Web Application Custom Parameter Rule Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sophisticated Web applications are vulnerable to malicious payloads in custom parameters within request URLs, which are difficult to identify due to proprietary interfaces or frameworks, making existing security analysis tools ineffective.
Innovation Solution
A method and system that instrument Web application source code to identify custom parameters by comparing run-time values with request URLs, generating a custom parameter rule based on intersections, and using static and dynamic analysis modules to track and persist parameter mappings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security analysis tools are used to detect malicious payloads, then general security analysis can be performed, but custom parameters in request URLs cannot be effectively identified due to proprietary interfaces or frameworks
Solution Approach 1:
The patent introduces an intermediary component that acts as a bridge between the security analysis tool and the proprietary Web application interface. This intermediary instruments the source code to intercept and analyze parameter mappings without requiring direct access to or understanding of the proprietary interface, thereby enabling custom parameter detection while maintaining compatibility with proprietary frameworks
Solution Approach 2:
The system performs self-service by automatically instrumenting the Web application source code and executing it to generate parameter mappings without requiring manual configuration or knowledge of the proprietary interface. The instrumentation process itself reveals the custom parameters through runtime observation, allowing the system to adapt to any proprietary interface automatically
2Measurement precision
If source code instrumentation is performed to identify custom parameters, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the security analysis system into distinct functional modules: a source code instrumentation module that adds tracking code, an execution module that runs the instrumented code, and an analysis module that processes runtime data. This segmentation allows each component to perform its specific function with high precision while keeping the overall system manageable through modular design
Solution Approach 2:
The system creates a copy of the original Web application source code and instruments this copy rather than modifying the production code directly. This copying approach enables detailed tracking and analysis of parameter flows without affecting the original system, achieving high detection accuracy while isolating the complexity to a separate analytical environment
Data Source
AI summary
Identifying at least one custom parameter in a request uniform resource locator (URL). The method can include identifying at least a first portion of source code of a Web application that typically consumes the custom parameter provided in the request URL and, via a processor, instrumenting the Web application at the first portion of the source code. The Web application can receive the request URL and the Web application can be executed with the instrumented source code. At least one run-time value consumed by the second portion of the source code can be identified, and the run-time value can be compared to the request URL to determine whether the run-time value intersects with the request URL. Responsive to determining that the run-time value intersects with the request URL, the run-time value can be identified as the custom parameter. A custom parameter rule can be generated based on the comparison.