Attacker detection via fingerprinting cookie mechanism
Disclosed herein are system, method, and computer program product embodiments for detecting cyber-attack. In an embodiment, a server receives a request to an application from a user device. The server determines that there is no cookie in the received request. The server then generates a new fingerprinting cookie and sends a verification request to the user device to verify the identity of a user. When the server receives the verification reply from the user device, the server determines that the verification reply is valid, marks the new cookie as a verified cookie, and transfers the request to the application for processing. The server can also unverify the verified cookie when the verified cookie is included in a malicious request. The server can determine that a request is malicious by analyzing functions the user wishes to perform using the request.
1. A computer-implemented method for validating a request from a user device, wherein the request is to be processed by an application, the method comprising:
receiving, by a server, the request from the user device;
determining, by the server, that the request does not contain a fingerprinting cookie;
generating, by the server, a new fingerprinting cookie for a user associated with the user device;
sending, by the server, a verification request and the new fingerprinting cookie to the user device;
receiving, by the server, a valid verification reply from the user device;
marking, by the server, the new fingerprinting cookie as a verified cookie;
providing, by the server, the request to the application for processing;
receiving, by the server, a second request from the user device, wherein the second request includes the verified cookie;
determining, by the server, the second request is malicious by analyzing functions the user wishes to perform using the second request;
unverifying the verified cookie; and
blocking the second request or routing the second request to a honeypot system.
2. The computer-implemented method of claim 1 , further comprising:
determining, by a request checking device, that the request is not malicious by analyzing functions the user wishes to perform using the request.
3. The computer-implemented method of claim 2 , wherein the request checking device is a component of the server.
4. The computer-implemented method of claim 1 , wherein the verification request comprises CAPTCHA, cryptogram puzzles, two-factor authentication or trusted execution environment technology.
5. The computer-implemented method of claim 1 , further comprising:
adding the verified cookie to a cookie whitelist.
6. The computer-implemented method of claim 1 , wherein the unverifying the verified cookie comprising:
deleting the verified cookie from a cookie whitelist.
7. A system, comprising:
a memory; and
at least one processor coupled to the memory and configured to:
receive a request from a user device to an application;
determine that the request does not contain a fingerprinting cookie;
generate a new fingerprinting cookie for a user associated with the user device;
send a verification request and the new fingerprinting cookie to the user device;
receive a valid verification reply from the user device;
mark the new fingerprinting cookie as a verified cookie;
provide the request to the application for processing;
receive a second request from the user device to the application, wherein the second request includes the verified cookie;
determine the second request is malicious by analyzing functions the user wishes to perform using the second request;
unverify the verified cookie; and
block the second request or reroute the second request to a honeypot system.
8. The system of claim 7 , wherein a request checking device is configured to determine the request is not malicious by analyzing functions the user wishes to perform using the request.
9. The system of claim 8 , wherein the request checking device is part of the at least one processor.
10. The system of claim 7 , wherein the verification request comprises CAPTCHA, cryptogram puzzles, two-factor authentication or trusted execution environment technology.
11. The system of claim 7 , wherein the at least one processor is further configured to:
add the verified cookie to a cookie whitelist.
12. The system of claim 7 , wherein to unverify the verified cookie, the at least one processor is configured to:
delete the verified cookie from a cookie whitelist.
13. A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations to validate a request from a user device, wherein the request is to be processed by an application, the operations comprising:
receiving, by the at least one computing device, the request from the user device;
determining, by the at least one computing device, that the request does not contain a fingerprinting cookie;
generating, by the at least one computing device, a new fingerprinting cookie for a user associated with the user device;
sending, by the at least one computing device, a verification request and the new fingerprinting cookie to the user device;
receiving, by the at least one computing device, a valid verification reply from the user device;
marking, by the at least one computing device, the new fingerprinting cookie as a verified cookie;
providing, by the at least one computing device, the request to the application for processing;
receiving, by the at least one computing device, a second request from the user device, wherein the second request includes the verified cookie;
determining, by the at least one computing device, the second request is malicious by analyzing functions the user wishes to perform using the second request;
unverifying, by the at least one computing device, the verified cookie by deleting it from a cookie whitelist; and
blocking, by the at least one computing device, the second request or rerouting the second request to a honeypot system.
14. The device of claim 13 , the operations further comprising:
determining, by a request checking device, that the request is not malicious by analyzing functions the user wishes to perform using the request.
15. The device of claim 14 , wherein the request checking device is part of the at least one computing device.
16. The device of claim 13 , wherein the verification request comprises CAPTCHA, cryptogram puzzles, two-factor authentication or trusted execution environment technology.
17. The device of claim 13 , the marking further comprising:
adding the verified cookie to a cookie whitelist.
18. The computer-implemented method of claim 6 , wherein the determining the second request is malicious further comprises detecting non-existing paths in the second request.
19. The system of claim 7 , wherein the at least one processor is further configured to determine the second request is malicious by detecting non-existing paths in the second request.
20. The device of claim 13 , wherein the determining the second request is malicious further comprises detecting non-existing paths in the second request.