Scripting attack detection and mitigation using content security policy violation reports

1 . A method for scripting attack detection and mitigation, comprising:

receiving a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to one or more second web applications;

identifying a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations;

determining the first violation is not classified as a scripting attack based on only the first plurality of features;

classifying the first violation and the one or more second violations as the scripting attack based on:

the first plurality of features;

the second pluralities of features; and

determining the first violation is not classified as the scripting attack based on only the first plurality of features; and

based on classifying the first violation and the one or more second violations as the scripting attack, taking action to mitigate the scripting attack on the first web application and the one or more second web applications.

2 . The method of claim 1 , wherein classifying the first violation and the one or more second violations as the scripting attack comprises:

processing, with a model configured to generate a score indicative of a scripting attack, the first plurality of features and thereby generate a first score for the first violation;

processing, with the model, the second pluralities of features and thereby generate one or more second scores for the one or more second violations;

generating a cumulative score based on the first score and one or more second scores;

determining the cumulative score is above a widespread scripting attack threshold; and

classifying the first violation and the one or more second violations as the scripting attack based on the cumulative score being above the widespread scripting attack threshold.

3 . The method of claim 1 , wherein determining the first violation is not classified as the scripting attack based on only the first plurality of features comprises:

processing, with a model configured to generate a score indicative of a scripting attack, only the first plurality of features and thereby generate a first score for the first violation;

determining the first score for the first violation is below an individual scripting attack threshold; and

determining the first violation is not classified as the scripting attack based on the first score for the first violation being below the individual scripting attack threshold.

4 . The method of claim 1 , wherein classifying the first violation and the one or more second violations as the scripting attack based on the first plurality of features and the second pluralities of features comprises at least one of:

determining a common scripting library associated with the first violation and the one or more second violations;

determining a common operating system (OS) where the first violation and the one or more second violations occurred;

determining a common browser where the first violation and the one or more second violations occurred;

determining a common browser version of the common browser where the first violation and the one or more second violations occurred;

determining a common geographical region associated with the first violation and the one or more second violations; or

determining the first web application and the one or more second web applications comprise a same web application type.

5 . The method of claim 1 , further comprising, based on classifying the first violation and the one or more second violations as the scripting attack, taking action to mitigate a potential scripting attack on a third web application.

6 . The method of claim 5 , wherein the third web application comprises at least one of:

an application running a common scripting library as the first web application and the one or more second web applications;

an application running on a same OS as the first web application and the one or more second web applications;

an application running on a same browser as the first web application and the one or more second web applications;

an application running on a same browser version as the first web application and the one or more second web applications;

an application running in a same geographical region as the first web application and the one or more second web applications; or

a same application as the first web application and the one or more second web applications.

7 . The method of claim 1 , wherein:

the first plurality of features comprise features included in the first report;

the second pluralities of features comprise features included in the one or more second reports; and

at least one of the first plurality of features or the second pluralities of features comprise at least one of:

a type of a browser where the first violation or the one or more second violations occurred,

a version of the browser,

an internet protocol (IP) address of the browser,

an operating system (OS) where the first violation or the one or more second violations occurred,

a uniform resource locator (URL) of a resource that was prevented from loading on the browser,

a URL of a document in which the first violation or the one or more second violations occurred,

a scripting code sample analysis,

a user-agent request header, or

an identification of the first security policy or the one or more second security policies.

8 . The method of claim 7 , wherein:

the first plurality of features comprises at least one of the IP address of the browser or the URL of the resource that was prevented from loading on the browser, and

the method further comprises:

determining a domain associated with the IP address of the browser or the URL of the resource; and

determining, for the domain, at least one of:

a reputation score,

a content delivery network (CDN) score,

an Alexa 10k score,

a malicious score,

an alias score,

a registration country,

a registration date, or

registration information, wherein the first plurality of features further comprises at least one of the reputation score, the CDN score, the Alexa 10k score, the malicious score, the alias score, the registration country, the registration date, or the registration information.

9 . The method of claim 8 , further comprising:

determining a subdomain associated with the domain; and

determining a reputation score for the subdomain, wherein the first plurality of features further comprises the reputation score for the subdomain.

10 . The method of claim 7 , wherein:

the second pluralities of features comprise at least one of the IP address of the browser or the URL of the resource that was prevented from loading on the browser, and

the method further comprises:

determining a domain associated with the IP address of the browser or the URL of the resource; and

determining, for the domain, at least one of:

a reputation score,

a CDN score,

an Alexa 10k score,

a malicious score,

an alias score,

a registration country,

a registration date, or

registration information, wherein the first plurality of features further comprises at least one of the reputation score, the CDN score, the Alexa 10k score, the malicious score, the alias score, the registration country, the registration date, or the registration information.

11 . The method of claim 10 , further comprising:

determining a subdomain associated with the domain; and

determining a reputation score for the subdomain, wherein the second pluralities of features further comprise the reputation score for the subdomain.

12 . The method of claim 7 , wherein:

the first plurality of features comprises the IP address of the browser and the URL of the resource that was prevented from loading on the browser, and

the method further comprises:

determining a first domain associated with the URL of the resource;

determining a second domain associated with the URL of the resource by performing a sequence of domain name system (DNS) and reverse DNS lookups; and

determining whether the first domain and the second domain are equal, wherein the first plurality of features further comprises the determination whether the first domain and the second domain are equal.

13 . The method of claim 7 , wherein:

the second pluralities of features comprises the IP address of the browser and the URL of the resource that was prevented from loading on the browser, and

the method further comprises:

determining a first domain associated with the URL of the resource;

determining a second domain associated with the URL of the resource by performing a sequence of DNS and reverse DNS lookups; and

determining whether the first domain and the second domain are equal, wherein the second pluralities of features further comprise the determination whether the first domain and the second domain are equal.

14 . The method of claim 7 , wherein:

the first plurality of features comprises at least one of the IP address of the browser or the URL of the resource that was prevented from loading on the browser, and

the method further comprises:

determining the IP address of the browser; and

determining, for the IP address, at least one of:

a reputation score, or

a malicious score, wherein the first plurality of features further comprises at least one of the reputation score or the malicious score for the IP address.

15 . The method of claim 7 , wherein:

the first plurality of features comprises at least one of the IP address of the browser or the URL of the resource that was prevented from loading on the browser, and

the method further comprises:

determining the IP address of the browser; and

determining, for the IP address, at least one of:

a reputation score, or

a malicious score, wherein the second pluralities of features further comprise at least one of the reputation score or the malicious score for the IP address.

16 . The method of claim 7 , wherein:

the first plurality of features comprises the URL of the resource that was prevented from loading on the browser, and

the method further comprises:

performing a nameserver lookup using the URL of the resource to obtain nameserver records for a domain associated with the URL of the resource; and

determining a reputation score for the nameserver records, wherein the first plurality of features further comprises the reputation score for the nameserver records.

17 . The method of claim 7 , wherein:

the second pluralities of features comprise the URL of the resource that was prevented from loading on the browser, and

the method further comprises:

performing a nameserver lookup using the URL of the resource to obtain nameserver records for a domain associated with the URL of the resource; and

determining a reputation score for the nameserver records, wherein the second pluralities of features further comprise the reputation score for the nameserver records.

18 . A processing system, comprising:

a memory comprising computer-executable instructions; and

a processor configured to execute the computer-executable instructions and cause the processing system to:

receive a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to one or more second web applications;

identify a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations;

determine the first violation is not classified as a scripting attack based on only the first plurality of features;

classify the first violation and the one or more second violations as the scripting attack based on:

the first plurality of features;

the second pluralities of features; and

determining the first violation is not classified as the scripting attack based on only the first plurality of features; and

based on classifying the first violation and the one or more second violations as the scripting attack, take action to mitigate the scripting attack on the first web application and the one or more second web applications.

19 . The processing system of claim 18 , wherein the processor is further configured to cause the processing system to, based on classifying the first violation and the one or more second violations as the scripting attack, take action to mitigate a potential scripting attack on a third web application.

20 . A method for scripting attack detection and mitigation, comprising:

receiving a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to one or more second web applications;

identifying a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations;

classifying the first violation and the one or more second violations as a scripting attack based on the first plurality of features and the second pluralities of features; and

based on classifying the first violation and the one or more second violations as the scripting attack, taking action to mitigate the scripting attack on the first web application and the one or more second web applications,

wherein classifying the first violation and the one or more second violations as the scripting attack based on the first plurality of features and the second pluralities of features comprises at least one of:

determining a common scripting library associated with the first violation and the one or more second violations;

determining a common operating system (OS) where the first violation and the one or more second violations occurred;

determining a common browser where the first violation and the one or more second violations occurred;

determining a common browser version of the common browser where the first violation and the one or more second violations occurred;

determining a common geographical region associated with the first violation and the one or more second violations; or

determining the first web application and the one or more second web applications comprise a same web application type.

21 . A method for scripting attack detection and mitigation, comprising:

receiving a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to one or more second web applications;

identifying a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations;

classifying the first violation and the one or more second violations as a scripting attack based on the first plurality of features and the second pluralities of features; and

based on classifying the first violation and the one or more second violations as the scripting attack:

taking action to mitigate the scripting attack on the first web application and the one or more second web applications; and

taking action to mitigate a potential scripting attack on a third web application, wherein the third web application comprises at least one of:

an application running a common scripting library as the first web application and the one or more second web applications;

an application running on a same OS as the first web application and the one or more second web applications;

an application running on a same browser as the first web application and the one or more second web applications;

an application running on a same browser version as the first web application and the one or more second web applications;

an application running in a same geographical region as the first web application and the one or more second web applications; or

a same application as the first web application and the one or more second web applications.

22 . A method for scripting attack detection and mitigation, comprising:

receiving a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to one or more second web applications;

identifying a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations, wherein:

the first plurality of features comprises features included in the first report,

the first plurality of features comprises an internet protocol (IP) address of a browser and a uniform resource locator (URL) of a resource that was prevented from loading on the browser, and

the second pluralities of features comprise features included in the one or more second reports;

determining a first domain associated with the URL of the resource;

determining a second domain associated with the URL of the resource by performing a sequence of domain name system (DNS) and reverse DNS lookups;

determining whether the first domain and the second domain are equal, wherein the first plurality of features further comprises the determination of whether the first domain and the second domain are equal;

classifying the first violation and the one or more second violations as a scripting attack based on the first plurality of features and the second pluralities of features; and

based on classifying the first violation and the one or more second violations as the scripting attack, taking action to mitigate the scripting attack on the first web application and the one or more second web applications.

23 . A method for scripting attack detection and mitigation, comprising:

receiving a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to one or more second web applications;

identifying a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations, wherein:

the first plurality of features comprises features included in the first report,

the second pluralities of features comprise features included in the one or more second reports, and

the second pluralities of features comprises an internet protocol (IP) address of a browser and a uniform resource locator (URL) of a resource that was prevented from loading on the browser;

determining a first domain associated with the URL of the resource;

determining a second domain associated with the URL of the resource by performing a sequence of DNS and reverse DNS lookups;

determining whether the first domain and the second domain are equal, wherein the second pluralities of features further comprise the determination of whether the first domain and the second domain are equal;

classifying the first violation and the one or more second violations as a scripting attack based on the first plurality of features and the second pluralities of features; and

based on classifying the first violation and the one or more second violations as the scripting attack, taking action to mitigate the scripting attack on the first web application and the one or more second web applications.

24 . A method for scripting attack detection and mitigation, comprising:

receiving a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to one or more second web applications;

identifying a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations, wherein:

the first plurality of features comprises features included in the first report,

the first plurality of features comprises a uniform resource locator (URL) of a resource that was prevented from loading on a browser, and

the second pluralities of features comprise features included in the one or more second reports;

performing a nameserver lookup using the URL of the resource to obtain nameserver records for a domain associated with the URL of the resource;

determining a reputation score for the nameserver records, wherein the first plurality of features further comprises the reputation score for the nameserver records;

classifying the first violation and the one or more second violations as a scripting attack based on the first plurality of features and the second pluralities of features; and

based on classifying the first violation and the one or more second violations as the scripting attack, taking action to mitigate the scripting attack on the first web application and the one or more second web applications.

25 . A method for scripting attack detection and mitigation, comprising:

receiving a first report indicating a first violation for a first security policy applied to a first web application and one or more second reports indicating one or more second violations for one or more second security policies applied to one or more second web applications;

identifying a first plurality of features associated with the first violation and second pluralities of features associated with the one or more second violations, wherein:

the first plurality of features comprises features included in the first report,

the second pluralities of features comprise features included in the one or more second reports, and

the second pluralities of features comprise a uniform resource locator (URL) of a resource that was prevented from loading on a browser;

performing a nameserver lookup using the URL of the resource to obtain nameserver records for a domain associated with the URL of the resource;

determining a reputation score for the nameserver records, wherein the second pluralities of features further comprise the reputation score for the nameserver records;

classifying the first violation and the one or more second violations as a scripting attack based on the first plurality of features and the second pluralities of features; and

based on classifying the first violation and the one or more second violations as the scripting attack, taking action to mitigate the scripting attack on the first web application and the one or more second web applications.