Complex application attack quantification, testing, detection and prevention
An apparatus and method for cyber risk quantification calculated from the likelihood of a cyber-attack on the target enterprise and/or cyber ecosystem based on its security posture. The cyber-attack likelihood can be derived as a probability-based time-to-event (TTE) measure using survivor function analysis. The likelihood probability measure can also be passed to cyber risk frameworks to determine financial impacts of the cyber-attacks. Embodiments of the present invention also relate to an apparatus and method (1) to identify and validate application attack surfaces and protect web applications against business logic-based attacks, sensitive data leakage and privilege escalation attacks; and/or (2) that protects web applications against business logic-based attacks, sensitive data leakage and privilege escalation attacks. This can include implementing an intelligent learning loop using artificial intelligence that creates an ontology-based knowledge base from application request and response sequences. Stochastic probabilistic measures are preferably applied to a knowledge base for predicting malicious user actions in real time.
1. A method for testing for weaknesses and protecting organizational software web applications against complex web application attacks comprising:
an event capture module communicating with a knowledge base to create comprehensive predicate logic representation for events generated by one or more end users in real time;
the event capture module communicating with a detection module to allow passing user and application logic identifiers as constants to a process for creating a grounded Markov Logic Network (“MLN”);
training the detection module with software weaknesses that are known to be exploited by attackers;
the detection module aiding in the creation of the grounded MLN via its communication with the knowledge base and the event capture module;
passing the grounded MLN to an MLN management module;
the MLN management module receiving input from the detection model;
the MLN management module creating a master MLN derived from legitimate user actions on a target web application that implements a custom business logic;
the MLN management module dynamically inferring user behavior leading to complex web application attacks; and
an alert module receiving inputs from the MLN management module.
2. The method of claim 1 wherein the MLN management module performs static and dynamic inference to predict and prevent complex web application attacks.
3. The method of claim 1 wherein the MLN management module forms a feedback loop to the event capture module to reevaluate a primitive event to enhance learning.
4. The method of claim 1 wherein the alert module is activated based on attack detection and/or prevention triggers from the MLN management module.
5. The method of claim 1 wherein the detection module further comprises an inductive logic programming-based inference engine that creates grounded MLN for the target web application from user actions.
6. The method of claim 5 wherein the inference engine assigns weights to the predicate statements that represent user actions on the target web application.
7. The method of claim 6 wherein an analysis engine calculates weights as a maximum likelihood estimator for a probability function.
8. The method of claim 7 wherein the probability function is based on all state transitions for underlying events applicable to each of a privilege access level.
9. The method of claim 5 wherein the inference engine accepts weight inputs that originate from subject matter experts.
10. The method of claim 5 wherein the inference engine creates a grounded MLN for the target web application from end user actions.
11. The method of claim 5 wherein the inference engine receives unique user identifiers from the knowledge base and event capture module.
12. The method of claim 11 wherein the unique user identifiers comprise one or more elements selected from a list consisting of session variables, user id, nonce, privilege access level and a combination thereof.
13. The method of claim 11 wherein the inference engine uses application logic identifiers and user-specific identifiers as constants in the grounded MLN.
14. The method of claim 13 wherein the grounded MLN is created as a time slice network capturing all user actions on web applications on a temporal scale.
15. The method of claim 14 wherein the created grounded MLN is a master MLN for a learning mode and wherein the created grounded MLN is a dynamic MLN in a live mode the master MLN generated from all legitimate events performed based on business logic of the target application.
16. The method of claim 14 further comprising computing summary factors as a transition joint probability function between each of a plurality of temporal level in the temporal scale.
17. The method of claim 16 wherein the joint probability function within a summary factor at a temporal level represents a consolidated function including all end user attributes and events executed until an immediately prior temporal level.
18. The method of claim 1 further comprising an inference engine performing static and dynamic inference.
19. The method of claim 18 wherein the inference engine performs static analysis by accepting security analyst queries and determines if the target web application is susceptible to complex application attacks.
20. The method of claim 19 wherein the inference engine can determine if the target web application is susceptible to privilege escalation attacks and business-logic attacks.
21. The method of claim 19 further comprising converting end user queries to respective predicate logic statements and subjecting them to inference in the grounded MLN by using offensive ontology constructs.
22. The method of claim 1 wherein the MLN management module accepts business logic rules as inputs and further predicts and prevents attacks targeting such rules.
23. The method of claim 22 wherein predicting and preventing attacks targeting such rules happens in real time or near-real time.
24. The method of claim 22 wherein the dynamic inference for detecting insecure direct object reference and horizontal privilege access escalation attacks are performed by comparing summary factors between a current and a preceding temporal level.
25. The method of claim 24 wherein comparing summary factors between a current and a preceding temporal level happens in real time or near-real time.
26. The method of claim 1 wherein the inference engine performs dynamic inference to detect vertical privilege escalation, insecure direct object reference, horizontal privilege escalation, and other anomalous user behavior by comparing summary factors between a master MLN and a dynamic MLN.
27. The method of claim 26 wherein comparing summary factors between a master MLN and a dynamic MLN is performed by computing a relative entropy between joint probability distribution functions of the summary factors.
28. The method of claim 27 wherein an anomalous user behavior alert is generated based on an entropy value generated from summary factor comparison.
29. The method of claim 28 wherein the anomalous user behavior alert is generated in real time or near-real time.
30. The method of claim 1 further comprising a command and control center that allows users to activate an attack prevention mode to enable detection of anomalous application user behavior.
31. A non-transitory computer-readable medium comprising computer software for testing for weaknesses and protecting organizational software web applications against complex web application attacks comprising:
code creating an event capture module that communicates with a knowledge base to create comprehensive predicate logic representation for events generated by one or more end users in real time;
code permitting the event capture module to communicate with a detection module to allow passing user and application logic identifiers as constants to a process for creating a grounded Markov Logic Network (“MLN”);
code training the detection module with software weaknesses that are known to be exploited by attackers;
code which causes the detection module to aid in the creation of the grounded MLN via its communication with the knowledge base and the event capture module;
code passing the grounded MLN to an MLN management module and which causes the MLN management module to receive input from the detection model;
code causing the MLN management module to create a master MLN derived from legitimate user actions on a target web application that implements a custom business logic;
code causing the MLN management module to dynamically inferring user behavior leading to complex application attacks; and
code causing an alert module to receive inputs from the MLN management module.