Learning Method for Web Server Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for detecting attacks on Web servers face challenges in accurately learning profiles, leading to erroneous detection or missing detection due to reliance on features with high appearance frequencies or those with low ranks, which can result in incorrect classification of requests as attacks or normals.
Innovation Solution
A learning method that generates a character class series abstracting the structure of character strings in requests, calculates a score for each combination of identification information and character class series based on appearance frequency and continuity, and updates profiles to determine whether requests are attacks or not, considering both the number of times of appearance and continuity of patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If features with high appearance frequency are selected as subjects of learning, then the quantity of learning data is increased, but the accuracy of attack detection deteriorates due to inclusion of attack request features
Solution Approach 1:
The patent changes the parameter for selecting learning features from simple appearance frequency to a composite score that incorporates both appearance frequency and continuity. This score transformation allows the system to distinguish between normal requests (high frequency, high continuity) and attack requests (high frequency, low continuity), thereby resolving the contradiction between quantity and accuracy.
2Quantity of substance
If features with low rank of appearance frequency are excluded from learning, then the quantity of learning data is increased, but the accuracy of attack detection deteriorates due to loss of useful features
Solution Approach 1:
The patent transforms the selection criterion from rank-based filtering to score-based selection, where the score combines appearance frequency and continuity. This allows features with lower appearance frequency but high continuity to be included in learning, preventing loss of useful features while maintaining data quality.
3Ease of operation
If learning is performed based solely on appearance frequency, then the simplicity of the learning process is maintained, but the reliability of profile learning deteriorates due to inability to distinguish normal from attack requests
Solution Approach 1:
The patent introduces a new scoring parameter that combines appearance frequency and continuity, transforming the learning criterion from simple frequency counting to a more nuanced evaluation. This maintains operational simplicity while significantly improving reliability by enabling distinction between normal and attack requests.
4Productivity
If requests with high appearance frequency are used for profile learning, then the productivity of learning is increased, but the accuracy of detection deteriorates due to erroneous inclusion of attack patterns
Solution Approach 1:
The patent changes the learning selection criterion to incorporate continuity alongside appearance frequency. This allows the system to quickly identify and learn from legitimate high-frequency patterns while filtering out attack patterns that lack continuity, thereby maintaining learning productivity while improving detection accuracy.
Data Source
AI summary
A learning device generates a character class series abstracting a structure of a predetermined character string included in each of requests to the server which have been generated in a predetermined period. Also, for each of the combinations of the predetermined identification information and the character class series included in the requests, the learning device calculates a score for update which becomes higher as the number of times of appearance of the combination is increased and becomes higher as the appearance of the combination is continued. Based on the score for update, the learning device updates the profile of each combination for determining whether the request is an attack or not.