METHODS FOR PROACTIVELY SECURING A WEB APPLICATION AND APPARATUSES THEREOF

• US 20110214182A1
• Filed: 02/25/2011
• Published: 09/01/2011
• Est. Priority Date: 02/26/2010
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Mykonos Software, Inc. (Juniper Networks Incorporated)
• Inventors: Pinenkov, Victor, Adams, Kyle
• Granted Patent: US 8,949,988 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method, non-transitory computer readable medium, and apparatus that proactively secures a web application includes injecting one or more decoys into an executing web application. An attempt to exploit one of the one more injected decoys in the executing application is identified. At least one action to secure the executing application from the attempted exploitation is performed.

Claims

1. A method for proactively securing a web application, the method comprising:

injecting with a proactive administrative proxy server one or more decoys into an executing web application;

identifying with the proactive administrative proxy server an attempt to exploit one of the one more injected decoys in the executing application; and

performing with the proactive administrative proxy server at least one action to secure the executing application from the attempted exploitation.

2. The method as set forth in claim 1 wherein the injecting further comprises injecting with the proactive administrative proxy server the one or more decoys in real-time into the executing application.

3. The method as set forth in claim 2 wherein the one or more decoys further comprises at least one of a fake vulnerability and a trap.

4. The method as set forth in claim 1 further comprising actively monitoring with the proactive administrative proxy server the one or more injected decoys in the executing application, wherein the identifying is based on the monitoring.

5. The method as set forth in claim 4 further comprising:

collecting information with the proactive administrative proxy server about the attempted exploitation based on the monitoring;

categorizing and classifying with the proactive administrative proxy server the attempted exploitation to obtain a threat level of an attacker, wherein the performing further comprises selecting the action to secure the executing application based on the threat level.

6. The method as set forth in claim 1 wherein the at least one action comprises one or more of blocking the attempted exploitation, slowing down the application, breaking the application, sending a warning to an attacking computing device attempting the exploitation, uploading executable code to the attacking computing device to defend against the attempted exploitation.

7. The method as set forth in claim 1 wherein the at least one action comprises issuing an alert with the proactive administrative proxy server about the attempted exploitation.

8. A non-transitory computer readable medium having stored thereon instructions for proactively securing a web application comprising machine executable code which when executed by at least one processor, causes the processor to perform steps comprising:

injecting one or more decoys into an executing web application;

identifying an attempt to exploit one of the one more injected decoys in the executing application; and

performing at least one action to secure the executing application from the attempted exploitation.

9. The medium as set forth in claim 8 wherein the injecting further comprises injecting the one or more decoys in real-time into the executing application.

10. The medium as set forth in claim 9 wherein the one or more decoys further comprises at least one of a fake vulnerability and a trap.

11. The medium as set forth in claim 8 further comprising actively monitoring the one or more injected decoys in the executing application, wherein the identifying is based on the monitoring.

12. The medium as set forth in claim 11 further comprising:

collecting information about the attempted exploitation based on the monitoring;

categorizing and classifying the attempted exploitation to obtain a threat level of an attacker, wherein the performing further comprises selecting the action to secure the executing application based on the threat level.

13. The medium as set forth in claim 8 wherein the at least one action comprises one or more of blocking the attempted exploitation, slowing down the application, breaking the application, sending a warning to an attacking computing device attempting the exploitation, uploading executable code to the attacking computing device to defend against the attempted exploitation.

14. The medium as set forth in claim 8 wherein the at least one action comprises issuing an alert about the attempted exploitation.

15. A proactively secured computing apparatus comprising:

one or more processors;

a memory coupled to the one or more processors which are configured to execute programmed instructions stored in the memory comprising;

injecting one or more decoys into an executing web application;

identifying an attempt to exploit one of the one more injected decoys in the executing application; and

performing at least one action to secure the executing application from the attempted exploitation.

16. The apparatus as set forth in claim 15 wherein the one or more processors is further configured to execute programmed instructions stored in the memory for injecting further comprising injecting the one or more decoys in real-time into the executing application.

17. The apparatus as set forth in claim 16 wherein the one or more decoys further comprises at least one of a fake vulnerability and a trap.

18. The apparatus as set forth in claim 15 wherein the one or more processors is further configured to execute programmed instructions stored in the memory further comprising actively monitoring the one or more injected decoys in the executing application, wherein the identifying is based on the monitoring.

19. The apparatus as set forth in claim 18 wherein the one or more processors is further configured to execute programmed instructions stored in the memory further comprising:

collecting information about the attempted exploitation based on the monitoring;

categorizing and classifying the attempted exploitation to obtain a threat level of an attacker, wherein the performing further comprises selecting the action to secure the executing application based on the threat level.

20. The apparatus as set forth in claim 15 wherein the at least one action comprises one or more of blocking the attempted exploitation, slowing down the application, breaking the application, sending a warning to an attacking computing device attempting the exploitation, uploading executable code to the attacking computing device to defend against the attempted exploitation.

21. The apparatus as set forth in claim 15 wherein the at least one action comprises issuing an alert about the attempted exploitation.