Web Traffic Learning for Application Layer Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security appliances, such as firewalls, are not designed to evaluate the intricacies of modern web applications and fail to detect application layer attacks like SQLi and XSS, as these attacks can be indistinguishable from normal traffic at the network layer, posing a challenge for web security models that rely on positive or negative variants.
Innovation Solution
A streaming-friendly solution for fault-tolerant learning of web traffic is implemented, which enforces thresholds for different attributes of traffic, such as URL parameters, to prevent malicious requests by allowing only requests that meet specific criteria, such as a large number of requests from diverse IP addresses and User-Agent strings across different time periods, facilitating anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewalls evaluate network layer information using allowed lists or denied lists, then they can block certain attacks, but they cannot detect application layer attacks like SQLi and XSS that use valid web traffic
Solution Approach 1:
The patent segments the web traffic analysis into multiple dimensions: URL parameters, HTTP methods, headers, and response codes. Instead of treating traffic as a single entity, the system breaks it down into discrete learnable features that can be individually analyzed against established patterns, enabling detection of application layer attacks while maintaining compatibility with valid traffic.
Solution Approach 2:
The system performs preliminary learning during a setup phase where it observes legitimate traffic patterns, URL parameters, and normal web application behavior before deployment. This preliminary action establishes a baseline of expected traffic characteristics, allowing the firewall to later identify deviations that indicate attacks without blocking legitimate requests.
2Reliability
If a positive security model with an allowed list is used, then requests matching the list are permitted, but any deviation is blocked including legitimate variations
Solution Approach 1:
The patent implements dynamic parameter learning where the system continuously adapts to legitimate traffic variations. Instead of a static allowed list, the firewall learns evolving patterns of valid URL parameters, query strings, and request formats. This dynamic adaptation allows legitimate traffic variations to pass through while maintaining security enforcement against malicious patterns.
Solution Approach 2:
The system changes the approach from fixed allowed/denied lists to parameter-based learning. It analyzes specific parameters such as URL query strings, HTTP headers, and response codes to determine legitimacy. This parameter-centric approach allows the system to accommodate legitimate variations in traffic parameters while blocking malicious parameter combinations that indicate attacks.
3Reliability
If a negative security model with a denied list is used, then requests matching signatures are blocked, but attacks using valid web traffic remain invisible
Solution Approach 1:
The patent replaces the mechanical signature-matching system with a learning-based approach. Instead of relying on pre-defined attack signatures, the system learns normal traffic patterns and automatically identifies deviations. This substitution enables detection of previously invisible attacks that use valid web traffic structures, as the system can recognize anomalous parameter combinations even without explicit signature definitions.
Solution Approach 2:
The system implements feedback mechanisms where blocked requests are analyzed to refine learning models. When potential attacks are detected, the system uses this feedback to improve its understanding of malicious patterns. This continuous feedback loop enhances the system's ability to detect application layer attacks over time while reducing false positives that would block legitimate traffic.
Data Source
AI summary
A method includes monitoring web traffic until a threshold of network traffic is collected. The method further includes determining a number of location characteristics corresponding to the network traffic. The method further includes monitoring traffic information corresponding to the number of location characteristics until a threshold of traffic information is collected. The method further includes determining a number of location content flags corresponding to the traffic information. The method further includes generating, by a processing device, a location profile based on the number of location characteristics and the number of content flags. The method further includes blocking impermissible web traffic from reaching a client device based on the location profile.