Granted Patent B2

US 12,609,943 · App. 18/554,769 · Granted Apr 21, 2026

Inventor: Yo Kanemoto (Tokyo, JP)

Assignee: NTT, Inc.

H04L63/1416H04L63/1425H04L63/1466

Abstract

Claims (36)

1 . A determination device comprising:

processing circuitry configured to:

detect, based on a Universal Resource Locator (“URL”) of a request destination of a request in a communication log that has captured a network communication of a web application, the communication log that indicates an attack on the web application, wherein the attack has caused a distinct damage in accordance with a function of the web application of the request destination;

determine, by using the detected communication log, a result of the attack, wherein the result of the attack is based on:

whether the URL of the request destination of the request in the detected communication log indicating a login form and at least either one of a response size in a response to the request or a status code in the response, and

determining whether or not the attack has succeeded as the result of the attack by collating:

whether or not there is the login form in the URL of the request destination in the request against profile information of the function of the web application indicating whether or not the function of the web application has a login form, and

the response size in the response to the request in which the attack has been detected against a range of a response size when the response is returned to an external device; and

output a result of the determination.

2 . The determination device according to claim 1 ,

wherein the processing circuitry is further configured to detect

the communication log of the attack causing different damage in accordance with the function of the web application of the request destination using a regular expression “OR.*=.* #”, a regular expression “OR (1|‘t’) (#|--)”, or a regular expression “.+[′″] (#|--)”, or any combination thereof as an attack detection signature.

3 . The determination device according to claim 1 , wherein the processing circuitry is further configured to

create profile information of the function of the web application based on normal communication performed between the external device and the function of the web application.

4 . The determination device according to claim 1 ,

wherein the processing circuitry is further configured to determine

in a case where it is determined for the communication log in which the attack has been detected that there is a login form in the URL of the request destination and the status code is one of 300 to 309, that an attack aiming at authentication bypass has succeeded.

5 . The determination device according to claim 1 ,

wherein the processing circuitry is further configured to determine

in a case where it is determined for the communication log in which the attack has been detected that there is no login form in the URL of the request destination and a response size to the request exceeds a range of a response size indicated in profile information of the function of the web application by equal to or greater than a predetermined value, that an attack aiming at information leakage has succeeded.

6 . A determination method executed by a determination device, the determination method comprising:

detecting, based on a Universal Resource Locator (“URL”) of a request destination of a request in a communication log that has captured a network communication of a web application, the communication log that indicates an attack on the web application, wherein the attack has caused a distinct damage in accordance with a function of the web application of the request destination;

determining, by using the detected communication log, a result of the attack, wherein the result of the attack is based on:

whether the URL of the request destination of the request in the detected communication log indicating a login form and at least either one of a response size in a response to the request or a status code in the response, and

determining whether or not the attack has succeeded as the result of the attack by collating:

whether or not there is the login form in the URL of the request destination in the request against profile information of the function of the web application indicating whether or not the function of the web application has a login form, and

the response size in the response to the request in which the attack has been detected against a range of a response size when the response is returned to an external device; and

outputting a result of the determination.

7 . A non-transitory computer-readable recording medium storing therein a determination program that causes a computer to execute a process comprising:

detecting, based on a Universal Resource Locator (“URL”) of a request destination of a request in a communication log that has captured a network communication of a web application, the communication log that indicates an attack on the web application, wherein the attack has caused a distinct damage in accordance with a function of the web application of the request destination;

determining, by using the detected communication log, a result of the attack, wherein the result of the attack is based on:

whether the URL of the request destination of the request in the detected communication log indicating a login form and at least either one of a response size in a response to the request or a status code in the response, and

determining whether or not the attack has succeeded as the result of the attack by collating:

whether or not there is the login form in the URL of the request destination in the request against profile information of the function of the web application indicating whether or not the function of the web application has a login form, and

the response size in the response to the request in which the attack has been detected against a range of a response size when the response is returned to an external device; and

outputting a result of the determination.

Assignments (2)

Continuity (1)

References Cited (14)