Complex application attack quantification, testing, detection and prevention
An apparatus and method for cyber risk quantification calculated from the likelihood of a cyber-attack on the target enterprise and/or cyber ecosystem based on its security posture. The cyber-attack likelihood can be derived as a probability-based time-to-event (TTE) measure using survivor function analysis. The likelihood probability measure can also be passed to cyber risk frameworks to determine financial impacts of the cyber-attacks. Embodiments of the present invention also relate to an apparatus and method (1) to identify and validate application attack surfaces and protect web applications against business logic-based attacks, sensitive data leakage and privilege escalation attacks; and/or (2) that protects web applications against business logic-based attacks, sensitive data leakage and privilege escalation attacks. This can include implementing an intelligent learning loop using artificial intelligence that creates an ontology-based knowledge base from application request and response sequences. Stochastic probabilistic measures are preferably applied to a knowledge base for predicting malicious user actions in real time.
1. A method for providing intelligent web application security based on enhancing an application knowledge base in real time to create a comprehensive application attack surface, the method comprising:
capturing, by an intelligent interceptor module, synchronous and asynchronous HTTP requests and response sequences within a target application resulting from user actions in real time;
passing, by the intelligent interceptor module, the synchronous and asynchronous HTTP requests and response sequences to a data processing module, wherein:
the synchronous HTTP requests and response sequences comprise traditional GET and POST HTTP requests between a client and a server,
each response from the server entirely replaces a currently displayed web page that belongs to the target application on a client side, and
the asynchronous HTTP requests and responses comprise HTTP request, response sequences using technologies that modify a Document Object Model state of a target web page that belongs to the target application without having to reload the target web page completely;
creating, by the data processing module, a structured content hierarchy from captured unstructured HTTP(S) data;
passing, by the data processing module, the structured content hierarchy to a knowledge module;
creating, by the knowledge module, a concept hierarchy from the structured content hierarchy;
further generating, by the knowledge module, a target application ontology from the concept hierarchy;
storing, by the knowledge module, the target application ontology in a knowledge base; and
creating, by an intelligent scanner, offensive ontology-based payloads while testing the target application for complex web application attacks.
2. The method of claim 1 , wherein the target application ontology represents an end user behavioral model.
3. The method of claim 1 , wherein the target application ontology is stored as a graph.
4. The method of claim 1 , wherein the offensive ontology is created using the target application ontology.
5. The method of claim 1 , wherein the offensive ontology-based payloads represent an adversary behavioral model.
6. The method of claim 1 , wherein the knowledge base is a machine understandable knowledge base.
7. The method of claim 6 , wherein the offensive ontology is created using the target application ontology.
8. The method of claim 7 , wherein the offensive ontology represents an adversary behavioral model.
9. The method of claim 1 , wherein the intelligent interceptor implements a memory-aware browser-based sensor to capture events resulting from asynchronous communication created from user actions on the target application in real time.
10. The method of claim 9 , wherein:
the memory-aware browser-based sensor creates a stack trace of events from the asynchronous communications occurring over HTTP(s) in the target application, and
the stack trace of the events enables capture of:
the document object module state changes,
related event chains, and
corresponding parameter values resulting from user actions.
11. The method of claim 10 , wherein the memory-aware sensor stores the stack trace in a repeatable audit log format using a graph-based data structure.
12. The method of claim 1 , wherein the intelligent interceptor includes a synchronization module that creates a transaction unit.
13. The method of claim 12 , wherein the transaction unit linearly interleaves events resulting from user actions on the target application captured from synchronous and asynchronous communication.
14. The method of claim 12 , wherein a union of the transaction units is represented as a content hierarchy of the target application.
15. The method of claim 1 , wherein the the target application ontology is represented as predicate logic statements.
16. The method of claim 15 , wherein:
the knowledge base is a graph-based knowledge base; and
the graph-based knowledge base acts as a behavioral model of the target application.
17. The method of claim 16 , wherein the behavioral model is categorized by an end user privilege access level.
18. The method of claim 17 , further comprising creating, by the knowledge module, an adversarial behavior model based on an offensive ontology from the application behavioral model.
19. The method of claim 1 , wherein the offensive ontology payloads are based on subject-matter expert input accepted as part of a scan initiation performed by the intelligent scanner.
20. The method of claim 19 , wherein the offensive ontology payloads are derived from rules specified by the one or more subject-matter experts that represent complex attacks for the target application.
21. The method of claim 20 , wherein the rules are translated to predicate-based ontology representation.
22. The method of claim 20 , wherein the ontology representation from the rules is validated against the target application ontology for completeness.
23. The method of claim 20 , wherein the validated ontology is converted to an HTTP request and response sequence executed against the target application as part of a target application security scan.
24. The method of claim 20 , wherein the offensive ontology payloads are feedback to the knowledge base.
25. The method of claim 1 , wherein as part of a scan evaluation, the intelligent scanner evaluates target application behavior against offensive ontology-based HTTP requests.
26. The method of claim 25 , wherein the intelligent scanner enhances parameters of offensive ontology-based HTTP(S) requests upon partial identification of intended behavior.
27. The method of claim 25 , wherein upon successful execution of an offensive ontology payload-based HTTP(S) request, the corresponding payload ontology is updated into the knowledge base.
28. The method of claim 25 , wherein an impact of severity of the offensive ontology-based payload is presented.