Stateful Application Firewall URL Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current application firewalls struggle to accurately distinguish between valid and invalid URL requests due to their stateless nature, leading to false positives and inability to capture the full range of valid URLs, which results in legitimate users being denied access.
Innovation Solution
A stateful classification method that considers the context of each URL request, examining attributes such as URL, parameters, source-IP, mime-type, cookie, headers, and HTTP-method, and applies configurable rules to classify requests as harmless or harmful, impacting all future requests in the same session, thereby reducing classification errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a stateless protocol (HTTP) is used for web traffic, then ease of operation and simplicity are improved, but the ability to accurately distinguish between valid and invalid URL requests deteriorates
Solution Approach 1:
The patent introduces dynamic state tracking into the previously static HTTP protocol interaction. The system maintains session state information including previously visited URLs, referral paths, and navigation patterns, allowing the firewall to dynamically evaluate each request in context rather than in isolation. This dynamic approach enables accurate classification of URL requests while preserving HTTP's operational simplicity.
Solution Approach 2:
The patent introduces an intermediary component (the stateful URL classification system) between the HTTP client and server. This intermediary intercepts HTTP requests, enriches them with contextual state information, and makes intelligent routing decisions. The intermediary maintains the simplicity of the underlying HTTP protocol while adding the necessary intelligence for accurate URL classification through its stateful inspection capabilities.
2Adaptability or versatility
If a training phase approach is used to learn valid URL ranges, then adaptability to legitimate URLs is improved, but false positives increase due to inability to capture full range of valid URLs
Solution Approach 1:
The patent implements a feedback mechanism where the system continuously learns from actual user navigation patterns and request contexts. By monitoring successful legitimate requests and their contextual characteristics (referral URLs, navigation sequences, timing patterns), the system refines its classification rules. This feedback loop enables the system to adapt to the full range of valid URLs without generating false positives, as it learns from real-world usage rather than static training data.
Solution Approach 2:
The patent performs preliminary stateful analysis of request contexts before making classification decisions. By pre-establishing baseline navigation patterns, referral relationships, and session characteristics, the system can quickly evaluate new requests against these pre-analyzed patterns. This preliminary action enables the system to recognize the full spectrum of valid URLs while maintaining high reliability, as it compares requests against established contextual norms rather than attempting to pre-define all possible valid URLs.
3Measurement precision
If context-based stateful classification is implemented, then accuracy of harmful vs. harmless URL classification is improved, but device complexity increases
Solution Approach 1:
The patent segments the URL classification task into distinct contextual components: referral URL analysis, navigation pattern recognition, session state tracking, and request characteristic evaluation. Each segment handles a specific aspect of contextual analysis independently, processing and storing relevant information in separate data structures. This segmentation enables accurate classification while managing complexity by breaking down the overall task into modular, independently manageable components.
Solution Approach 2:
The patent adds contextual dimensions to the classification process by considering referral URLs, navigation sequences, timing patterns, and session characteristics alongside the target URL itself. Rather than analyzing requests in a single dimension (the URL string), the system evaluates multiple contextual dimensions simultaneously. This multi-dimensional approach improves classification accuracy while organizing complexity through structured dimensional analysis rather than monolithic processing.
Data Source
AI summary
A method and system to protect web applications from malicious attacks is described. A stateful means of distinguishing between valid (e.g., harmless) and invalid (e.g., harmful) accesses is provided. A request from a content browser for content from an application server is forwarded by a firewall to the application server if it includes a URL that was previously transmitted from the application server. The firewall performs a security evaluation of the request if the URL of the request was not previously transmitted from the application server.