Rule generalization for web application entry point modeling
View Patent ↗A security gateway receives messages, such as URL requests, rejected by a message filter based on a set of rules. The security gateway maintains frequencies with which the messages were rejected by the rules. The security gateway finds rejected messages having a high frequency of occurrence. Since messages having a high frequency of occurrences are more likely to represent legitimate requests rather than malicious attacks, the security gateway generates exception rules, which would allow similar messages to pass through the gateway.
1. A method for adaptively generating exception rules to rejection rules for filtering messages, comprising:
(a) receiving, by an intermediary device between a client and a server, a first message of a first user session, the first message having a first URL comprising a plurality of hierarchically related URL components, the plurality of hierarchically related URL components comprising a first URL component and a second URL component, the second URL component being a descendant of the first URL component;
(b) rejecting, by the intermediary device, the first message based on a rejection rule that rejects messages having the first URL component;
(c) maintaining, by the intermediary device, a first number of user sessions each having one or more messages rejected based on the first URL component;
(d) maintaining, by the intermediary device, a second number of user sessions each having one or more messages rejected based on the second URL component;
(e) determining, by the intermediary device, that the first number of user sessions exceeds a threshold and that the second number of user sessions does not exceed the threshold;
(f) generating, by the intermediary device, an exception rule to the rejection rule responsive to the determination, the exception rule allowing messages having the first URL component to pass;
(g) receiving, by the intermediary device, a second message of the first user session having the first URL component; and
(h) allowing, by the intermediary device, the second message of the first user session to pass between the client and the server based on the exception rule that allows messages having the first URL component to pass.
2. The method of claim 1 , wherein step (e) comprises determining that the first number of user sessions exceeds the threshold, the first URL component having no descendents with a corresponding number of user sessions exceeding the threshold.
3. The method of claim 1 , wherein step (e) comprises determining that a function of the first number of user sessions and the second number of user sessions exceeds the threshold.
4. The method of claim 3 , further comprising defining the function as a function of the first number of user sessions and a number of user sessions corresponding to each descendant of the first URL component in messages received by the intermediary device.
5. The method of claim 1 , further comprising defining the threshold as a product of a total number of messages over a time interval and a percentage of the messages that should be allowed.
6. The method of claim 1 , further comprising generating the exception rule by inferencing a scalar data type of the descendants of the first URL component.
7. The method of claim 3 , further comprising defining the function as a direct count of the user sessions corresponding to the first URL component.
8. The method of claim 3 , further comprising defining the function as a weighted count of the user sessions corresponding to the first URL component.
9. The method of claim 1 , further comprising storing, by the intermediary device the URL in a trie structure, wherein each URL component of the plurality of hierarchically related URL components is associated with a node in the trie structure.
10. The method of claim 3 , further comprising storing, by the intermediary device the URL in a trie structure and maintaining the function in a node of the trie structure associated with the first URL component, wherein each URL component of the plurality of hierarchically related URL components is associated with a node in the trie structure.
11. A system for adaptively generating exception rules to rejection rules for filtering messages received by an intermediary device, comprising:
a filter receiving a first message of a first user session, the first message having a first URL, the first URL comprising a plurality of hierarchically related URL components, the plurality of hierarchically related URL components comprising a first URL component and a second URL component, the second URL component being a descendant of a first URL component, wherein the first message is rejected based on a rejection rule that rejects messages having the first URL component; and
an engine maintaining, in memory, a first number of user sessions each having one or more messages rejected based on the first URL component, and a second number of user sessions each having one or more messages rejected based on the second URL component; determining that the first number of user sessions exceeds a threshold and that the second number of user sessions does not exceed the threshold; and generating an exception rule to the rejection rule for the first node associated with the first URL component responsive to the determination, the exception rule allowing messages having the first URL component to pass;
wherein the filter receives a second message of the first user session having the first URL component; and allows the second message of the first user session to pass between the client and the server based on the exception rule that allows messages having the first URL component to pass.
12. The system of claim 11 , wherein the engine determines that the first number of user sessions exceeds the threshold, the first URL component having no descendents with a corresponding number of user sessions exceeding the threshold.
13. The system of claim 12 , wherein the engine determines that a function of the first number of user sessions and the second number of user sessions exceeds the threshold.
14. The method of claim 13 , wherein the function is a function of the first number of user sessions and a number of user sessions corresponding to each descendant of the first URL component in messages received by the device.
15. The system of claim 12 , wherein the threshold is a product of a total number of messages over a time interval and a percentage of the messages that should be allowed.
16. The system of claim 12 , wherein the exception rule is generated by inferencing a scalar data type of the descendants of the first URL.
17. The system of claim 13 , wherein the function is a direct count of the first number of user sessions corresponding to the first URL component.
18. The system of claim 13 , wherein the function is a weighted count of the number of user sessions corresponding to the first URL component.
19. The system of claim 12 , wherein the engine stores the URL in a trie structure such that each URL component of the plurality of hierarchically related URL components is associated with a node in the trie structure.
20. The system of claim 13 , wherein the engine stores the URL in a trie structure such that each URL component of the plurality of hierarchically related URL components is associated with a node in the trie structure, and maintains the function in a node of the trie structure associated with the first URL component.
21. A method for adaptively generating exception rules to rejection rules for filtering messages, comprising:
(a) receiving, by an intermediary device between a client and a server, a first message of a first user session, the first message having a first URL comprising a plurality of hierarchically related URL components, the plurality of hierarchically related URL components comprising a first URL component and a second URL component, the second URL component being a descendant of the first URL component;
(b) rejecting, by the intermediary device, the first message based on a rejection rule that rejects messages having the first URL component;
(c) maintaining, by the intermediary device, a first number of user sessions each having one or more messages rejected based on the first URL component;
(d) maintaining, by the intermediary device, a second number of user sessions each having one or more messages rejected based on the second URL component;
(e) determining, by the intermediary device, that the first number of user sessions exceeds a threshold and the second number of user sessions does not exceed the threshold;
(f) generating, by the intermediary device, an exception rule to the rejection rule responsive to the determination, the exception rule allowing messages having the first URL component to pass;
(g) receiving, by the intermediary device, a second message of the first user session having the first URL component;
(h) identifying, by the intermediary device, that the second message having the first URL component is rejected by the rejection rule;
(i) determining, by the intermediary device, that the rejection rule has an exception rule that may allow a message that has been rejected by the rejection rule to pass; and
(j) allowing, by the intermediary device, the second message of the first user session to pass between the client and the server based on the exception rule that allows messages having the first URL component to pass.