Website Vulnerability Inspection via Dynamic Type-Based Parameter Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional vulnerability detection methods fail to identify malfunctions caused by valid input values, such as changes in product prices or message content, which are unacceptable in terms of specification.
Innovation Solution
A system and method that determines the type of a website, webpage, and parameters based on page information, using machine learning models to inspect for vulnerabilities by applying inspection rules tailored to these types, including both valid and invalid input value scenarios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If parameter-based vulnerability detection using detection patterns is used, then invalid input values can be detected, but valid input values causing specification violations cannot be detected
Solution Approach 1:
The patent changes the detection parameter from fixed detection patterns to dynamically generated expected values based on type information. By determining the type of website, webpage, and parameter, the system generates context-appropriate expected values that can detect both invalid inputs and specification violations, thereby expanding detection scope while maintaining accuracy
Solution Approach 2:
The patent introduces dynamic adaptation by determining types of website, webpage, and parameter, and generating detection patterns based on these types. This dynamic approach allows the system to adjust detection strategies according to specific contexts, enabling detection of both traditional invalid inputs and novel specification violations
2Reliability
If type determination and tailored inspection rules are applied, then comprehensive vulnerability detection including valid input values is achieved, but system complexity increases
Solution Approach 1:
The patent segments the inspection process into distinct phases: type determination (website type, webpage type, parameter type) followed by tailored inspection rule application. This segmentation allows complex detection logic to be organized into manageable modules, improving reliability while making the complexity more controllable and maintainable
Solution Approach 2:
The patent performs preliminary type determination before applying inspection rules. By pre-classifying the website, webpage, and parameter types, the system prepares context-specific detection strategies in advance, which improves detection reliability and allows complex logic to be organized in a structured, manageable way
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A vulnerability inspection server according to an embodiment of the present invention assists in inspecting a website for various vulnerabilities. The server provides, to a user who operates a user terminal communicatively connected to the server through a communication network, a vulnerability inspection service in which a website specified by the user is inspected for vulnerabilities. The server determines the type of the website, the type of multiple webpages included in the website, and/or the type of parameters in the webpages on the basis of page information on each of the webpages and inspects the website for vulnerabilities on the basis of these types. Thus, it is able not only to detect a malfunction caused by an invalid input value but also to perform appropriate inspections according to the meaning, purpose, function, or the like of the website, webpages, and/or parameters.