US 9,479,526 B1 · Dynamic comparative analysis method and apparatus for detecting and preventing code injection and other network attacks

Abstract

A security appliance includes a vulnerable testbed that simulates at least one known vulnerability, and a secure testbed that simulates not having that vulnerability. A testbed monitor monitors run-time behavior of the vulnerable testbed and the secure testbed, obtaining at least one run-time behavior parameter. A comparative evaluator module compares the run-time behavior parameters with respect to the received client request to determine if it is legitimate or illegitimate. The security appliance outputs its determination with a message and/or by forwarding client requests deemed legitimate and dropping client requests deemed illegitimate. The determination can be based, on differences in the run-time behavior parameters. Illegitimate requests can be cached for later matching. The requests can be database data requests, XML formatted requests, operating system requests and/or other types of requests that would be differentially handled by a vulnerable server and a secure server.

Claims32

Dependent claims

A security appliance that is present in a network path between client computers or computing devices and a secured server, the security appliance comprising:

a network interface over which client requests for the secured server can be received;
a vulnerable testbed, wherein the vulnerable testbed is configured to simulate a vulnerable server response to a received client request, simulated to have at least one known vulnerability;
a secure testbed, wherein the secure testbed is configured to simulate a server response to the received client request, simulated to not have the at least one known vulnerability;
a testbed monitor that monitors run-time behavior of the vulnerable testbed and the secure testbed, obtaining at least one run-time behavior parameter;
a comparative evaluator module that compares the at least one run-time behavior parameter for each of the vulnerable testbed and the secure testbed with respect to the received client request;
and
a test output that signals whether the security appliance determines the received client request to be a legitimate request or an illegitimate request, wherein the determination is based, at least in part, on any differences in the run-time behavior parameter for each of the vulnerable testbed and the secure testbed.

4 more elements

Dependencies are inferred from the claim text.

Dynamic comparative analysis method and apparatus for detecting and preventing code injection and other network attacks

Life of this patent

Dynamic comparative analysis method and apparatus for detecting and preventing code injection and other network attacks

Life of this patent

Abstract

Claims32