Method and system of attack detection and protection in computer systems
View Patent ↗In one example aspect, a computerized method of automatically detecting and blocking at least one attack on an application includes the step of modifying instructions of the application to include at least one sensor. The at least one sensor generates a set of events related to detecting an attack on the application or a computing system implementing the application. The method includes the step of reviewing, from within the application, the set of events generated by the at least one sensor. The method includes the step of detecting a presence of at least one attack on the application based on the review of the set of events. The method includes the step of invoking an attack response action.
1. A computerized method of automatically detecting and blocking at least one attack on an application comprising:
wherein the at least one attack is on the application;
modifying, from within the application, instructions of the application to include at least one sensor, wherein the sensor generates a set of events related to detecting an attack on the application, when executed by one or more processors, or a computing system implementing the application, wherein the at least one sensor is configured to create an event based on a configuration information for the application, and wherein the sensor comprises a passive sensor that generates an event that is collected and analyzed whenever an instrumented method is invoked;
reviewing, from within the application, the set of events generated by the at least one sensor;
detecting, from within the application, a presence of the at least one attack on the application based on the review of the set of events; and
invoking, from within the application, an attack response action, wherein the step of invoking an attack response action further comprises:
enabling a custom set of rules and responses to be enforced as a virtual patch,
modifying a set of instructions of the application snapshot to include at least one sensor adapted to generate an action selected by testing and analyzing a runtime behavior of a run-time library or run time component, and
dynamically patching a code segment at a run-time of the application, and
wherein the sensors and the attack response actions are controlled by a set of custom rules created by a user, and
wherein the set of custom rules are used to implement the virtual patch to the application.
2. The computerized method of claim 1 , wherein the set of events are related to detecting both the attack on the application or the computing system implementing the application and a vulnerability detection related to an attack vulnerability of the application or in the computing system implementing the application.
3. The computerized method of claim 1 , wherein the detected attack comprises a bot attack.
4. The computerized method of claim 1 , wherein the detected attack comprises an attempt to exploit a specific known vulnerability in a library the application or in the computing system implementing the application.
5. The computerized method of claim 1 further comprising:
implementing a lazy-attack evaluation.
6. The computerized method of claim 1 , wherein the attack response action comprises a logging action that records a set of events related to the attack.
7. The computerized method of claim 1 , wherein the attack response action comprises throwing an exception.
8. The computerized method of claim 1 , wherein the attack response action comprises redirecting the user's web browser to another web page.
9. The computerized method of claim 1 , wherein the attack response action comprises sending the user's web browser to a honeypot mechanism.
10. The computerized method of claim 1 , wherein the attack response action comprising adding or enabling a specified security feature or reconfiguring the application.
11. The computerized method of claim 1 , wherein the sensor is configured to create an action snapshot based on the data in HTTP requests and a response that is either received or transmitted by the application.
12. The computerized method of claim 1 , wherein the code segment to be patched is a software component or library that is a part of the application.
13. A server system of automatically detecting and blocking at least one attack on an application comprising:
a processor configured to execute instructions;
a memory containing instructions when executed on the processor, causes the processor to perform operations that:
modify, from within the application, instructions of the application to include at least one sensor, wherein the sensor generates a set of events related to detecting an attack on the application or a computing system implementing the application, wherein the at least one sensor is configured to create an event based on a configuration information for the application, and wherein the sensor comprises a passive sensor that generates an event that is collected and analyzed whenever an instrumented method is invoked;
review, from within the application, the set of events generated by the at least one sensor;
detect, from within the application, a presence of at least one attack on the application based on the review of the set of events; and
invoke, from within the application, an attack response action by:
enabling a custom set of rules and responses to be enforced as a virtual patch,
modifying a set of instructions of the application snapshot to include at least one sensor adapted to generate an action selected by testing and analyzing a runtime behavior of a run-time library or run time component, and
dynamically patching a code segment at a run-time of the application, and
wherein the sensors and the attack response actions are controlled by a set of custom rules created by a user, and
wherein the set of custom rules are used to implement the virtual patch to the application.
14. A computerized method of automatically detecting and blocking at least one attack on an application comprising:
modifying, from within the application, instructions of the application to include at least one sensor, wherein the sensor generates a set of events related to detecting an attack on the application, when executed by one or more processors, or a computing system implementing the application, wherein the sensor is configured to create an event based on a configuration information for the application, and wherein the sensor comprises an active sensor or a passive sensor that generates an event that is collected and analyzed whenever an instrumented method is invoked;
reviewing, from within the application, the set of events generated by the at least one sensor;
detecting, from within the application, a presence of at least one attack on the application based on the review of the set of events; and
invoking, from within the application, an attack response action, wherein the step of invoking an attack response action further comprises:
enabling a custom set of rules and responses to be enforced as a virtual patch,
modifying a set of instructions of the application snapshot to include at least one sensor adapted to generate an action selected by testing and analyzing a runtime behavior of a run-time library or run time component, and
dynamically patching a code segment at a run-time of the application, and
wherein the sensors and the attack response actions are controlled by a set of custom rules created by a user, and
wherein the set of custom rules are used to implement the virtual patch to the application.