Web Application Unauthorized Access Detection via Sequence Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unauthorized access vulnerabilities in web applications are difficult to detect due to their similarity to normal website access operations, making it challenging for security gateways to distinguish between legitimate and abnormal access, leading to potential large-scale damage when exploited.
Innovation Solution
A method and system that parse HTTP requests to obtain URL addresses and determine if protection rules exist, analyzing access data against these rules to identify unauthorized access attacks by checking for deviations in access sequences, frequencies, and parameters, automatically generating protection rules through self-learning processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security gateways use traditional access control methods to detect unauthorized access, then normal website access operations can be monitored, but the gateways cannot distinguish between normal and abnormal access patterns
Solution Approach 1:
The system pre-establishes operation sequences for web applications before attacks occur. These sequences define the expected order of operations (e.g., login → browse → purchase → payment). By having these sequences predefined, the system can immediately compare actual access patterns against them during runtime, enabling rapid detection of unauthorized access without needing to learn normal patterns in real-time.
Solution Approach 2:
The system transforms the detection approach by changing from static access control lists to dynamic sequence verification. It monitors multiple parameters including operation type, operation object, and sequence position, then compares these against the pre-established operation sequences. This parameter-based transformation enables the gateway to distinguish normal from abnormal access by checking whether operations occur in the expected sequence and context.
2Reliability
If manual protection rules are configured for each URL, then specific unauthorized access can be blocked, but the complexity and time required for configuration increases significantly
Solution Approach 1:
The system automatically generates protection rules by analyzing the pre-established operation sequences and comparing them against actual access patterns. Instead of requiring security administrators to manually configure rules for each URL and attack scenario, the system self-generates appropriate protection rules based on detected deviations from normal operation sequences, significantly reducing configuration complexity while maintaining security effectiveness.
Solution Approach 2:
The operation sequence mechanism serves multiple functions simultaneously: it defines normal access patterns, detects unauthorized access, generates protection rules, and adapts to different web applications. By creating a universal framework that works across multiple URLs and application types, the system eliminates the need for separate manual configuration for each specific case.
3Measurement precision
If the system monitors all HTTP requests in detail, then unauthorized access can be detected, but the processing time and system resources increase
Solution Approach 1:
By pre-establishing operation sequences before attacks occur, the system prepares the expected access patterns in advance. During runtime, it only needs to compare actual requests against these pre-defined sequences rather than analyzing every request from scratch. This preliminary preparation significantly reduces processing time while maintaining high detection precision.
Solution Approach 2:
The system focuses monitoring efforts on critical operation points defined in the pre-established sequences rather than uniformly analyzing all HTTP requests. It selectively monitors operations that are part of the defined sequences and their contextual relationships, reducing the overall processing burden while maintaining sufficient detection accuracy for unauthorized access.
Data Source
AI summary
A method is provided for detecting unauthorized access attack. The detecting method includes obtaining at least one HTTP request and at least one URL address of the HTTP request by parsing the HTTP request; determining whether there exist one or more protection rules corresponding to the URL address; and, when it is determined that the protection rules corresponding to the URL address exit, obtaining access data of the HTTP request. The detecting method also includes determining whether the access data satisfies the protection rules; and, when it is determined that the access data does not satisfy the protection rules, determining the corresponding HTTP request of the URL address to be an unauthorized access attack.