# US 2018/0322284 A1 · Methods for preventing computer attacks in two-phase filtering and apparatuses using the same > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0322284 A1 - Document ID: US20180322284A1 - Status: Published application - Kind: A1 - Application number: 15/770,749 - Filed: 2015-10-29 - Published: 2018-11-08 - Earliest claimed: 2015-10-29 - Assignees: Cloudcoffer LLC - Applicants: Cloudcoffer LLC - Inventors: Kuo CHIANG - Web page: https://patentgrep.com/patent/US20180322284A1 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/563: Data redirection of data network streams - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The invention introduces a method for preventing computer attacks in two-phase filtering, performed by a processing unit of an apparatus, which contains at least the following steps. A service request is received from a client system, which requests a service to a protected computer-asset. The phase one filtering is performed to forward the service request to the protected computer-asset when a white-list pattern is discovered from the service request. The phase two filtering is performed subsequent to a completion of the phase one filtering. ## Claims ### Claim 1 A method for preventing computer attacks in two-phase filtering, performed by a processing unit of an apparatus, comprising: receiving a service request from a client system, wherein the service request requests a service to a protected computer-asset; performing a phase one filtering to forward the service request to the protected computer-asset when discovering a white-list pattern from the service request; and performing a phase two filtering subsequent to a completion of the phase one filtering. ### Claim 2 (depends on 1) The method of claim 1, wherein the step for performing a phase one filtering further comprises: providing a plurality of black-list patterns; and performing an attack prevention operation when discovering that the service request comprises no white-list pattern but at least one black-list pattern. ### Claim 3 (depends on 1) The method of claim 1, wherein the step for performing a phase one filtering further comprises: providing a plurality of custom-rule patterns; and performing an attack prevention operation when discovering that the service request comprises no white-list pattern but at least one custom-rule pattern. ### Claim 4 (depends on 3) The method of claim 3, wherein the custom-rule patterns are provided for at least one type of protected computer assets. ### Claim 5 (depends on 3) The method of claim 3, wherein the step for performing a phase two filtering further comprises: providing a plurality of base-rule patterns; and performing the attack prevention operation when discovering that the service request comprises at least one base-rule pattern. ### Claim 6 (depends on 5) The method of claim 5, wherein the base-rule patterns cover more types of protected computer-assets than the custom-rule patterns. ### Claim 7 (depends on 5) The method of claim 5, wherein the custom-rule patterns are specifically designed for an individual system or vulnerability and the base-rule patterns are designed to prevent common attacks. ### Claim 8 (depends on 1) The method of claim 1, wherein the service request comprises a layer 7 message. ### Claim 9 (depends on 1) The method of claim 1, wherein the service request is carried by a plurality of TCP/IP (Transmission Control Protocol/Internet Protocol) packets, the method comprising: caching the TCP/IP packets; and forwarding the cached TCP/IP packets to the protected computer-asset when discovering that a white-list pattern is included in the service request. ### Claim 10 (depends on 5) The method of claim 5, wherein the attack prevention operation is performed to replace special characters to prevent strings from switching into any execution context, and forward the modified service request to the protected computer-asset. ### Claim 11 (depends on 5) The method of claim 5, wherein the attack prevention operation is performed to drop the service request, without forwarding the service request to the protected computer-asset. ### Claim 12 (depends on 5) The method of claim 5, wherein the attack prevention operation is performed to block the service request from being forwarded to the protected computer-asset and respond with a message to the client system. ### Claim 13 (depends on 5) The method of claim 5, wherein the attack prevention operation is performed to forward the service request to the protected computer-asset and record a log describing a detection time with the discovered custom-rule pattern or the discovered base-rule pattern. ### Claim 14 (depends on 5) The method of claim 5, wherein the attack prevention operation is performed to respond to the client system with an url (uniform resource locator) linking to a warning web page. ### Claim 15 (depends on 5) The method of claim 5, wherein the attack prevention operation is performed to forward the service request to a destination site of a sandbox. ### Claim 16 (depends on 1) The method of claim 1, wherein the step for performing a phase one filtering further comprises: providing a plurality of base-rule patterns; and performing an attack prevention operation when discovering that the service request comprises no white-list pattern but at least one base-rule pattern. ### Claim 17 (depends on 16) The method of claim 16, wherein the step for performing a phase two filtering further comprises: providing a plurality of custom-rule patterns; and performing the attack prevention operation when discovering that the service request comprises at least one custom-rule pattern. ### Claim 18 (depends on 17) The method of claim 17, wherein the custom-rule patterns are specifically designed for an individual system or vulnerability and the base-rule patterns are designed to prevent common attacks. ### Claim 19 An apparatus for preventing computer attacks in two-phase filtering, comprising: a storage device, storing a plurality of white-list patterns; and a processing unit, configured to receive a service request from a client system, wherein the service request requests a service to a protected computer-asset; perform a phase one filtering to forward the service request to the protected computer-asset when discovering a white-list pattern from the service request; and perform a phase two filtering subsequent to a completion of the phase one filtering. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the storage device stores a plurality of black-list patterns, and the processing unit, during the phase one filtering, performs an attack prevention operation when discovering that the service request comprises no white-list pattern but at least one black-list pattern. ### Claim 21 (depends on 19) The apparatus of claim 19, wherein the storage device stores a plurality of custom-rule patterns, and the processing unit, during the phase one filtering, performs an attack prevention operation when discovering that the service request comprises no white-list pattern but at least one custom-rule pattern. ### Claim 22 (depends on 21) The apparatus of claim 21, wherein the custom-rule patterns are provided for at least one type of protected computer assets. ### Claim 23 (depends on 21) The apparatus of claim 21, wherein the storage device stores a plurality of base-rule patterns, and the processing unit, during the phase two filtering, performs the attack prevention operation when discovering that the service request comprises at least one base-rule pattern. ### Claim 24 (depends on 23) The apparatus of claim 23, wherein the base-rule patterns cover more types of protected computer-assets than the custom-rule patterns. ### Claim 25 (depends on 24) The apparatus of claim 24, wherein the custom-rule patterns are specifically designed for an individual system or vulnerability and the base-rule patterns are designed to prevent common attacks. ### Claim 26 (depends on 19) The apparatus of claim 19, wherein the service request comprises a layer 7 message. ### Claim 27 (depends on 19) The apparatus of claim 19, further comprising: a memory caching the TCP/IP (Transmission Control Protocol/Internet Protocol) packets, wherein the service request is carried by a plurality of TCP/IP packets, and the processing unit forwards the cached TCP/IP packets to the protected computer-asset when discovering that a white-list pattern is included in the service request. ### Claim 28 (depends on 23) The apparatus of claim 23, wherein the attack prevention operation is performed to replace special characters to prevent strings from switching into any execution context, and forward the modified service request to the protected computer-asset. ### Claim 29 (depends on 23) The apparatus of claim 23, wherein the attack prevention operation is performed to drop the service request, without forwarding the service request to the protected computer-asset. ### Claim 30 (depends on 23) The apparatus of claim 23, wherein the attack prevention operation is performed to block the service request from being forwarded to the protected computer-asset and respond with a message to the client system. ### Claim 31 (depends on 23) The apparatus of claim 23, wherein the attack prevention operation is performed to forward the service request to the protected computer-asset and record a log describing a detection time with the discovered custom-rule pattern or the discovered base-rule pattern. ### Claim 32 (depends on 23) The apparatus of claim 23, wherein the attack prevention operation is performed to respond to the client system with an url (uniform resource locator) linking to a warning web page. ### Claim 33 (depends on 23) The apparatus of claim 23, wherein the attack prevention operation is performed to forward the service request to a destination site of a sandbox. ### Claim 34 (depends on 19) The apparatus of claim 19, wherein the storage device stores a plurality of base-rule patterns, and the processing unit, during the phase one filtering, performs an attack prevention operation when discovering that the service request comprises no white-list pattern but at least one base-rule pattern. ### Claim 35 (depends on 34) The apparatus of claim 34, wherein the storage device stores a plurality of custom-rule patterns, and the processing unit, during the phase two filtering, performs the attack prevention operation when discovering that the service request comprises at least one custom-rule pattern. ### Claim 36 (depends on 35) The apparatus of claim 35, wherein the custom-rule pattern are specifically designed for an individual system or vulnerability and the base-rule patterns are designed to prevent common attacks.