Web Server Backup Analysis for Malicious Change Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional web server security solutions are limited by performance degradation and fail to effectively detect malicious activities, especially in updated environments, due to their reliance on direct server processing.
Innovation Solution
A system utilizing machine learning models and backup archives to analyze changes in web server files, applying security rules and multiple ML models to identify malicious activity, with the option to roll back to a secure backup state if severe threats are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security solutions (WAF, access control lists) are deployed directly on the web server or in the network path, then security detection capability is provided, but performance degradation occurs
Solution Approach 1:
The patent introduces a separate security analysis system that operates independently from the web server. This system retrieves backups, analyzes changes using machine learning models, and generates security assessments without directly interfering with web server operations. The intermediary position of the analysis system allows comprehensive security checking while avoiding the performance degradation that would result from embedding security checks within the server's request-processing path.
2Measurement precision
If machine learning models are used to detect malicious activity, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent divides the security analysis system into multiple specialized machine learning models, each responsible for specific aspects of malicious activity detection. This segmentation allows each model to be optimized for its particular function while keeping individual model complexity manageable. The modular architecture also enables independent training and deployment of each model component.
Solution Approach 2:
The patent creates a multi-functional security analysis system that uses machine learning models to perform various detection tasks including identifying malicious code, analyzing suspicious patterns, and assessing risk levels. This universal approach allows a single integrated system to handle diverse security threats rather than requiring separate specialized tools for each threat type.
3Reliability
If comprehensive security analysis is performed on all web server files, then detection coverage is improved, but processing time increases
Solution Approach 1:
The patent performs security analysis on backup files rather than on the live web server files. By analyzing backups that represent previous states of the server, the system can conduct comprehensive file-by-file examination without impacting current server operations or requiring real-time processing of active web content. This preliminary analysis approach maintains thorough detection coverage while avoiding time-critical performance issues.
Solution Approach 2:
The system implements periodic security analysis by scheduling regular backup retrievals and change detections rather than continuously monitoring all files in real-time. This periodic approach allows comprehensive analysis to be performed at intervals when server performance requirements are less demanding, balancing thorough detection coverage with acceptable processing time and resource utilization.
Data Source
AI summary
Disclosed herein are systems and method for detecting malicious activity on a web server. A method may include: retrieving a first backup and a second backup of a web server from a backup archive that stores a plurality of backups of the web server, wherein the first backup was generated at a first time and the second backup was generated at a second time; detecting at least one change between the first backup and the second backup; determining whether the at least one change is associated with malicious activity based on a plurality of security rules and a plurality of machine learning models and a severity of the malicious activity; and in response to determining that the severity is greater than a threshold severity, executing a rollback function of the web server to a backup that does not include the malicious activity.