a session vector, and using this vector to characterize the session, thereby providing insights into the nature of the session and aiding in security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional web-security products are used to identify illegitimate requests, then code-level security is improved, but the ability to detect sophisticated automated and malicious processes deteriorates
Solution Approach 1:
The patent transitions from code-level security analysis to a session-level behavioral analysis dimension. By capturing and analyzing the sequence of web requests, user interactions, and navigation patterns across multiple pages, the system creates a holistic view of visitor behavior that reveals sophisticated automated processes and malicious activities that evade traditional code-level detection methods.
2Ease of operation
If software on devices is used to identify new visitors as automated processes, then visitor identification is improved, but the ability to handle sophisticated attackers deteriorates due to evasion capabilities
Solution Approach 1:
The system continuously monitors and analyzes visitor behavior patterns, comparing observed actions against learned models of legitimate user behavior. When deviations are detected—such as atypical navigation sequences, unusually rapid interactions, or patterns consistent with automated scraping—the system triggers feedback mechanisms to flag these visitors for further investigation or blocking, enabling dynamic adaptation to sophisticated attack evasion techniques.
3Difficulty of detecting and measuring
If server-side activity is used to identify automated processes, then comprehensive detection is improved, but processing complexity increases
Solution Approach 1:
The patent segments the complex task of analyzing server-side activity into distinct modular components: request capture module, behavior analysis module, pattern recognition module, and decision enforcement module. Each component processes specific aspects of visitor behavior independently, making the overall complex detection system more manageable, maintainable, and scalable while preserving comprehensive detection capabilities.
Data Source
AI summary
A method of processing a new visitor session to a web-based system, the method including: for each of a plurality of web requests made to the web-based system in the new visitor session, determining a request vector corresponding to the web request, wherein each request vector is derived from the learned parameters of a trained artificial neural network configured to determine a plurality of probabilities from an input web request or an input sequence of web requests, wherein each of the plurality of probabilities represents a likelihood that, within a session containing the input web request of sequence of web requests, a respective one of a plurality of possible web requests will be requested at one or more predetermined locations before or after the input web request or sequence of web requests; and combining the request vectors to obtain a session vector which characterizes the new visitor session.