US 10,382,465 B2 · Pattern matching based dataset extraction

Abstract

Example systems generate a dataset for tuning an analyzer to probe activities related to a web facing application. The systems capture data streams received at a framework of the application. The systems also capture a first set of functions, a second set of functions, and database queries triggered by the framework processing the data streams. The systems match: (i) the first set of functions to packets of the data streams and (ii) the second set of functions to the database queries. For example, the systems may pattern match: (i) data in parameters of the first set of functions to data in fields of the packets and (ii) data in parameters of the second set of functions to data in expressions of the database queries. The systems extract matched functions and database queries into the dataset and probe activities of the application based on the dataset to detect security attacks.

Claims22

Dependent claims

A computer implemented method comprising:

capturing data streams received at a framework of a web facing application;
capturing a first set of functions triggered by the framework processing the data streams;
matching a subset of the captured first set of functions to data packets of the captured data streams;
extracting the matched subset of the captured first set of functions and data of the data packets into a dataset;
identifying a chain of instructions used in processing the data streams by correlating functions and data packets in the extracted dataset, the chain of instructions being extracted into the dataset to represent vulnerabilities in the web facing application;
and
detecting security attacks by probing activities of the web facing application based on the chain of instructions in the extracted dataset.

4 more elements

A computer system comprising:

at least one hardware processor configured to implement:
a first traffic analyzer configured to capture data streams received at a framework of a web facing application;
a first profiler configured to capture a first set of functions triggered by the framework processing the data streams;
a pattern matching engine configured to:
match a subset of the captured first set of functions to data packets of the captured data streams;
extract the matched subset of the captured first set of functions into a dataset;
and
identify a chain of instructions used in processing the data streams by correlating functions and data packets in the extracted dataset, the chain of instructions being extracted into the dataset to represent vulnerabilities in the web facing application;
and
a probe configured to detect security attacks by probing activities of the web facing application based on the chain of instructions in the extracted dataset.

7 more elements

Dependencies are inferred from the claim text.

Pattern matching based dataset extraction

Life of this patent

Pattern matching based dataset extraction

Life of this patent

Abstract

Claims22