Web Application Vulnerability Detection via Parameter Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for determining vulnerability in web applications are inefficient, as they apply the same vulnerability determination process to all parameters in a URL, leading to redundant checks and excessive time consumption, especially in large-scale portal websites, and fail to differentiate between parameters with completed and incomplete vulnerability assessments.
Innovation Solution
A method and system that select a fixed parameter from a URL, determine if vulnerability determination has been completed, insert attack patterns for each attack type into the input value of the selected parameter, and analyze the response to assess vulnerability, thereby reducing redundant checks and focusing on parameters with incomplete assessments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the vulnerability determination process is applied to all parameters in a URL, then comprehensive security assessment is achieved, but time consumption increases significantly
Solution Approach 1:
The patent segments the vulnerability determination process by dividing URL parameters into two categories: fixed parameters (which require vulnerability testing) and variable parameters (which are excluded from testing). This segmentation allows the system to focus computational resources only on parameters that need assessment, thereby reducing overall time consumption while maintaining comprehensive security evaluation of critical parameters.
Solution Approach 2:
The patent applies local quality by treating different parameters differently based on their characteristics. Fixed parameters receive full vulnerability determination processing, while variable parameters are excluded. This differentiated approach ensures that security assessment is applied locally where needed (fixed parameters) without wasting resources on parameters that don't require it (variable parameters), resolving the contradiction between comprehensiveness and efficiency.
2Reliability
If the vulnerability determination process is repeatedly applied to the same URL or parameter, then thorough checking is performed, but redundant checks waste time
Solution Approach 1:
The patent implements preliminary action by maintaining a database that records which fixed parameters have already undergone vulnerability determination. Before performing vulnerability testing, the system checks this database to determine if the parameter has been previously assessed. If yes, the system skips the redundant testing; if no, it proceeds with the vulnerability determination. This preliminary check prevents redundant operations while ensuring thorough assessment of untested parameters.
3Reliability
If vulnerability determination is applied to all parameters in large-scale portal websites, then complete security coverage is achieved, but processing efficiency deteriorates
Solution Approach 1:
The patent segments the large set of URL parameters into fixed parameters (requiring vulnerability testing) and variable parameters (excluded from testing). This segmentation strategy enables the system to maintain complete security coverage over critical fixed parameters while dramatically improving processing efficiency by excluding numerous variable parameters from the testing process, thus resolving the contradiction between coverage and efficiency in large-scale portal websites.
Data Source
AI summary
A method of determining vulnerability of web application comprises: selecting fixed parameters from parameters of URL link extracted from a website; determining whether a process of determining vulnerability for the selected fixed parameter is completed or not; inserting an attack pattern for each attack type to an input value for the selected fixed parameter, when the process of determining vulnerability for the selected fixed parameter is not completed; and determining vulnerability of the selected fixed parameter by each attack type through an analysis of response to an input of URL link with the attack pattern inserted thereinto.