Web Application Firewall Attack Emulation and Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for determining the success of attacks on web applications require modifications to the server system, pre-defined attack behaviors, and collection of vulnerability information, and are limited by their inability to handle attacks on web applications effectively.
Innovation Solution
A determining apparatus that identifies attack types in attack codes, executes emulation to extract features from server responses, and determines attack success without modifying existing systems or collecting vulnerability information, using an attack type determining unit, feature extracting unit, and determining unit.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If HIDS is used to determine attack success, then detection accuracy is improved, but system complexity increases due to required server modifications
Solution Approach 1:
The patent introduces a WAF (Web Application Firewall) as an intermediary component that sits between the web application and the network. The WAF captures requests and responses without requiring modifications to the web application server itself, thereby maintaining detection accuracy while avoiding system complexity increases from server modifications.
2Reliability
If stateful IDS is used to detect attacks, then detection capability is improved, but adaptability decreases due to pre-defined attack behaviors
Solution Approach 1:
The system performs self-learning by automatically analyzing captured requests and responses to identify attack patterns. Instead of relying on pre-defined attack signatures, the WAF autonomously builds detection rules from observed traffic, enabling it to detect both known and unknown attacks without requiring manual configuration updates.
3Measurement precision
If correlation analysis with vulnerability information is performed, then detection precision is improved, but information collection requirements increase
Solution Approach 1:
The patent extracts only the essential features needed for attack detection directly from the captured requests and responses. Instead of collecting and analyzing comprehensive vulnerability information databases, the system extracts relevant patterns such as abnormal response codes, error messages, and traffic patterns directly from the web application interactions, significantly reducing information collection requirements.
4Reliability
If attack code emulation is used for binary codes, then emulation capability is improved, but applicability to web applications is reduced
Solution Approach 1:
The patent changes the emulation approach from binary code execution to HTTP protocol analysis. Instead of emulating machine code, the system analyzes HTTP requests and responses at the application layer, capturing and examining web traffic patterns. This parameter change enables effective detection of web application attacks while maintaining the benefits of automated analysis.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A determining apparatus (10) performs emulation of an attack code included in an attack request that is addressed to a web application (web server), based on the attack type of the attack code, and extracts a feature that appears in a response issued by the web application when the emulation results in a successful attack. The determining apparatus (10) determines that the attack has succeeded if the feature is included in a response from the web application, and determines that the attack has failed if the feature is not included.