Web Server Attack Detection Using Character Class Sequences
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Web server attack detection methods face issues with false detection due to limited learning data, complex parameter structures, and mismatched regular expressions, leading to incorrect classification of normal data as faulty.
Innovation Solution
A log analyzing device and attack detecting system that extracts parameters from access logs, converts them into class sequences using predefined character string classes, and calculates similarity to determine if a request is an attack, reducing false detection by abstracting parameter values into class sequences and using a predetermined threshold for similarity analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a state transition model is generated with each character as a state, then the detection covers all parameter values, but data not existing in learning data causes false detection
Solution Approach 1:
The patent changes the parameter representation from raw character values to abstract character classes (e.g., alphanumeric, numeric, special characters). This transformation allows the system to generalize from limited learning data and recognize patterns even when exact parameter values differ, thereby reducing false detection of normal data while maintaining detection accuracy for actual attacks.
Solution Approach 2:
The patent applies different character class definitions to different positions within parameter values. By defining position-specific character classes that reflect the expected structure at each position, the system can accurately validate normal data patterns while detecting anomalies, reducing false positives without sacrificing detection precision.
2Ease of manufacture
If a single character string class is generated for a single parameter, then the profile generation is simple, but parameters with complicated structures cannot be properly profiled
Solution Approach 1:
The patent segments parameter values into multiple character classes based on position and pattern. Instead of treating each parameter as a single homogeneous class, the system divides it into segments (e.g., prefix, middle, suffix portions) with different character class expectations. This segmentation enables accurate profiling of complex parameter structures while maintaining the simplicity of using predefined character classes.
Solution Approach 2:
The patent adds a dimensional aspect to character string classification by introducing position-based character classes. Rather than a single flat class assignment, the system creates a multi-dimensional classification where character classes vary by position within the parameter value, enabling accurate representation of complex structures without increasing system complexity.
3Measurement precision
If regular expressions are strictly matched for character string classes, then precise format validation is achieved, but normal data with format variations is incorrectly identified as attacks
Solution Approach 1:
The patent transforms the rigid regular expression matching approach into a flexible character class matching system. Instead of requiring exact format matches, the system uses character classes that define acceptable ranges and patterns at each position. This allows normal data with legitimate format variations to pass validation while still detecting actual format violations that indicate attacks.
Data Source
AI summary
A device including: a parameter extracting unit that extracts each parameter from an access request, a character-string class converting unit that, with regard to each parameter, compares each part of a parameter value with a previously defined character string class, replaces the part with a longest matching character string class, and conducting conversion for a class sequence that is sequentially arranged in order of replacement, a profile storing unit that stores, as a profile in a storage unit, a class sequence with the appearance frequency of equal to or more than a predetermined value in the above-described group of class sequences with regard to the access request of the normal data as learning data, and a failure detecting unit that determines the presence or absence of an attack in accordance with the degree of similarity between the above-described class sequence and the profile with regard to the access request.