Complex application attack quantification, testing, detection and prevention
An apparatus and method for cyber risk quantification calculated from the likelihood of a cyber-attack on the target enterprise and/or cyber ecosystem based on its security posture. The cyber-attack likelihood can be derived as a probability-based time-to-event (TTE) measure using survivor function analysis. The likelihood probability measure can also be passed to cyber risk frameworks to determine financial impacts of the cyber-attacks. Embodiments of the present invention also relate to an apparatus and method {1) to identify and validate application attack surfaces and protect web applications against business logic-based attacks, sensitive data leakage and privilege escalation attacks; and/or {2) that protects web applications against business logic-based attacks, sensitive data leakage and privilege escalation attacks. This can include implementing an intelligent learning loop using artificial intelligence that creates an ontology-based knowledge base from application request and response sequences. Stochastic probabilistic measures are preferably applied to a knowledge base for predicting malicious user actions in real time.
1. A method for providing intelligent web application security, the method comprising:
capturing requests and response sequences within a target application, wherein:
the requests and response sequences include synchronous HTTP request and asynchronous HTTP requests and response sequences;
the requests and response sequences result from user actions in real time;
the synchronous HTTP requests and response sequences include traditional GET and POST HTTP requests between a client and a server;
creating a structured content hierarchy based on captured unstructured HTTP(S) data;
creating a concept hierarchy from the structured content hierarchy, the concept hierarchy representing a “is-a” relationship of content of the target application;
generating an ontology of the target application from the concept hierarchy and storing the ontology in a knowledge base, the ontology being represented using first order predicate logic that represents domain knowledge of the target application;
creating a master Markov logic network (MLN) and a dynamic MLN based on the captured synchronous and asynchronous HTTP requests of the knowledge base; and
predicting an attack on the target application using the master MLN and the dynamic MLN, wherein the predicting an attack on the target application is based on determining a relative entropy of the master MLN and dynamic MLN to detect deviations in user behavior and infer potential attacks in progress.
2. The method of claim 1 , wherein:
the first order predicate logic includes multiple predicate logic formulae; and
the creating the master MLN includes:
assigning weights to the predicate logic formulae in the knowledge base; and
deriving grounded representations of the predicate logic formulae in which variables in the predicate logic formulae are replaced by constants.
3. The method of claim 2 , wherein:
the predicate logic formulae includes a first predicate logic formula;
the first predicate logic formula corresponds to a first event;
a first event includes a source state and a destination state; and
a first weight of the weights assigned to the first predicate logic formula is based on a first constant associated with the first event, a reward assigned to the first event based at least partially on the first constant, and a probability of a number of transitions between the source state to the destination state to a number of transitions from the source state to any destination state.
4. The method of claim 3 , wherein:
the structured content hierarchy captures and represents the user actions in a graphical structure that represents source and destination states associated with each event of the user actions; and
the weights are assigned to each of the predicate logic formulae based on a position of a corresponding logical event in the structured content hierarchy.
5. The method of claim 4 , wherein:
the capturing the requests and response sequences partially occurs during a training mode in which logical events are generated from navigation behavior of the target application; and
the master MLN is based on the logical events generated during the training mode.
6. The method of claim 5 , wherein:
the capturing the requests and response sequences occurs during a live mode in which additional logical events are derived from the knowledge base; and
the dynamic MLN is based on the additional logical events derived during the live mode.
7. The method of claim 6 , wherein the logical events and the additional logical events are mapped to the first order predicate logic of the ontology.
8. The method of claim 7 , wherein:
event attributes are associated with the logical events and the additional logical events; and
the event attributes include constants associated with a user level of a user performing the user actions, user identification of a user performing the user actions, or an event name.
9. The method of claim 8 , wherein the event attributes are combined with the logical events and the additional logical events to deduce the grounded representations of the predicate logic formulae.
10. The method of claim 1 , further comprising performing stochastic probabilistic analysis of the dynamic MLN to detect user behavior anomalies in real time.
11. A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations for providing intelligent web application security, the operations comprising:
capturing requests and response sequences within a target application, wherein:
the requests and response sequences include synchronous HTTP request and asynchronous HTTP requests and response sequences;
the requests and response sequences result from user actions in real time;
the synchronous HTTP requests and response sequences include traditional GET and POST HTTP requests between a client and a server;
creating a structured content hierarchy based on captured unstructured HTTP(S) data;
creating a concept hierarchy from the structured content hierarchy, the concept hierarchy representing a “is-a” relationship of content of the target application;
generating an ontology of the target application from the concept hierarchy and storing the ontology in a knowledge base, the ontology being represented using first order predicate logic that represents domain knowledge of the target application;
creating a master Markov logic network (MLN) and a dynamic MLN based on the captured synchronous and asynchronous HTTP requests of the knowledge base; and
predicting an attack on the target application using the master MLN and the dynamic MLN, wherein the predicting an attack on the target application is based on determining a relative entropy of the master MLN and dynamic MLN to detect deviations in user behavior and infer potential attacks in progress.
12. The non-transitory computer-readable medium of claim 11 , wherein:
the first order predicate logic includes multiple predicate logic formulae; and
the creating the master MLN includes:
assigning weights to the predicate logic formulae in the knowledge base; and
deriving grounded representations of the predicate logic formulae in which variables in the predicate logic formulae are replaced by constants.
13. The non-transitory computer-readable medium of claim 12 , wherein:
the predicate logic formulae includes a first predicate logic formula;
the first predicate logic formula corresponds to a first event;
a first event includes a source state and a destination state; and
a first weight of the weights assigned to the first predicate logic formula is based on a first constant associated with the first event, a reward assigned to the first event based at least partially on the first constant, and a probability of a number of transitions between the source state to the destination state to a number of transitions from the source state to any destination state.
14. The non-transitory computer-readable medium of claim 13 , wherein:
the structured content hierarchy captures and represents the user actions in a graphical structure that represents source and destination states associated with each event of the user actions; and
the weights are assigned to each of the predicate logic formulae based on a position of a corresponding logical event in the structured content hierarchy.
15. The non-transitory computer-readable medium of claim 14 , wherein:
the capturing the requests and response sequences partially occurs during a training mode in which logical events are generated from navigation behavior of the target application; and
the master MLN is based on the logical events generated during the training mode.
16. The non-transitory computer-readable medium of claim 15 , wherein:
the capturing the requests and response sequences occurs during a live mode in which additional logical events are derived from the knowledge base; and
the dynamic MLN is based on the additional logical events derived during the live mode.
17. The non-transitory computer-readable medium of claim 16 , wherein the logical events and the additional logical events are mapped to the first order predicate logic of the ontology.
18. The non-transitory computer-readable medium of claim 17 , wherein:
event attributes are associated with the logical events and the additional logical events; and
the event attributes include constants associated with a user level of a user performing the user actions, user identification of a user performing the user actions, or an event name.
19. The non-transitory computer-readable medium of claim 18 , wherein the event attributes are combined with the logical events and the additional logical events to deduce the grounded representations of the predicate logic formulae.
20. The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise performing stochastic probabilistic analysis of the dynamic MLN to detect user behavior anomalies in real time.