Back to results
US 11,936,685 B2Granted
Systems and methods for blocking novel attack vectors
AssigneeCloud Linux Software Inc.
InventorsIgor Seletskiy, Marat Sataiev
Life of this patent
Estimating the term…
Abstract
Disclosed herein are systems and method for blocking novel attack vectors. In one aspect, a detected security incident and a consequential event are correlated such that the combination of the security incident and the consequential event are identified as an attack vector. A method may comprise generating and executing a rule that blocks the consequential event in response to detecting the security incident.
Claims20
A method for blocking an attack vector, the method comprising:
- detecting a security incident associated with a potential attack vector on a web server, wherein the potential attack vector is a path taken by a malicious entity to gain access to the web server;
- recording, in a database, a first report comprising a timestamp of the security incident and an identifier of the security incident;
- detecting a consequential event comprising one of:
- an unauthorized change in a database on the web server, a malware upload, or a subsequent security incident related to an attack vector;
- recording, in the database, a second report comprising a timestamp associated with the consequential event and an identifier of the consequential event;
- in response to determining that the first report and the second report have a common identifier and timestamps:
- identifying a combination of the security incident and the consequential event as an attack vector;
- generating a first rule that blocks the consequential event in response to detecting the security incident;
- and
- blocking, based on the first rule, any consequential events in response to detecting the security event on the web server that involve the identifier of the security incident.
7 more elements
A system for blocking an attack vector, the system comprising:
- a hardware processor configured to:
- detect a security incident associated with a potential attack vector on a web server, wherein the potential attack vector is a path taken by a malicious entity to gain access to the web server;
- record, in a database, a first report comprising a timestamp of the security incident and an identifier of the security incident;
- detect a consequential event comprising one of:
- an unauthorized change in a database on the web server, a malware upload, or a subsequent security incident related to an attack vector;
- record, in the database, a second report comprising a timestamp associated with the consequential event and an identifier of the consequential event;
- in response to determining that the first report and the second report have a common identifier and timestamps:
- identify a combination of the security incident and the consequential event as an attack vector;
- generate a first rule that blocks the consequential event in response to detecting the security incident;
- and
- block, based on the first rule, any consequential events in response to detecting the security event on the web server that involve the identifier of the security incident.
8 more elements
A non-transitory computer readable medium storing thereon computer executable instructions for blocking an attack vector, including instructions for:
- detecting a security incident associated with a potential attack vector on a web server, wherein the potential attack vector is a path taken by a malicious entity to gain access to the web server;
- recording, in a database, a first report comprising a timestamp of the security incident and an identifier of the security incident;
- detecting a consequential event comprising one of:
- an unauthorized change in a database on the web server, a malware upload, or a subsequent security incident related to an attack vector;
- recording, in the database, a second report comprising a timestamp associated with the consequential event and an identifier of the consequential event;
- in response to determining that the first report and the second report have a common identifier and timestamps:
- identifying a combination of the security incident and the consequential event as an attack vector;
- generating a first rule that blocks the consequential event in response to detecting the security incident;
- and
- blocking, based on the first rule, any consequential events in response to detecting the security event on the web server that involve the identifier of the security incident.
7 more elements
Dependencies are inferred from the claim text.