Web Server Vulnerability Diagnosis via Response Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability diagnostic techniques for Web servers fail to accurately diagnose SQL injection vulnerabilities when the server changes its response content over time or with the number of access, leading to incorrect assessments.
Innovation Solution
A vulnerability diagnostic device that collects and compares normal and abnormal responses to determine if there is a difference, using a normal response collection means, common area extraction, and determination means to identify vulnerabilities, even if the Web server changes its response content, with the abnormal request being a SQL injection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the Web server changes response content over time or with number of access, then the response becomes more dynamic and adaptive, but the vulnerability diagnosis accuracy deteriorates because normal and abnormal responses cannot be properly compared
Solution Approach 1:
The patent segments the response content into multiple parts, comparing only the common parts that remain unchanged between normal and abnormal responses. This segmentation approach allows the system to handle dynamic responses by focusing comparison on stable segments rather than the entire response, thereby maintaining diagnosis accuracy despite response variations over time.
Solution Approach 2:
The patent extracts and compares only the common parts of responses that are invariant to temporal changes or access frequency. By taking out and isolating these stable components for comparison, the system can accurately diagnose vulnerabilities even when other parts of the response dynamically change, thus resolving the contradiction between response adaptability and diagnosis accuracy.
2Device complexity
If traditional vulnerability diagnosis methods are used, then the diagnosis process is simple, but the diagnosis accuracy deteriorates when the Web server dynamically changes its response content
Solution Approach 1:
The patent introduces segmentation of response content into comparable and non-comparable parts. This adds complexity to the diagnosis process by requiring identification and separation of common parts, but it significantly improves accuracy for dynamic responses. The segmentation approach balances the trade-off by making the process only slightly more complex while achieving substantial accuracy improvement.
Solution Approach 2:
The patent performs preliminary analysis to identify common parts of responses before conducting the vulnerability diagnosis comparison. This preliminary action of extracting invariant components prepares the data for accurate comparison, ensuring that the diagnosis process can handle dynamic responses effectively without requiring overly complex real-time analysis.
3Reliability
If the Web server implements security measures against SQL injection, then the security level improves, but the ability to detect vulnerabilities through response comparison deteriorates because legitimate responses may be filtered or modified
Solution Approach 1:
The patent extracts and compares only the common invariant parts of responses that are not affected by security filtering or modification. By focusing on these stable components, the system can detect vulnerabilities even when security measures modify other parts of the response, thus maintaining both security reliability and vulnerability detection capability.
Solution Approach 2:
Instead of comparing entire responses which may be modified by security measures, the patent inverts the approach by identifying and comparing only the common parts that should remain unchanged. This inverted comparison strategy allows vulnerability detection to work effectively even when security filters modify the visible response content.
Data Source
AI summary
To diagnose vulnerabilities such as SQL injection, even for web-server devices that change the content of responses to requests in accordance with prescribed conditions. A normal-response collection means (10) transmits a normal request (REQN), accompanied by a registered user ID and password, a plurality of times. Said normal-response collection means (10) receives a plurality of responses (RESN) (hereafter “normal responses”) from a web server in response to the normal requests. A common-region extraction means (12) extracts a common region from the plurality of normal responses. An abnormal-response collection means (18) performs SQL injection on the web server, receives the response (RESA) (hereafter “abnormal response”), and records same in a storage unit (16). A determination means (14) determines that the web server has a vulnerability if the normal responses and the abnormal response are the same in the common region.