Vulnerability Duplication Detection via URL Hash Comparison

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for analyzing web application vulnerabilities often result in duplicate detections, leading to excessive information and missed meaningful detection results due to the comparison of URL addresses rather than their structures, and lack of consideration for response page structures.

Innovation Solution

A method and apparatus that extract vulnerability URL addresses, generate hash values based on URL and response page structures, and compare these hash values in tables to determine duplication, ensuring accurate identification and removal of duplicate vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If vulnerability URL addresses are compared directly to determine duplication, then the detection process is simple, but the detection accuracy is low due to URL parameter variations

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoiddetection process complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent introduces hash values as an intermediary element between URL addresses and duplication determination. Instead of directly comparing complex URL addresses with parameters, the system generates hash values from URLs and compares these simplified representations. This intermediary approach maintains detection accuracy while significantly reducing comparison complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent transforms the original URL address parameters into hash value parameters through a hashing function. This parameter transformation converts variable-length URLs with multiple parameters into fixed-length hash values, enabling efficient and accurate duplication detection without being affected by URL parameter variations.

Inventive Principle:

Principle #35Parameter changes

2Loss of information

If all detected vulnerabilities are retained without duplication removal, then no information is lost, but the information volume becomes excessive and meaningful results are missed

Engineering Contradiction:

Improvevulnerability information completenessVSAvoidvulnerability information volume

Core Design Contradiction:

Loss of informationVSQuantity of substance

Solution Approach 1:

The patent performs preliminary duplication detection and removal before final vulnerability reporting. By proactively identifying and eliminating duplicate vulnerabilities through hash value comparison, the system reduces information volume in advance while maintaining completeness of unique vulnerability data, preventing information overload in the final results.

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If URL structure comparison is performed instead of direct address comparison, then duplication detection accuracy improves, but the computational complexity increases

Engineering Contradiction:

Improveduplication detection accuracyVSAvoidcomputational resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent replaces the mechanical process of detailed URL structure analysis with a computational hashing operation. Instead of manually parsing and comparing URL structures, the system uses hash functions to convert URLs into comparable values, significantly reducing computational resource consumption while maintaining high detection accuracy.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11570196B2Method for determining duplication of security vulnerability and analysis apparatus using same

Publication Date: 2023.01.31 NAVER CLOUD CORP

AI summary

A method for determining duplication of a vulnerability may include a vulnerability extraction step of extracting vulnerability uniform resource locator (URL) addresses including the vulnerability from an analysis target server; a hash generation step of generating the URL hash value corresponding to the extracted vulnerability from the vulnerability URL address; and a duplication determination step of determining, when the URL hash value is present in the first comparison table, that the vulnerability is duplicated and excluding the corresponding vulnerability from vulnerability information.