Web Application Attack Determination via Response Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for determining the success or failure of web application attacks face challenges when attack traces appear in responses different from the expected response, leading to inaccurate assessment.
Innovation Solution
A method that determines the attack type of an attack code, emulates the attack, extracts features from the server response, and examines subsequent responses for the presence of these features to accurately assess attack success or failure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the response corresponding to the attack request is set as the examination target, then the determination process is simple, but the determination accuracy deteriorates when attack traces appear in different responses
Solution Approach 1:
The examination mechanism is extended to handle multiple response types universally. Instead of limiting examination to only the attack request response, the system now examines any response that contains attack traces, making the determination process adaptable to various attack scenarios where traces may appear in different responses (e.g., subsequent responses, error responses, or responses to related requests).
Solution Approach 2:
The system uses the extracted attack traces as feedback to identify and examine relevant responses. By extracting characteristic traces from the attack emulation and then searching for these traces in subsequent responses, the system creates a feedback loop that improves determination accuracy by dynamically identifying which responses to examine based on the specific attack characteristics.
2Measurement precision
If attack traces are examined in multiple subsequent responses, then the determination accuracy improves, but the examination complexity increases
Solution Approach 1:
The system extracts characteristic attack traces from the emulation results and separates them from the complex attack request data. These extracted traces serve as simplified search criteria that can be efficiently matched against multiple responses, reducing the complexity of examining subsequent responses while maintaining high determination accuracy.
Solution Approach 2:
The system performs preliminary extraction of attack traces from the emulation before examining subsequent responses. By preparing the search criteria (attack traces) in advance and storing them for later comparison, the system reduces the complexity of the examination process when analyzing multiple responses, as the traces are already identified and ready for matching.
3Reliability
If emulation is performed to extract attack features, then the determination reliability improves, but the processing time increases
Solution Approach 1:
The system performs emulation only for identified attack requests rather than examining all requests. By applying partial action (emulation only when attack is detected) rather than excessive action (emulation for all requests), the system maintains high determination reliability for actual attacks while minimizing unnecessary processing time for normal requests.
Solution Approach 2:
The system performs attack type determination and emulation in advance before the actual attack occurs in the production environment. By pre-executing the emulation to extract traces and store them for later comparison, the system reduces the processing time required during actual attack detection, as the heavy emulation work has already been completed beforehand.
Data Source
AI summary
A determination method includes determining an attack type of an attack code included in an attack request on the server, carrying out emulation of an attack by the attack code on the server in accordance with the determined attack type, and in a case of succeeding in an attack on the server as a result of the emulation, extracting a feature appearing in a response from the server, and examining whether a plurality of responses respectively corresponding to a plurality of requests to the server after the attack request each have the extracted feature, and in a case where at least any one of the plurality of responses has the extracted feature, determining that an attack by the attack code has succeeded, by a processor.