Web Application Agent Library for Real-Time Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web application protection technologies, including web application firewalls (WAFs), are ineffective against sophisticated and targeted attacks, and lack real-time detection and prevention capabilities.
Innovation Solution
A system and method that includes an agent library embedded in web applications, which hooks into various interfaces to detect and respond to attacks using dynamic rules generated in a cloud service, allowing for real-time protection and updates without developer intervention, even in environments without an instrumentation API.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web application firewalls (WAF) are used to detect and prevent web application attacks, then network and server level attacks can be blocked, but they are ineffective against sophisticated and targeted attacks and require complex configuration and maintenance
Solution Approach 1:
The system enables self-service through automatic rule generation from security events and automated deployment of protection rules without manual configuration. The security system automatically learns from attacks and updates protection rules, eliminating the need for complex manual setup and maintenance that plagues traditional WAF systems.
Solution Approach 2:
The system implements feedback loops where security events and attack patterns are continuously monitored, analyzed, and used to automatically update protection rules. This closed-loop feedback mechanism allows the system to adapt to new threats dynamically without requiring manual reconfiguration, resolving the contradiction between effectiveness and complexity.
2Measurement precision
If traditional security scanning and penetration testing products are used, then vulnerability detection is performed, but they fail to detect and stop attacks occurring in real time
Solution Approach 1:
The system performs preliminary action by pre-generating protection rules from analyzed security events and attack patterns before actual attacks occur. These pre-computed rules are ready for immediate deployment, enabling both precise vulnerability detection and real-time attack prevention without the latency of traditional scanning approaches.
Solution Approach 2:
The system transitions from static vulnerability scanning to dynamic real-time protection by continuously updating rules based on current threat intelligence and security events. This dynamic approach allows the system to maintain both detection precision and real-time response capability, unlike traditional static scanning tools.
3Reliability
If RASP technologies instrument code via runtime instrumentation API, then detection of certain attack types is enabled, but they require specific runtime features and APIs that are not universally available
Solution Approach 1:
The system achieves universality by generating protection rules that can be deployed across diverse runtime environments without requiring specific instrumentation APIs. The rule generation mechanism is environment-agnostic, allowing the same rule set to protect applications regardless of the underlying runtime platform, thus resolving the compatibility issue while maintaining detection capability.
Solution Approach 2:
The system uses an intermediary rule generation layer that translates security requirements into environment-independent protection rules. This intermediary mechanism decouples the detection logic from specific runtime implementations, enabling broad compatibility across different platforms while maintaining reliable attack detection.
4Measurement precision
If dynamic rules are generated and deployed in real time, then protection accuracy improves, but system complexity and resource requirements increase
Solution Approach 1:
The system segments the rule generation and deployment process into manageable components: event collection, pattern analysis, rule generation, validation, and deployment. This segmentation allows complex real-time rule updates to be handled through modular, independent stages, reducing overall system complexity while maintaining high detection accuracy.
Data Source
AI summary
The present disclosure provided a method and system for protecting web applications against web attacks comprising a cloud service for generating rules and receiving reports, an agent manager in communication with the cloud service receiving rules from the cloud service and passing reports thereto, and an in-application agent in communication with the agent manager for receiving rules therefrom and passing reports thereto for protecting an application in which the in-application agent is embedded.