Determining an origin server is potentially compromised

A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause said processor to perform operations comprising:

• receiving, by an edge server, a request for a web page hosted by an origin server;
• transmitting a response to the request, the response including the web page;
• accessing an edge server request log to retrieve a log entry associated with the request for the web page, the log entry associated with the request for the web page including information regarding the request for the web page and the response to the request for the web page;
• retrieving one or more characteristics of an asset of the web page from the log entry associated with the request for the web page, the asset having expected values for each of the one or more characteristics;
• determining that the origin server is compromised when a value for a characteristic of the asset of the web page is not within a threshold range of an expected value for the characteristic of the asset;
• and
• performing a first mitigation action in response to determining that the origin server is compromised.

An apparatus, comprising:

• a processor;
• a non-transitory machine-readable storage medium coupled with the processor that stores instructions that, when executed by the processor, causes said processor to perform the following:
• receive a request for a web page hosted by an origin server;
• transmit a response to the request, the response including the web page;
• access an edge server request log to retrieve a log entry associated with the request for the web page, the log entry associated with the request for the web page including information regarding the request for the web page and the response to the request for the web page;
• retrieve one or more characteristics of an asset of the web page from the log entry associated with the request for the web page, the asset having expected values for each of the one or more characteristics;
• determine that the origin server is compromised when a value for a characteristic of the asset of the web page is not within a threshold range of an expected value for the characteristic of the asset;
• and
• perform a first mitigation action in response to determining that the origin server is compromised.