Determining an origin server is potentially compromised
An edge server receives a request from a client network application for a web page hosted at an origin server. The edge server transmits the requested web page in a response. The edge server accesses an edge server request log to retrieve a log entry associated with the request for the web page, where the log entry associated with the request for the web page includes information regarding the request and the response. The edge server retrieves one or more characteristics of an asset of the web page, where each characteristics has an expected value. The edge server determines whether the origin server is compromised when a value for a characteristic is not within a threshold range of the expected value for the characteristic of the asset and performs a mitigation action in response.
1. A computer-implemented method comprising:
receiving, by an edge server, a request for a web page hosted by an origin server;
transmitting a response to the request, the response including the web page;
accessing an edge server request log to retrieve a log entry associated with the request for the web page, the log entry associated with the request for the web page including information regarding the request for the web page and the response to the request for the web page;
retrieving one or more characteristics of an asset of the web page from the log entry associated with the request for the web page, the asset having expected values for each of the one or more characteristics;
determining that the origin server is compromised when a value for a characteristic of the asset of the web page is not within a threshold range of an expected value for the characteristic of the asset; and
performing a first mitigation action in response to determining that the origin server is compromised.
2. The computer-implemented method of claim 1 , further comprising:
retrieving a security certificate associated with a website containing the web page from the log entry associated with the request for the web page;
determining whether the retrieved security certificate associated with the website matches a stored fingerprint of the security certificate associated with the website;
determining that the origin server is compromised when the retrieved security certificate does not match the stored fingerprint of the security certificate; and
performing a second mitigation action in response to determining that the origin server is compromised.
3. The computer-implemented method of claim 2 , wherein determining whether the retrieved security certificate associated with the website matches the stored fingerprint of the security certificate associated with the website comprises:
generating a fingerprint of the security certificate from the log entry associated with the request for the web page; and
comparing the generated fingerprint of the security certificate to the stored fingerprint of the security certificate.
4. The computer-implemented method of claim 1 , wherein the characteristic of the asset of the web page is a file size of the asset.
5. The computer-implemented method of claim 1 , wherein the characteristic of the asset of the web page is a fingerprint of the asset.
6. The computer-implemented method of claim 1 , wherein accessing the edge server request log to retrieve the log entry associated with the request for the web page comprises:
determining that a defined amount of time has elapsed since a previous retrieval from the edge server request log; and
retrieving one or more log entries from the edge server request log, the one or more log entries generated in the defined amount of time since the previous retrieval from the edge server request log.
7. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor, cause said processor to perform operations comprising:
receiving, by an edge server, a request for a web page hosted by an origin server;
transmitting a response to the request, the response including the web page;
accessing an edge server request log to retrieve a log entry associated with the request for the web page, the log entry associated with the request for the web page including information regarding the request for the web page and the response to the request for the web page;
retrieving one or more characteristics of an asset of the web page from the log entry associated with the request for the web page, the asset having expected values for each of the one or more characteristics;
determining that the origin server is compromised when a value for a characteristic of the asset of the web page is not within a threshold range of an expected value for the characteristic of the asset; and
performing a first mitigation action in response to determining that the origin server is compromised.
8. The non-transitory machine-readable storage medium of claim 7 , further comprising:
retrieving a security certificate associated with a website containing the web page from the log entry associated with the request for the web page;
determining whether the retrieved security certificate associated with the website matches a stored fingerprint of the security certificate associated with the website;
determining that the origin server is compromised when the retrieved security certificate does not match the stored fingerprint of the security certificate; and
performing a second mitigation action in response to determining that the origin server is compromised.
9. The non-transitory machine-readable storage medium of claim 8 , wherein determining whether the retrieved security certificate associated with the website matches the stored fingerprint of the security certificate associated with the website comprises:
generating a fingerprint of the security certificate from the log entry associated with the request for the web page; and
comparing the generated fingerprint of the security certificate to the stored fingerprint of the security certificate.
10. The non-transitory machine-readable storage medium of claim 7 , wherein the characteristic of the asset of the web page is a file size of the asset.
11. The non-transitory machine-readable storage medium of claim 7 , wherein the characteristic of the asset of the web page is a fingerprint of the asset.
12. The non-transitory machine-readable storage medium of claim 7 , further comprising: wherein accessing the edge server request log to retrieve the log entry associated with the request for the web page comprises:
determining that a defined amount of time has elapsed since a previous retrieval from the edge server request log; and
retrieving one or more log entries from the edge server request log, the one or more log entries generated in the defined amount of time since the previous retrieval from the edge server request log.
13. An apparatus, comprising:
a processor;
a non-transitory machine-readable storage medium coupled with the processor that stores instructions that, when executed by the processor, causes said processor to perform the following:
receive a request for a web page hosted by an origin server;
transmit a response to the request, the response including the web page;
access an edge server request log to retrieve a log entry associated with the request for the web page, the log entry associated with the request for the web page including information regarding the request for the web page and the response to the request for the web page;
retrieve one or more characteristics of an asset of the web page from the log entry associated with the request for the web page, the asset having expected values for each of the one or more characteristics;
determine that the origin server is compromised when a value for a characteristic of the asset of the web page is not within a threshold range of an expected value for the characteristic of the asset; and
perform a first mitigation action in response to determining that the origin server is compromised.
14. The apparatus of claim 13 , wherein the instructions further cause said processor to perform the following:
retrieve a security certificate associated with a website containing the web page from the log entry associated with the request for the web page;
determine whether the retrieved security certificate associated with the website matches a stored fingerprint of the security certificate associated with the website;
determine that the origin server is compromised when the retrieved security certificate does not match the stored fingerprint of the security certificate; and
perform a second mitigation action in response to determining that the origin server is compromised.
15. The apparatus of claim 14 , wherein determining whether the retrieved security certificate associated with the website matches the stored fingerprint of the security certificate associated with the website comprises:
generating a fingerprint of the security certificate from the log entry associated with the request for the web page; and
comparing the generated fingerprint of the security certificate to the stored fingerprint of the security certificate.
16. The apparatus of claim 13 , wherein the characteristic of the asset of the web page is a file size of the asset.
17. The apparatus of claim 13 , wherein the characteristic of the asset of the web page is a fingerprint of the asset.
18. The apparatus of claim 13 , wherein accessing the edge server request log to retrieve the log entry associated with the request for the web page comprises:
determining that a defined amount of time has elapsed since a previous retrieval from the edge server request log; and
retrieving one or more log entries from the edge server request log, the one or more log entries generated in the defined amount of time since the previous retrieval from the edge server request log.