Web Application Vulnerability Detection Through HTTP Request Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing applications are vulnerable to malicious attempts to detect vulnerabilities, which can lead to unauthorized access and exploitation of sensitive information, and traditional signature-based approaches are ineffective against zero-day attacks.
Innovation Solution
A system and method that utilizes lexical and structural analysis of HTTP requests to identify anomalous patterns, employing a novelty-detection approach with binomial thresholds to detect malicious attempts and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based approaches are used to detect malicious attempts, then known vulnerabilities can be identified, but zero-day attacks and novel malicious patterns cannot be detected
Solution Approach 1:
The patent transforms the detection approach from signature-based (exact pattern matching) to statistical parameter-based detection. It extracts lexical parameters (character counts, word frequencies) and structural parameters (URL components, HTTP headers) from requests, then uses statistical analysis to identify anomalies. This allows the system to detect zero-day attacks by recognizing deviations from normal parameter distributions without requiring prior knowledge of specific attack signatures.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a statistical inference system. Instead of mechanically comparing requests against a database of known attack signatures, the system uses statistical models to infer whether a request is malicious based on its parameters. This substitution enables detection of previously unseen attack patterns through anomaly detection rather than exact pattern matching.
2Measurement precision
If lexical and structural analysis of all HTTP requests is performed to detect anomalies, then detection precision improves, but processing time and computational complexity increase
Solution Approach 1:
The patent segments the HTTP request into distinct components (headers, URL, parameters, body) and extracts specific lexical and structural features from each segment independently. This segmentation allows the system to process only relevant features rather than analyzing the entire request as a single unit, reducing computational overhead while maintaining detection precision. The segmented approach enables parallel processing of different request components.
Solution Approach 2:
The patent applies partial analysis by selecting and analyzing only the most discriminative lexical and structural parameters rather than examining all possible request attributes. It uses statistical thresholds to determine when full analysis is necessary versus when simplified checks suffice, performing excessive analysis only when anomaly indicators are detected, thus balancing precision with processing efficiency.
Data Source
AI summary
Described embodiments provide systems and methods for identifying malicious attempts to detect vulnerabilities in an application. At least one processor may determine a mean and a standard variation of character counts of each of a plurality of characters from a plurality of sets of data. The at least one processor may determine a distance metric for each of the characters in each of the sets of data. For a corresponding set of data, the at least one processor may determine a number of outliers to determine whether the corresponding set of data is anomalous.