US 9,853,940 B2Granted

Passive web application firewall

AssigneeMicrosoft Technology Licensing, LLC

InventorsRobert C. Fruth, Viresh Ramdatmisier, Barry Markey, Robert Fish, Erik Tayler, Dragos Boia, Donald Ankney

Life of this patent

Estimating the term…

Loading patent…

Abstract

To protect network-based services, offering computer implemented functionality, from attacks, a passive web application firewall reactively identifies vulnerabilities, enabling such vulnerabilities to be quickly ameliorated, without intercepting communications or introducing other suboptimal aspects of traditional web application firewalls. Communications directed to the network-based services are logged and such logs are scanned for entries evidencing attacks, such as based on predetermined attack syntax. Further evaluation of the entries identified as evidencing attacks identifies a subset of those entries that correspond to likely successful attacks. Such further evaluation includes attacking the network-based service in an equivalent manner. Attacks that are found to be successful identify vulnerabilities, and a notification of such vulnerabilities is provided to facilitate amelioration of such vulnerabilities. Vulnerability amelioration can be automatic, such as by automatically adjusting the settings corresponding to the implementation of the network-based services to ameliorate identified vulnerabilities in a predetermined manner.

Claims20

Dependent claims

A method of protecting delivery of computer-implemented functionality that is offered over a network, the method comprising the steps of:

obtaining logs of prior communications received from the network directed to the computer-implemented functionality to perform operation services;
identifying, from the obtained logs, a first set of log entries as attacks based on each entry, of the first set of entries, matching a pre-determined attack syntax;
in response to the identifying the first set of log entries, testing an actual vulnerability by:
selecting a log entry from the identified first set of log entries;
generating an attack communication directed to the computer-implemented functionality, the generated attack communication being analogous to an attack of the selected log entry;
detecting, from the computer-implemented functionality, either results indicative that the generated attack communication resulted in execution of computer-executable instructions inserted by the generated attack communication or results indicative that one or more parameters defining operation of the computer-implemented functionality were either set improperly or incorrectly, thereby allowing the generated attack to succeed, or are now set improperly or incorrectly due to the generated attack;
and
flagging the selected entry only if the results were indicative that the generated attack communication resulted in the successful attack;
repeating the testing the actual vulnerability for other entries from the set of entries;
and
generating notification of only the second set of entries, which is a subset of the identified first set of log entries.

8 more elements

A computing device comprising:

one or more hardware processing units;
and
computer-readable media comprising computer-executable instructions, which, when executed by the one or more processing units, cause the computing device to:
obtain logs of prior communications received from the network directed to the computer-implemented functionality to perform operation services;
identify, from the obtained logs, a first set of log entries as attacks based on each entry, of the first set of entries, matching a pre-determined attack syntax;
in response to the identifying the first set of loci entries, testing an actual vulnerability by:
selecting a log entry from the identified first set of log entries;
generating an attack communication directed to the computer-implemented functionality, the generated attack communication being analogous to an attack of the selected log entry;
detecting, from the computer-implemented functionality, either results indicative that the generated attack communication resulted in execution of computer-executable instructions inserted by the generated attack communication or results indicative that one or more parameters defining operation of the computer-implemented functionality were either set improperly or incorrectly, thereby allowing the generated attack to succeed, or are now set improperly or incorrectly due to the generated attack;
and
flagging the selected entry only if the results were indicative that the generated attack communication resulted in the successful attack;
repeat the testing the actual vulnerability for other entries from the set of entries;
and
generate notification of only the second set of entries, which is a subset of the identified first set of log entries.

11 more elements

A system for protecting delivery of computer-implemented functionality that is offered over a network comprising:

a first set of computing devices performing steps comprising:
obtaining logs of prior communications received from the network directed to the computer-implemented functionality to perform operating services;
identifying, from the obtained logs, a first set of log entries as attacks based on each entry, of the first set of entries, matching a pre-determined attack syntax;
and
a second set of computing devices performing steps comprising:
in response to the identifying the first set of log entries, testing an actual vulnerability by:
selecting a log entry from the identified first set of log entries;
generating an attack communication directed to the computer-implemented functionality, the generated attack communication being analogous to an attack of the selected log entry;
detecting, from the computer-implemented functionality, either results indicative that the generated attack communication resulted in execution of computer-executable instructions inserted by the generated attack communication or results indicative that one or more parameters defining operation of the computer-implemented functionality were either set improperly or incorrectly, thereby allowing the generated attack to succeed, or are now set improperly or incorrectly due to the generated attack;
and
flagging the selected entry only if the results were indicative that the generated attack communication resulted in the successful attack;
repeating the testing the actual vulnerability for other entries from the set of entries;
and
generating notification of only the second set of entries, which is a subset of the identified first set of log entries.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/864,858Filed 24 Sep 2015
Published: US 2017/0093795 A130 Mar 2017
Granted: 26 Dec 2017
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/02
Network architectures or network communication protocols for network security: for separating internal from external traffic, e.g. firewalls
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
H04L 63/1441
For detecting or protecting against malicious traffic: countermeasures against malicious traffic