Identifying a security threat to a web-based resource

• US 10,574,679 B2
• Filed: 02/01/2017
• Issued: 02/25/2020
• Est. Priority Date: 02/01/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Rehak, Martin
• Primary Examiner(s): Chiang, Jason
• Application Number:
  US15/421,969
• Publication Number:
  US 20180219890A1
• Time in Patent Office: 1,119 Days
• Field of Search: None
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Access logs associated with user requests for a web-based resource are monitored. Parameter(s) that index records of the web-based resource are identified. A baseline distribution(s) of values of the parameter(s) are generated and, based on the baseline distribution(s), a baseline entropy of the parameter(s) is calculated. A distribution(s) of values of the parameters associated with user requests made by a particular user is generated and, based on the distribution(s), an entropy of the parameter(s) associated with the user requests is calculated. The entropy is compared to the baseline entropy. If a difference between the baseline entropy and the entropy exceeds a threshold, it is determined that the particular user poses a security threat to the web-based resource.

Claims

1. A computer-implemented method comprising:

monitoring access logs associated with hypertext transfer protocol requests made to a uniform resource locator for a web-based resource, wherein the access logs include an indication of a number of the hypertext transfer protocol requests made to the uniform resource locator for the web-based resource and one or more timestamps of the hypertext transfer protocol requests made to the uniform resource locator for the web-based resource;

identifying, based on the access logs, one or more parameters that index records of the web-based resource;

generating at least one baseline distribution of values of the one or more parameters;

calculating, based on the at least one baseline distribution of values, a baseline entropy of the one or more parameters;

generating at least one distribution of values of the one or more parameters associated with hypertext transfer protocol requests made by a particular user, wherein the at least one distribution of values includes at least one histogram including a mapping of the values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user and a number of the hypertext transfer protocol requests made by the particular user;

calculating, based on the at least one distribution of values, an entropy of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user;

comparing the entropy to the baseline entropy; and

if a difference between the baseline entropy and the entropy exceeds a threshold, determining that the hypertext transfer protocol requests made by the particular user poses a security threat to the web-based resource.

2. The method of claim 1, wherein identifying the one or more parameters includes:

identifying one or more candidate parameters, wherein the one or more candidate parameters are associated with the hypertext transfer protocol requests to the uniform resource locator for the web-based resource;

generating at least one distribution of values of the one or more candidate parameters;

calculating, based on the at least one distribution of values of the one or more candidate parameters, respective entropies of the one or more candidate parameters; and

determining, based on the respective entropies of the one or more candidate parameters, which of the one or more candidate parameters index the web-based resource.

3. The method of claim 2, wherein determining which of the one or more candidate parameters index the web-based resource includes determining which of the respective entropies of the one or more candidate parameters are intermediate entropies of the respective entropies.

4. The method of claim 1, wherein the at least one baseline distribution of values of the one or more parameters is associated with the hypertext transfer protocol requests made by the particular user.

5. The method of claim 1, wherein the at least one baseline distribution of values of the one or more parameters is associated with hypertext transfer protocol requests made by a plurality of users.

6. The method of claim 1, wherein:

generating the at least one baseline distribution of values of the one or more parameters includes generating a user-specific baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user, and a global baseline distribution of values of the one or more parameters associated with hypertext transfer protocol requests made by a plurality of users; and

calculating the baseline entropy includes calculating a user-specific baseline entropy based on the user-specific baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user and a global baseline entropy based on the global baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the plurality of users.

7. The method of claim 6, wherein comparing includes comparing the entropy to either or both of the user-specific baseline entropy and the global baseline entropy.

8. The method of claim 1, wherein the at least one baseline distribution of values includes at least one baseline histogram.

9. The method of claim 1, wherein monitoring, identifying, generating the at least one baseline distribution of values of the one or more parameters, and calculating the baseline entropy, are performed for each of a plurality of web-based resources based on hypertext transfer protocol requests made by each of a plurality of users.

10. The method of claim 9, wherein generating the at least one distribution of values of the one or more parameters associated with hypertext transfer protocol requests made by the particular user, calculating the entropy of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user, comparing, and determining are performed for each of the plurality of users.

11. The method of claim 1, further comprising providing an alert that the particular user poses the security threat to the web-based resource.

12. An apparatus comprising:

a memory;

a communication interface configured to enable communications in a network; and

one or more processors coupled to the memory and to the communication interface, and configured to;

monitor access logs associated with hypertext transfer protocol requests made to a uniform resource locator for a web-based resource, wherein the access logs include an indication of a number of the hypertext transfer protocol requests made to the uniform resource locator for the web-based resource and one or more timestamps of the hypertext transfer protocol requests made to the uniform resource locator for the web-based resource;

identify, based on the access logs, one or more parameters that index records of the web-based resource;

generate at least one baseline distribution of values of the one or more parameters;

calculate, based on the at least one baseline distribution of values, a baseline entropy of the one or more parameters;

generate at least one distribution of values of the one or more parameters associated with hypertext transfer protocol requests made by a particular user, wherein the at least one distribution of values includes at least one histogram including a mapping of the values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user and a number of the hypertext transfer protocol requests made by the particular user;

calculate, based on the at least one distribution of values, an entropy of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user;

compare the entropy to the baseline entropy; and

if a difference between the baseline entropy and the entropy exceeds a threshold, determine that the hypertext transfer protocol requests made by the particular user poses a security threat to the web-based resource.

13. The apparatus of claim 12, wherein the one or more processors are configured to identify the one or more parameters that index records of the web-based resource by:

identifying one or more candidate parameters, wherein the one or more candidate parameters are associated with the hypertext transfer protocol requests to the uniform resource locator for the web-based resource;

generating at least one distribution of values of the one or more candidate parameters;

calculating, based on the at least one distribution of values of the one or more candidate parameters, respective entropies of the one or more candidate parameters; and

determining, based on the respective entropies of the one or more candidate parameters, which of the one or more candidate parameters index the web-based resource.

14. The apparatus of claim 13, wherein the one or more processors are configured to determine which of the one or more candidate parameters index the web-based resource by determining which of the respective entropies of the one or more candidate parameters are intermediate entropies of the respective entropies.

15. The apparatus of claim 12, wherein the one or more processors are configured to:

generate a user-specific baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user, and a global baseline distribution of values of the one or more parameters associated with hypertext transfer protocol requests made by a plurality of users; and

calculate a user-specific baseline entropy based on the user-specific baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user and a global baseline entropy based on the global baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the plurality of users.

16. The apparatus of claim 15, wherein the one or more processors are configured to compare the entropy to either or both of the user-specific baseline entropy and the global baseline entropy.

17. One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:

monitor access logs associated with hypertext transfer protocol requests made to a uniform resource locator for a web-based resource, wherein the access logs include an indication of a number of the hypertext transfer protocol requests made to the uniform resource locator for the web-based resource and one or more timestamps of the hypertext transfer protocol requests made to the uniform resource locator for the web-based resource;

identify, based on the access logs, one or more parameters that index records of the web-based resource;

generate at least one baseline distribution of values of the one or more parameters;

calculate, based on the at least one baseline distribution of values, a baseline entropy of the one or more parameters;

generate at least one distribution of values of the one or more parameters associated with hypertext transfer protocol requests made by a particular user, wherein the at least one distribution of values includes at least one histogram including a mapping of the values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user and a number of the hypertext transfer protocol requests made by the particular user;

calculate, based on the at least one distribution of values, an entropy of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user;

compare the entropy to the baseline entropy; and

if a difference between the baseline entropy and the entropy exceeds a threshold, determine that the hypertext transfer protocol requests made by the particular user poses a security threat to the web-based resource.

18. The one or more non-transitory computer readable storage media of claim 17, wherein the instructions that cause the processor to identify the one or more parameters that index records of the web-based resource include instructions that cause the processor to:

identify one or more candidate parameters, wherein the one or more candidate parameters are associated with the hypertext transfer protocol requests to the uniform resource locator for the web-based resource;

generate at least one distribution of values of the one or more candidate parameters;

calculate, based on the at least one distribution of values of the one or more candidate parameters, respective entropies of the one or more candidate parameters; and

determine, based on the respective entropies of the one or more candidate parameters, which of the one or more candidate parameters index the web-based resource.

19. The one or more non-transitory computer readable storage media of claim 18, wherein the instructions that cause the processor to determine which of the one or more candidate parameters index the web-based resource include instructions that cause the processor to determine which of the respective entropies of the one or more candidate parameters are intermediate entropies of the respective entropies.

20. The one or more non-transitory computer readable storage media of claim 17, wherein:

the instructions that cause the processor to generate the at least one baseline distribution of values of the one or more parameters include instructions that cause the processor to generate a user-specific baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user, and a global baseline distribution of values of the one or more parameters associated with hypertext transfer protocol requests made by a plurality of users; and

the instructions that cause the processor to calculate the baseline entropy include instructions that cause the processor to calculate a user-specific baseline entropy based on the user-specific baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the particular user and a global baseline entropy based on the global baseline distribution of values of the one or more parameters associated with the hypertext transfer protocol requests made by the plurality of users.