# US 12,003,526 B2 · Systems and methods for graphical visualization of web application vulnerabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,526 B2 - Document ID: US12003526B2 - Status: Granted - Kind: B2 - Application number: 17/745,476 - Filed: 2022-05-16 - Published: 2022-09-01 - Granted: 2024-06-04 - Earliest claimed: 2020-09-28 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Kasirao Velugu; Priya Bagaria; Thirumoorthi Thangamani; Ganesh Kathiresan - Web page: https://patentgrep.com/patent/US12003526B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 63/0263: {Rule management} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to extract, from a website vulnerability scanner log, a uniform resource locator (URL) and a vulnerability score and vulnerability classification associated with the URL. The at least one processor is further configured to generate an application vulnerability graph comprising connected nodes that are associated with a field of the URL. The nodes are labeled to indicate the associated field of the URL and color coded based on the vulnerability score. The nodes are also associated with the vulnerability classification. The at least one processor is further configured to enable or disable security protection against a user-selected vulnerability classification of a user-selected node by generating web application firewall security rules and/or web application firewall relaxation rules. ## Claims ### Claim 1 A computer system comprising: a memory; and at least one processor coupled to the memory and configured to: extract, from a website vulnerability scanner log file, a uniform resource locator (URL), a vulnerability score associated with the URL, and a vulnerability classification associated with the URL; generate an application vulnerability graph, the graph being a tree graph comprising a root node, intermediate nodes, and leaf nodes connected by edges, the root node associated with a hostname of the URL and each of the intermediate nodes and leaf nodes associated with a field of the URL, wherein the nodes are labeled to indicate the associated field of the URL, the nodes are color coded based on the vulnerability score, the nodes are user selectable, and the nodes are associated with the vulnerability classification; and generate a web application firewall relaxation rule for application to at least one of the nodes that is user-selected, the web application firewall relaxation rule configured to disable protection against a vulnerability associated with the at least one of the nodes that is user-selected. ### Claim 2 (depends on 1) The computer system of claim 1, wherein the vulnerability classification comprises one or more of a Structured Query Language injection vulnerability, a Cross-site Scripting injection vulnerability, a credit card leak vulnerability, and a path traversal vulnerability. ### Claim 3 (depends on 1) The computer system of claim 1, wherein the at least one processor is further configured to filter nodes of the application vulnerability graph based on a match between a user-selected vulnerability classification and the vulnerability classification associated with the nodes. ### Claim 4 (depends on 3) The computer system of claim 3, wherein the at least one processor is further configured to enable or disable security protection against the user-selected vulnerability classification of the nodes. ### Claim 5 (depends on 1) The computer system of claim 1, wherein the web application firewall relaxation rules are generated as regular expressions based on the URL. ### Claim 6 (depends on 1) The computer system of claim 1, wherein the at least one processor is further configured to: generate a first application vulnerability graph based on a first website vulnerability scanner log file provided at a first time; generate a second application vulnerability graph based on a second website vulnerability scanner log file provided at a second time; and render a visualization of differences between the first application vulnerability graph and the second application vulnerability graph. ### Claim 7 A method for graphical visualization of web application vulnerabilities comprising: extracting, by a computer system, from a website vulnerability scanner log file, a uniform resource locator (URL), a vulnerability score associated with the URL, and a vulnerability classification associated with the URL; generating, by the computer system, an application vulnerability graph, the graph being a tree graph comprising a root node, intermediate nodes, and leaf nodes connected by edges, the root node associated with a hostname of the URL and each of the intermediate nodes and leaf nodes associated with a field of the URL, wherein the nodes are labeled to indicate the associated field of the URL, the nodes are color coded based on the vulnerability score, the nodes are user selectable, and the nodes are associated with the vulnerability classification; and generating, by the computer system, a web application firewall relaxation rule for application to at least one of the nodes that is user-selected, the web application firewall relaxation rule configured to disable protection against a vulnerability associated with the at least one of the nodes that is user-selected. ### Claim 8 (depends on 7) The method of claim 7, wherein the vulnerability classification comprises one or more of a Structured Query Language injection vulnerability, a Cross-site Scripting injection vulnerability, a credit card leak vulnerability, and a path traversal vulnerability. ### Claim 9 (depends on 7) The method of claim 7, further comprising filtering nodes of the application vulnerability graph based on a match between a user-selected vulnerability classification and the vulnerability classification associated with the nodes. ### Claim 10 (depends on 9) The method of claim 9, further comprising enabling or disabling security protection against the user-selected vulnerability classification of a user-selected node. ### Claim 11 (depends on 7) The method of claim 7, wherein the web application firewall relaxation rules are generated as regular expressions based on the URL. ### Claim 12 (depends on 7) The method of claim 7, further comprising: generating a first application vulnerability graph based on a first website vulnerability scanner log file provided at a first time; generating a second application vulnerability graph based on a second website vulnerability scanner log file provided at a second time; and rendering a visualization of differences between the first application vulnerability graph and the second application vulnerability graph. ### Claim 13 A non-transitory computer readable medium storing executable sequences of instructions to provide graphical visualization of web application vulnerabilities, the sequences of instructions comprising instructions to: extract, from a website vulnerability scanner log file, a uniform resource locator (URL), a vulnerability score associated with the URL, and a vulnerability classification associated with the URL; generate an application vulnerability graph, the graph being a tree graph comprising a root node, intermediate nodes, and leaf nodes connected by edges, the root node associated with a hostname of the URL and each of the intermediate nodes and leaf nodes associated with a field of the URL, wherein the nodes are labeled to indicate the associated field of the URL, the nodes are color coded based on the vulnerability score, the nodes are user selectable, and the nodes are associated with the vulnerability classification; and generate a web application firewall relaxation rule for application to at least one of the nodes that is user-selected, the web application firewall relaxation rule configured to disable protection against a vulnerability associated with the at least one of the nodes that is user-selected. ### Claim 14 (depends on 13) The computer readable medium of claim 13, wherein the vulnerability classification comprises one or more of a Structured Query Language injection vulnerability, a Cross-site Scripting injection vulnerability, a credit card leak vulnerability, and a path traversal vulnerability. ### Claim 15 (depends on 13) The computer readable medium of claim 13, wherein the sequences of instructions further include instructions to filter nodes of the application vulnerability graph based on a match between a user-selected vulnerability classification and the vulnerability classification associated with the nodes. ### Claim 16 (depends on 15) The computer readable medium of claim 15, wherein the sequences of instructions further include instructions to enable or disable security protection against the user-selected vulnerability classification of a user-selected node. ### Claim 17 (depends on 13) The computer readable medium of claim 13, wherein the web application firewall relaxation rules are generated as regular expressions based on the URL. ### Claim 18 (depends on 13) The computer readable medium of claim 13, wherein the sequences of instructions further include instructions to: generate a first application vulnerability graph based on a first website vulnerability scanner log file provided at a first time; generate a second application vulnerability graph based on a second website vulnerability scanner log file provided at a second time; and render a visualization of differences between the first application vulnerability graph and the second application vulnerability graph.