Complex application attack quantification, testing, detection and prevention

A method for providing intelligent web application security based on enhancing an application knowledge base in real time to create a comprehensive application attack surface, the method comprising:

• capturing, by an intelligent interceptor module, synchronous and asynchronous HTTP requests and response sequences within a target application resulting from user actions in real time;
• passing, by the intelligent interceptor module, the synchronous and asynchronous HTTP requests and response sequences to a data processing module, wherein:
• the synchronous HTTP requests and response sequences comprise traditional GET and POST HTTP requests between a client and a server,
• each response from the server entirely replaces a currently displayed web page that belongs to the target application on a client side, and
• the asynchronous HTTP requests and responses comprise HTTP request, response sequences using technologies that modify a Document Object Model state of a target web page that belongs to the target application without having to reload the target web page completely;
• creating, by the data processing module, a structured content hierarchy from captured unstructured HTTP(S) data;
• passing, by the data processing module, the structured content hierarchy to a knowledge module;
• creating, by the knowledge module, a concept hierarchy from the structured content hierarchy;
• further generating, by the knowledge module, a target application ontology from the concept hierarchy;
• storing, by the knowledge module, the target application ontology in a knowledge base;
• and
• creating, by an intelligent scanner, offensive ontology-based payloads while testing the target application for complex web application attacks.