Protecting against and learning attack vectors on web artifacts

A method for protecting against attacks to web files hosted on a web server comprising:

• performing a plurality of monitoring tasks by a service processor, the service processor being hosted by a baseboard management controller (BMC) and independent of a central processing unit (CPU) of the web server, the plurality of monitoring tasks comprising:
• receiving a plurality of packets forming access requests made to the web files;
• determining that a packet is suspicious when a source Internet Protocol (IP) address associated with the packet is not on a whitelist or a blacklist;
• updating a learning block with information about each suspicious packet, the information comprising a signature associated with the suspicious packet, a source IP address associated with the suspicious packet, and a time indicating when the suspicious packet arrived;
• updating a counter indicating a number of times a packet with the signature of the suspicious packet was received;
• forwarding the suspicious packet to the web server when the counter is below a threshold;
• not forwarding the suspicious packet to the web server when the counter is above the threshold;
• and
• upon not forwarding the suspicious packet, analyzing the suspicious packet in conjunction with other packets previously determined to be suspicious, the analyzing comprising:
• rearranging an order in which the suspicious packet and the other suspicious packets arrived to form a new arrival sequence of the suspicious packets;
• matching the new arrival sequence of the suspicious packets to attack patterns stored in an attack pattern database;
• and
• upon the new arrival sequence of the suspicious packets matching an attack pattern, adding source IP addresses associated with the suspicious packets matching the attack pattern to the blacklist.

A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors to implement a method comprising:

• performing a plurality of monitoring tasks by a service processor, the service processor being hosted by a baseboard management controller (BMC) and independent of a central processing unit (CPU) of the web server, the plurality of monitoring tasks comprising:
• receiving a plurality of packets forming access requests made to the web files;
• determining that a packet is suspicious when a source Internet Protocol (IP) address associated with the packet is not on a whitelist or a blacklist;
• updating a learning block with information about each suspicious packet, the information comprising a signature associated with the suspicious packet, a source IP address associated with the suspicious packet, and a time indicating when the suspicious packet arrived;
• updating a counter indicating a number of times a packet with the signature of the suspicious packet was received;
• forwarding the suspicious packet to the web server when the counter is below a threshold;
• not forwarding the suspicious packet to the web server when the counter is above the threshold;
• and
• upon not forwarding the suspicious packet, analyzing the suspicious packet in conjunction with other packets previously determined to be suspicious, the analyzing comprising:
• rearranging an order in which the suspicious packet and the other suspicious packets arrived to form a new arrival sequence of the suspicious packets;
• matching the new arrival sequence of the suspicious packets to attack patterns stored in an attack pattern database;
• and
• upon the new arrival sequence of the suspicious packets matching an attack pattern, adding source IP addresses associated with the suspicious packets matching the attack pattern to the blacklist.