Web Proxy Anomaly Detection via Request Sequence Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web application layer proxies are ineffective in detecting and mitigating zero-day attacks and business logic attacks, as they rely on negative or schema enforcement security models that fail to recognize threats evident only through contextual actions.
Innovation Solution
A web application layer proxy system that constructs sequences of requests, generates profiles based on past behavior, determines context tags, and assigns risk rankings to detect anomalies, enabling real-time identification and mitigation of attacks, including zero-day and business logic attacks, by using a configuration that maps actions, context, and threat values to appropriate responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If negative security models are used to compare each individual request against a list of impermissible actions, then known attacks can be detected effectively, but zero-day attacks and business logic attacks cannot be detected because they are not in the prohibited list
Solution Approach 1:
The system performs preliminary actions by constructing sequences of requests and generating profiles of normal behavior patterns before actual attacks occur. These profiles serve as a baseline for detecting anomalies, enabling the system to identify zero-day and business logic attacks that traditional negative security models miss.
Solution Approach 2:
The patent transitions from analyzing individual requests in one dimension to analyzing sequences of requests across multiple dimensions. By examining temporal patterns, request sequences, and contextual relationships, the system detects attacks that manifest through contextual actions rather than isolated malicious payloads.
2Reliability
If schema enforcement security models are used to maintain a list of permissible actions, then several types of attacks can be blocked, but attacks evident only through contextual actions (business logic attacks) remain undetected
Solution Approach 1:
The system implements feedback mechanisms by continuously monitoring request sequences, comparing them against learned profiles of normal behavior, and adjusting detection parameters based on detected patterns. This feedback loop enables the system to adapt to new attack vectors while maintaining protection against known threats.
Solution Approach 2:
The system performs self-service by automatically learning and updating behavior profiles without requiring manual configuration of permissible actions. The automated profile generation and anomaly detection enable the system to identify business logic attacks through contextual analysis rather than relying on pre-defined schemas.
3Productivity
If traditional security models process each request independently, then processing is simple and fast, but contextual relationships between requests are lost and multi-request attacks cannot be detected
Solution Approach 1:
The system segments the analysis process into distinct phases: constructing request sequences, generating behavior profiles, determining context tags, and assigning risk rankings. This segmentation allows efficient processing of individual requests while maintaining the capability to analyze contextual relationships across request sequences.
Solution Approach 2:
The system applies partial action by focusing computational resources on requests that exhibit anomalous characteristics or deviate from learned profiles. Rather than performing full sequence analysis on every request, the system identifies suspicious patterns and applies more rigorous analysis only where needed, maintaining productivity while improving detection accuracy.
Data Source
AI summary
A method is described for a proxy to mitigate attacks from web application clients based on context of web application layer requests. The method includes receiving a plurality of web application layer requests from a web application layer client; aggregating a first set of requests from the plurality of web application layer requests, wherein the first set of requests are part of a first session; determining a profile based on the first set of requests, wherein the profile describes a baseline of expected behavior for a user of the web application layer client; and determining a first threat value associated with the first set of requests based on the first set of requests and the profile, wherein the first threat value describes the likelihood that the first set of requests are part of an attack on one or more web application servers.