Web Server Plug-in Agent for Encrypted Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security management systems are unable to detect SSL/TLS-based encrypted attacks and cope with web hacking attacks during sessions after normal login due to their packet-dependent nature, which limits their ability to analyze encrypted data and identify abnormal transactions.
Innovation Solution
A security system comprising a WAS or WEB plug-in agent that collects transaction information from a web application server or web server, including HTTP header, session ID, user ID, and database access information, and a management server that analyzes this information to detect abnormal transactions and transmit blocking instructions, enabling detection of SSL/TLS-based encrypted attacks and web hacking incidents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security management systems use packet sniffing and parsing in layers L4 or L7, then they can perform basic intrusion detection and blocking, but they cannot detect SSL/TLS based encrypted attacks and cannot cope with web hacking attacks during sessions after normal login
Solution Approach 1:
The patent introduces a WAS plug-in agent as an intermediary component installed on the web application server. This agent collects transaction information including HTTP headers, session IDs, user IDs, and database access details, then transmits this data to the management server for analysis. This intermediary approach enables detection of encrypted SSL/TLS attacks and post-login web hacking without requiring complex packet parsing of encrypted traffic, thus improving detection reliability while managing system complexity through modular architecture.
2Measurement precision
If the system collects detailed transaction information from web application servers including HTTP headers, session IDs, user IDs, and database access information, then detection precision for abnormal transactions improves, but the complexity of information collection and processing increases
Solution Approach 1:
The patent segments the information collection function into multiple specialized modules within the WAS plug-in agent: HTTP header information collection module, web session ID collection module, user ID information collection module, and DB access information collection module. Each module collects specific types of transaction information independently, then the management server processes these segmented information types separately to determine abnormal transactions. This segmentation improves measurement precision by ensuring comprehensive data collection while managing processing complexity through modular organization.
3Reliability
If the management server analyzes transaction information to detect abnormal transactions and transmits blocking instructions, then the ability to cope with web hacking attacks improves, but the system response time and processing load increase
Solution Approach 1:
The patent implements preliminary action by pre-defining abnormal transaction patterns and criteria in the management server before attacks occur. The system continuously monitors transaction information against these pre-established patterns, enabling rapid detection and blocking instructions to be transmitted immediately when anomalies are detected, rather than requiring time-consuming analysis during the attack response phase. This preliminary preparation improves attack response capability while minimizing processing time during actual threat detection.
Data Source
AI summary
The present disclosure provides a security system comprising: a WAS plug-in agent installed on a web application server (WAS) or a WEB plug-in agent installed on a web server (WEB), wherein the WAS plug-in agent or WEB plug-in agent is configured to collect transaction information; and a management server configured to: receive the transaction information from the WAS plug-in agent or WEB plug-in agent; determine whether the transaction information is normal or abnormal; generate detection information based on the determination; and upon determination that the transaction information is abnormal, transmit, to the WAS plug-in agent or the WEB plug-in agent, a blocking instruction to block a transaction corresponding to the abnormal transaction information. According to the present disclosure, the analysis of decrypted transaction information may allow detecting SSL/TLS based encrypted attacks and coping with web hacking attacks at session level after normal login.