Automatic user session profiling system for detecting malicious intent

1. A method for analyzing past user sessions for malicious intent, the method comprising:

detecting, by a computer system, a security incident;

responsive to detecting the security incident, triggering, by the computer system, a forensic investigation using a set of security rules for detecting website vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product;

downloading a database of the set of security rules associated with the dynamic analysis product for use by a forensic analysis product to perform the forensic investigation; and

configuring the dynamic analysis product, comprising a set of security tests for detecting the website vulnerability using the set of security rules, and the forensic analysis product, configured to analyze patterns of network traffic using the set of security rules to investigate security incidents in the forensic investigation, to communicate with each other.

2. The method of claim 1 , wherein triggering the forensic investigation using the set of security rules for detecting the web site vulnerability comprises:

identifying a set of past user sessions for a current user identified in the security incident; and

applying the set of security rules to the set of past user sessions for the current user to identify a group of other security incidents associated with the current user.

3. The method of claim 2 , wherein applying the set of security rules to the set of past user session to identify the group of other security incidents associated with the current user comprises:

applying the set of security rules to patterns of network traffic for the set of past user sessions for the current user to identify the group of other security incidents associated with the current user.

4. The method of claim 2 , wherein applying the set of security rules to the set of past user sessions to identify the group of other security incidents associated with the current user comprises:

applying the set of security rules to patterns of network traffic to a past user session in the set of past user sessions for the current user to determine whether a pattern of network traffic in the patterns of network traffic matches a security rule in the set of security rules to identify the group of other security incidents associated with the current user.

5. The method of claim 1 , wherein detecting the security incident comprises:

detecting the security incident using at least one of an intrusion protection system, an intrusion detection system, or a security information and event management system.

6. The method of claim 1 further comprising:

identifying the set of past user sessions in a database; and

performing the forensic investigation on the set of past user sessions using the set of security rules for detecting the web site vulnerability in which the set of security rules is applied to the set of past user sessions.

7. The method of claim 1 wherein the forensic analysis product uses the set of security rules to identify cookies and parameters in network traffic following a same logic that the dynamic analysis product employs to dynamically detect vulnerabilities in the network traffic.

8. A computer system comprising:

a processor unit; and

a forensic analysis product running on the processor unit, wherein the forensic analysis product, responsive to detecting a security incident, triggering a forensic investigation using a set of security rules for detecting web site vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product, wherein the forensic analysis product downloads a database of security rules associated with the dynamic analysis product for use by the forensic analysis product to perform the forensic investigation, and wherein the forensic analysis product communicates with the dynamic analysis product, comprising the set of security rules for detecting the website vulnerability, to receive the set of security rules associated with the dynamic analysis product.

9. The computer system of claim 8 , wherein the forensic analysis product triggers the forensic investigation using the set of security rules for detecting the website vulnerability by identifying the set of past user sessions for a current user identified in the security incident and applying the set of security rules to the set of past user sessions for the current user to identify other security incidents associated with the current user.

10. The computer system of claim 9 , wherein the forensic analysis product applies the set of security rules to the set of past user session to identify a group of the other security incidents associated with the current user by applying the set of security rules to patterns of network traffic for the set of past user sessions for the current user to identify the group of the other security incidents associated with the current user.

11. The computer system of claim 9 , wherein the forensic analysis product applies the set of security rules to a current user session to identify the group of the other security incidents associated with the current user comprises:

applying the set of security rules to patterns of network traffic for a past user session for the current user to determine whether a pattern of network traffic in the patterns of network traffic matches a security rule in the set of security rules to identify the group of the other security incidents associated with the current user.

12. The computer system of claim 8 , wherein the forensic analysis product detects the security incident by receiving an indication from at least one of an intrusion protection system, an intrusion detection system, or a security information and event management system.

13. The computer system of claim 8 , wherein the forensic analysis product identifies the set of past user sessions in a database and performs the forensic investigation on the set of past user sessions using the set of security rules for detecting the website vulnerability in which the set of security rules is applied to the set of past user sessions.

14. The computer system of claim 8 , wherein the forensic analysis product uses the set of security rules to identify cookies and parameters in network traffic following a same logic that the dynamic analysis product employs to dynamically detect vulnerabilities in the network traffic.

15. A computer program product for analyzing user sessions for malicious intent, the computer program product comprising:

a computer-readable storage media;

first program code, stored on the computer-readable storage media, for detecting a security incident;

second program code, stored on the computer-readable storage media, for triggering a forensic investigation using a set of security rules for detecting website vulnerability in response to detecting the security incident, in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product; and

third program code, stored on the computer-readable storage media, for downloading a database of the set of security rules associated with the dynamic analysis product for use by a forensic analysis product to perform the forensic investigation, wherein the forensic analysis product communicates with the dynamic analysis product, comprising the set of security rules for detecting the website vulnerability, to receive the set of security rules associated with the dynamic analysis product.

16. The computer program product of claim 15 , wherein the second program code comprises:

program code, stored on the computer-readable storage media, for identifying the set of past user sessions for a current user identified in the security incident; and

program code, stored on the computer-readable storage media, for applying the set of security rules to the set of past user sessions for the current user to identify other security incidents associated with the current user.

17. The computer program product of claim 16 , wherein the program code for applying the set of security rules to the set of past user sessions to identify the other security incidents associated with the current user comprises:

program code, stored on the computer-readable storage media, for applying the set of security rules to patterns of network traffic for the set of past user sessions for the current user to identify a group of the other security incidents associated with the current user.

18. The computer program product of claim 16 , wherein the program code for applying the set of security rules to the set of past user sessions for the current user to identify the other security incidents associated with the current user comprises:

program code, stored on the computer-readable storage media, for applying the set of security rules to patterns of network traffic to a past user session in the set of past user sessions for the current user to determine whether a pattern of network traffic in the patterns of network traffic matches a security rule in the set of security rules to identify a group of the other security incidents associated with the current user.