Web server intrusion detection method and apparatus

• US 20020143963A1
• Filed: 03/15/2001
• Published: 10/03/2002
• Est. Priority Date: 03/15/2001
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Converse, Kim, Edmark, Ronald O?apos;Neal
• Application Number:
  US09/810,028
• Publication Number:
  US 20020143963A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Disclosed is an apparatus for enhancing the security of a web server from intrusive attacks in the form of HTTP (hypertext transfer) requests. This is accomplished by comparing an incoming request with a predefined list of attack signatures which may comprise at least files, file categories and IP addresses of known hackers. Action is then taken to reject any requests wherein a positive comparison is determined. Further, the web server is notified of relevant data provided in connection with any rejected request for potential future action in accordance with the severity of potential damage and frequency of rejected requests from a given requestor.

Claims

1. A method of minimizing web server inappropriate HTTP (hypertext transfer) requests, comprising the steps of:

comparing an incoming request with a predetermined list; and

refusing a response to requests for files, documents and other signatures included in said predetermined list.

2. A web server, comprising:

input means for receiving hypertext transfer requests;

a list of documents and files to be protected from export;

detection means for comparing the subject matter of hypertext transfer requests with said list; and

output means for supplying, in response to received hypertext transfer requests, only documents and files that are not part of said list.

3. A method of preventing the export from a central serving computer, serving a set of network interconnected client devices, of a predetermined set of data files, comprising the steps of:

compiling a list of data files to be protected from intrusive served network requests;

comparing received data file requests with said list; and

refusing to supply requested data files comprising a part of said list.

4. A method of rejecting unauthorized HTTP (hypertext transfer) requests, comprising the steps of:

preparing a list of files and file categories to be protected from general access;

intercepting HTTP requests directed to a web server;

comparing an incoming request with said list; and

rejecting requests for files within the scope of said list.

5. A method of determining HTTP (hypertext transfer) requests to be rejected, comprising the steps of:

comparing an incoming HTTP request with a predetermined attack signature list; and

rejecting requests for files within the scope of said list.

6. A web server, comprising:

qualifying means for initially determining inappropriateness of incoming HTTP (hypertext transfer) requests; and

means for fulfilling only those requests determined to be appropriate requests.

7. Apparatus as claimed in claim 6, wherein:

said qualifying means includes a list of signatures considered to be inappropriate for positive response; and

comparison means for comparing incoming requests with said list.

8. A method of minimizing web server inappropriate HTTP (hypertext transfer) requests, comprising the steps of:

comparing an incoming request with a predetermined list; and

refusing a response to requests related to signatures included in said predetermined list.

9. A web server, comprising:

input means for receiving hypertext transfer requests;

a list of attack signatures;

comparison means for comparing data included in said hypertext transfer requests with said list; and

output means for rejecting all received hypertext transfer requests comprising a part of said list.

10. A method of determining HTTP (hypertext transfer) requests to be rejected, comprising the steps of:

comparing an incoming HTTP request with an attack signature list; and

rejecting requests within the scope of said list.

11. A computer program product for determining whether or not a web server computer should honor a given file request, the computer program product having a medium with a computer program embodied thereon, the computer program comprising:

computer program code for intercepting incoming HTTP requests upon receipt by the web server computer;

computer program code for comparing incoming HTTP requests with a signature list; and

computer program code for rejecting any requests within the scope of said list.

13. The computer program product of claim 12, wherein the predetermined list is accessible by the computer program code and is a signature attack list.

14. The computer program product of claim 12, wherein the computer program product further comprises computer program code for intercepting incoming HTTP requests upon receipt of the request by the web server computer.

12. A computer program product for calculating whether or not a given file request to a web server computer is inappropriate, the computer program product having a medium with a computer program embodied thereon, the computer program comprising:

computer program code for comparing an incoming request with a predetermined list; and

computer program code for refusing a response to requests for files, documents and other signatures included in said predetermined list.