Web Traffic Logging System for Real-Time Hacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current web application firewalls face performance degradation and limited configurability in cloud environments, and signature-based analysis struggles with false positives and inability to detect new attacks, failing to effectively block malware like web shells.
Innovation Solution
A web traffic logging system that collects and transmits HTTP/HTTPS protocol traffic logs to a cloud server for real-time analysis, decomposing and fingerprinting data to rapidly detect attacks, while minimizing server performance impact and expanding detectable attack ranges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web application firewall analyzes web traffic in host server, then hacking detection capability is improved, but host server performance is reduced
Solution Approach 1:
The patent extracts the traffic analysis function from the host server and relocates it to a dedicated reverse proxy server. The reverse proxy intercepts web traffic before it reaches the host server, performs security analysis, and only allows legitimate traffic to pass through. This separation ensures that the host server's performance is not degraded by analysis operations.
Solution Approach 2:
The reverse proxy acts as an intermediary between clients and the host server. It receives all incoming traffic, analyzes it for security threats using signature-based detection, and forwards only clean traffic to the host server. This intermediary layer provides security protection without impacting the host server's processing performance.
2Measurement precision
If signature-based analysis uses more signatures to reduce false rate, then detection accuracy is improved, but detection speed is reduced
Solution Approach 1:
The system performs preliminary classification of traffic into normal and suspicious categories using efficient filtering mechanisms before applying comprehensive signature analysis. Common legitimate traffic patterns are quickly identified and allowed to pass, while only potentially malicious traffic undergoes full signature-based inspection. This preliminary action reduces the overall processing load while maintaining high detection accuracy for actual threats.
3Adaptability or versatility
If web application firewall is deployed in cloud environment, then flexibility is improved, but configurability is limited
Solution Approach 1:
The reverse proxy server is designed with multi-functionality to operate effectively in cloud environments. It combines security analysis, traffic management, and logging capabilities in a single deployable unit that can be easily instantiated across multiple cloud instances. The system provides standardized configuration interfaces and supports centralized policy management, enabling flexible deployment while maintaining ease of configuration through uniform interfaces.
4Reliability
If signature-based analysis is used to detect hacking, then known attack detection is improved, but new attack detection is reduced
Solution Approach 1:
The system performs preliminary analysis using signature-based detection to quickly identify known attack patterns. Simultaneously, it collects traffic samples and behavioral data that feed into anomaly detection mechanisms. This dual approach allows the system to reliably detect known attacks while also being prepared to identify new attack patterns through behavioral analysis of deviant traffic characteristics.
Data Source
AI summary
The present invention relates to a hacking detecting technology, and more specifically, to a logging technology for analyzing web traffic to cope with web hacking. In a system according to an embodiment of the invention, a server in which packet or log is generated does not perform web traffic analysis, but a cloud server which is a remote system detects and blocks system attack, thereby providing a service with an effect similar to a web application firewall.