Web Application Security Scanner Circumvention via Traffic Profiling

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Web applications lack effective defense mechanisms against security scanners, which can be exploited by nefarious parties to identify vulnerabilities, and existing security scans are not sufficient to protect against such threats post-test phase.

Innovation Solution

A system and method that monitors incoming traffic to a web application, compares it to a security scanner traffic profile generated by modeling known security scanner traffic, and circumvents security scanners by providing dummy content to prevent detection and potential attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security scanners are used to identify vulnerabilities in web applications, then security vulnerabilities can be detected, but web applications become vulnerable to exploitation by nefarious parties post-test phase

Engineering Contradiction:

Improvesecurity vulnerability detectionVSAvoidexploitation risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary identification of security scanners by analyzing traffic patterns and comparing them against known scanner profiles before the scanners can exploit vulnerabilities. This advance detection allows the web application to prepare defensive measures in advance, preventing post-test phase exploitation while maintaining the benefits of security scanning during development.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system converts the harmful traffic from security scanners into beneficial information by analyzing scanner behavior patterns, identifying vulnerability types being probed, and using this intelligence to strengthen the application's defenses. The scanner traffic itself becomes the data source for improving security posture.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

2Object-affected harmful factors

If security scanners are blocked or prevented from accessing the web application, then exploitation risk is reduced, but legitimate security testing capabilities are compromised

Engineering Contradiction:

Improveexploitation riskVSAvoidsecurity testing capability

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The system applies different response strategies to different types of incoming traffic based on local analysis of scanner behavior. Legitimate security scanners used during development are identified and allowed full access for testing, while malicious scanners detected in production environments are blocked or subjected to honeypot traps. This localized quality control preserves security testing capabilities while preventing exploitation.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system dynamically adjusts its response to security scanner traffic based on contextual factors such as the development phase, application state, and scanner behavior patterns. During development, scanners are permitted to perform comprehensive tests; during production, the system dynamically blocks or redirects scanners based on real-time threat assessment, maintaining both testing capability and security.

Inventive Principle:

Principle #15Dynamics

3Measurement precision

If traffic monitoring and analysis is implemented to identify security scanners, then security scanner detection capability is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity scanner detection accuracyVSAvoidtraffic monitoring system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system implements partial monitoring by focusing analysis on specific traffic characteristics most indicative of scanner behavior, such as request patterns, user agent strings, and probing sequences. Rather than analyzing every aspect of incoming traffic in depth, the system applies targeted analysis to key indicators, achieving high detection accuracy with reduced computational complexity.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The system creates simplified copies or models of scanner behavior patterns and traffic characteristics to compare against actual incoming traffic. By using representative profiles and templates of known scanner behaviors, the system achieves accurate scanner identification through pattern matching rather than complex real-time analysis, reducing system complexity while maintaining detection precision.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS11374959B2Identifying and circumventing security scanners

Publication Date: 2022.06.28 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A system and method for identifying and circumventing a security scanner includes monitoring incoming traffic to a web application, identifying a portion of the incoming traffic as security scanner traffic by comparing the incoming traffic to a security scanner traffic profile, and circumventing the security scanner by providing dummy content or signaling the web application to provide dummy content. The security scanner traffic profile is created by receiving web application traffic generated by a plurality of security scanners; identifying web application traffic features common to at least a portion of the plurality of security scanners by modelling using artificial intelligence, machine learning, and the like; and generating the security scanner traffic profile based on the identified web application traffic features.