Web Application Attack Detection via Event Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for correlating events to detect web application attacks are prone to errors, leading to incorrect correlations of irrelevant events and missed detections due to timing differences between relevant events.
Innovation Solution
An analysis method that creates event blocks using process IDs and transmission source port numbers to accurately correlate events, followed by a similarity calculation to detect abnormal activity indicative of attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If events are correlated based only on time of occurrence, then the correlation process is simple, but the accuracy of attack detection deteriorates due to erroneous correlation of irrelevant events and missed detections
Solution Approach 1:
The patent segments events into different types (HTTP request events, system log events, firewall log events) and correlates them separately before integrating the results. This segmentation allows for more precise correlation within each event type while maintaining overall system simplicity, resolving the contradiction between correlation complexity and detection accuracy.
Solution Approach 2:
The patent introduces an event type classification as an intermediary layer between raw event correlation and attack detection. By classifying events into specific types first, the system can apply type-specific correlation rules, improving detection accuracy without proportionally increasing overall complexity.
2Measurement precision
If a strict time window is used for event correlation, then false correlations of irrelevant events are reduced, but relevant events with larger time differences are missed
Solution Approach 1:
The patent implements dynamic time windows for event correlation, where the time window duration adapts based on event type and context. For example, different time windows are applied to HTTP requests versus system logs, allowing the system to capture relevant events with varying time differences while maintaining correlation accuracy through type-specific parameters.
Solution Approach 2:
The patent changes correlation parameters (time window size, event type weights, threshold values) based on the specific event being analyzed. By adjusting these parameters dynamically according to event type and context, the system achieves both high correlation accuracy and broad event coverage, resolving the contradiction between precision and adaptability.
3Measurement precision
If multiple event types are correlated with detailed analysis, then attack detection accuracy improves, but the computational complexity and processing time increase
Solution Approach 1:
The patent segments the analysis system into modular components that handle different event types independently (HTTP event analyzer, system log analyzer, firewall log analyzer). Each module performs detailed analysis only on its specific event type, achieving high overall detection accuracy while keeping individual module complexity manageable and enabling parallel processing.
4Productivity
If all events are correlated regardless of relevance, then no relevant events are missed, but false positives increase and processing efficiency decreases
Solution Approach 1:
The patent applies different correlation strategies and relevance criteria to different event types and contexts. For example, HTTP requests are correlated with specific system logs based on process ID matching, while firewall events use different correlation rules. This localized approach to event quality assessment reduces false positives while maintaining high detection reliability and processing efficiency.
Data Source
AI summary
In order to detect an attack to a web application accurately by accurately correlating different types of events having occurred in the same server, an event acquiring unit acquires a log of events containing a HTTP request to a server, an event correlator creates a set of the request and events relevant to the request as an event block by using process IDs of processes having processed events contained in the log, and an attack detector contrasts the event block that is created from the log of events in which an attack is to be detected with an event block that is created from normal events to calculate a degree of similarity and, when the degree of similarity is equal to or lower than a threshold, detects the event block as an event block containing an event that is abnormal due to an attack.