Web Resource Compromise Detection via Historical Database Querying
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face difficulties in quickly detecting and reacting to compromised web resources, as current web security applications are unable to detect attacks on trusted sites that have been compromised, leading to potential security risks.
Innovation Solution
A method and system that monitor user requests for web resources over time to determine trusted sites, query a network database for historical data on site compromises, and alert users or administrators if a compromised site is accessed, restricting access if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users manually check news sources to detect compromised web resources, then they can become aware of security breaches, but this process is time-consuming and users cannot react quickly enough
Solution Approach 1:
The system performs preliminary actions by proactively monitoring web resources and maintaining a database of compromised sites before users need to check. The automated system continuously updates the database of compromised web resources, so when users access sites, the checking mechanism can immediately query this pre-prepared database without requiring users to manually check news sources first.
Solution Approach 2:
The system enables self-service by automatically detecting and monitoring compromised web resources without requiring user intervention. The automated checking mechanism continuously queries the database and notifies users of compromises, eliminating the need for users to manually monitor security news and perform time-consuming research to detect compromised sites.
2Reliability
If current web security applications block all suspicious sites, then user safety is improved, but legitimate trusted sites that have been temporarily compromised are also blocked, causing false positives
Solution Approach 1:
The system applies local quality by implementing granular, site-specific monitoring and assessment rather than blanket blocking. Each web resource is individually evaluated against the compromise database, allowing the system to distinguish between genuinely malicious sites and legitimate sites that may have temporary issues. This localized approach enables precise security measures tailored to each site's actual risk level.
Solution Approach 2:
The system implements dynamics by continuously updating the compromise database and re-evaluating site status over time. The monitoring mechanism dynamically adjusts its assessments based on new information from the database, allowing legitimate sites to be unblocked once they are no longer compromised while maintaining blocks on persistently malicious sites. This dynamic approach reduces false positives while maintaining security.
3Reliability
If comprehensive monitoring of all web resources is implemented, then security coverage is improved, but system complexity and computational resources increase
Solution Approach 1:
The system extracts and isolates the core security checking function into a separate, dedicated mechanism that queries a centralized database. Rather than embedding complex monitoring logic throughout the entire system, the compromise detection functionality is extracted as a distinct module that can be independently maintained and updated. This extraction reduces overall system complexity while maintaining comprehensive security coverage.
Solution Approach 2:
The system introduces an intermediary database that acts as a mediator between web resources and the monitoring system. Instead of directly monitoring and analyzing each web resource in real-time, the system queries this intermediary database that already contains compromise information. This intermediary layer simplifies the monitoring architecture by decoupling the complexity of web resource analysis from the user-facing checking mechanism.
Data Source
AI summary
According to an aspect of the invention, there is provided a method of protecting a user from a compromised web resource. The method may include monitoring a user's requests for trusted web resources to determine one or more web resources to be checked. The method may include querying a network database based on the determined one or more web resources to obtain historical data relating to whether any of the one or more web resources has been compromised at any time during a preceding time period. The method may include providing a predetermined response to protect the user if any of the one or more web resources has been compromised.