Web Application Attack Success Detection From Communication Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to determine whether an attack has succeeded, particularly in cases where traces of the attack do not appear in the response, such as authentication bypass and information leakage attacks on web applications, due to varying damage based on the application's function.
Innovation Solution
A determination device that analyzes communication logs using URL patterns, response sizes, and status codes to identify and determine the success of attacks based on the web application's function, employing a control unit to create function profiles and make success/failure determinations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all attacks are detected and alerts are issued, then the detection coverage is improved, but maintenance persons or monitoring persons may overlook the alerts due to excessive alert volume
Solution Approach 1:
The patent segments attacks into two categories: suspicious attacks (detected but success uncertain) and successful attacks (confirmed via response inspection). This segmentation allows the system to issue alerts selectively for successful attacks only, reducing alert volume while maintaining comprehensive detection coverage for all attack types.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that inspects attack responses to determine success. This intermediary step acts as a filter between detection and alerting, confirming which detected attacks actually succeeded before generating alerts, thus reducing false positives and alert overload.
2Measurement precision
If attack success is determined by inspecting response content, then successful attacks can be identified, but attacks without explicit traces in responses (e.g., authentication bypass, information leakage) cannot be determined
Solution Approach 1:
The patent creates a universal determination framework that handles multiple attack types through a common architecture. The system maintains attack-specific determination rules (login form presence, response size thresholds, status code patterns) that can be applied across different attack scenarios, making the system adaptable to various attack types while maintaining precise success determination.
Solution Approach 2:
The patent changes the determination parameters based on attack type and target application characteristics. For authentication bypass attacks, it checks for login form presence; for information leakage, it monitors response size variations; for other attacks, it uses status code analysis. This parameter adaptation enables precise determination across diverse attack types.
3Measurement precision
If attack determination is based on response inspection, then attacks with explicit traces can be detected, but it becomes difficult to determine success for attacks against different web application functions with varying damage
Solution Approach 1:
The patent applies local quality by tailoring determination criteria to specific web application functions and attack targets. The system inspects relevant portions of responses based on the attacked function (e.g., authentication responses for login attacks, data responses for information leakage), rather than applying a uniform inspection method across all attacks. This localized approach enables precise determination for function-specific attacks.
Data Source
AI summary
A determination device includes processing circuitry configured to detect a communication log of an attack causing different damage in accordance with a function of a web application of a request destination using a URL of the request destination in a communication log in which an attack is to be detected, determine whether or not the attack has succeeded using whether or not there is a login form in the URL of the request destination, a response size to a request, or a status code, or any combination thereof, for the communication log in which the attack has been detected, and output a result of the determination.