Session-Based Web Activity Logging for Malicious Request Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security devices struggle to detect abnormal follow-on requests caused by malicious code due to a lack of 'stateful' understanding of browsing sessions, as they treat web page requests as discrete events rather than part of a single user interaction, limiting their ability to monitor and filter network communications effectively.
Innovation Solution
A method and system that obtain a unique user identifier for a web browser tab and associate it with network events, enabling session-based recording and logging of activities related to web page requests, allowing for a more holistic view of user interactions and improved security monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If traditional proxy logs treat web requests as discrete events, then device complexity is reduced, but the ability to detect malicious follow-on requests deteriorates
Solution Approach 1:
The patent segments the logging structure by creating distinct data containers for different types of information: initial web request data, follow-on request data, and associated metadata. Each segment is tracked separately but linked through session identifiers, allowing the system to maintain low overall complexity while capturing the full context of browsing sessions for reliable malicious code detection.
2Reliability
If session-based recording is implemented, then malicious activity detection is improved, but device complexity increases
Solution Approach 1:
The patent introduces session identifiers and data structure templates as intermediaries between the complex task of session-based security monitoring and the logging system. These intermediaries standardize the representation of browsing sessions, allowing the system to achieve high reliability in security monitoring while keeping the underlying logging infrastructure manageable through consistent data organization.
3Measurement precision
If per-user-session logging is implemented, then measurement precision of user interactions is improved, but loss of information is reduced
Solution Approach 1:
The patent implements a nested data structure where follow-on request information is nested within the context of the initial web request, which is itself nested within the broader session data. This nesting preserves the hierarchical relationships and contextual associations between different events, ensuring that no information is lost while achieving precise measurement of user interactions through structured data organization.
Data Source
AI summary
A method, system, and computer-usable medium are disclosed for, responsive to receipt at a security device of a webpage request from a client to a server, obtaining a unique user identifier corresponding to a tab of a web browser issuing the webpage request and associating the unique user identifier with network events associated with the tab and the webpage request.