Techniques for tracking actual users in web application security systems

• US 8,392,963 B2
• Filed: 11/27/2006
• Issued: 03/05/2013
• Est. Priority Date: 11/28/2005
• Status: Active Grant

• Current Assignee: Imperva Incorporated (Thales SA)
• Original Assignee: Imperva Incorporated (Thales SA)
• Inventors: Shulman, Amichai, Shatz, Gur, Ryterski, Tal
• Primary Examiner(s): Powers, William
• Assistant Examiner(s): SHAIFER HARRIMAN, DANT B
• Application Number:
  US11/563,589
• Publication Number:
  US 20070124806A1
• Time in Patent Office: 2,290 Days
• Field of Search: 726/2
• US Class Current: 726/2
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method for tracking and identifying an identity of a user accessing a web application. An application normal behavior profile (NBP), wherein said NBP includes a plurality of authentication identifiers of the web application is generated. It is determined using the NBP whether an authentication request submitted by the user was successful. A first actionable data on a successful authentication request is saved. A second actionable data on an unsuccessful authentication request is saved.

Claims

1. A method for tracking and identifying an identity of a user using a client to access a web application on a protected server, the method comprising:

monitoring, by a secure gateway on a device, client requests for the web application sent from a client to the protected sever, and replies to those client requests sent from the protected server to the client;

identifying candidate authentication forms in the replies to the client requests sent from the protected server to the client;

determining which of the candidate authentication forms in those replies are authentication forms;

generating a normal behavior profile (NBP) for the web application, wherein said NBP includes authentication form identifiers corresponding to those of the candidate authentication forms determined to be the authentication forms;

monitoring, by the secure gateway using the authentication form identifiers, login requests sent from the client to the protected server, and login responses sent from the protected server to the client in response to the login requests;

identifying, for each of the authentication form identifiers in the NBP, a combination of login indications and corresponding values in the login responses that indicates a successful login request;

generating an updated NBP by adding to the NBP, for each of the authentication form identifiers in the NBP, the combination of login indications and corresponding values identified to be indicating a successful login request;

determining by the secure gateway using the updated NBP whether a subsequent login request submitted by the user was successful;

saving a first actionable data if the subsequent login request is determined to be successful, wherein the first actionable data comprises user identifiers associated with the user for tracking the user across a plurality of sessions; and

saving a second actionable data if the subsequent login request is determined to be unsuccessful.

2. The method of claim 1, further comprising:

attaching a corresponding user identification to each subsequent login request submitted by the user.

3. The method of claim 1, wherein the updated NBP further includes, for each of the authentication form identifiers in the NBP, a combination of login indications and corresponding values indicating an unsuccessful login request.

4. The method of claim 1, wherein the authentication forms are hypertext markup language (HTML) forms.

5. The method of claim 1, wherein the combination of login indications comprises at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

6. The method of claim 1, wherein the determining which of the candidate authentication forms are authentication forms includes:

counting a number of occurrences of each of the candidate authentication forms during a predefined time interval; and

determining that the candidate authentication forms are in fact authentication forms if the corresponding number of occurrences exceeds a predefined threshold.

7. The method of claim 6, wherein the candidate authentication forms are identified by identifier parameters comprising at least one of:

an input field of type password, and an input field of type text.

8. The method of claim 1, wherein the identifying combination of login indications and corresponding values that indicates a successful login request includes:

counting a number of observations of each combination of login indications and corresponding values during a predefined time interval;

determining a combination of login indications and corresponding values indicates a successful login request if a corresponding number of observations exceeds a predefined threshold; and

determining a combination of login indications and corresponding values indicates an unsuccessful login request if a the corresponding number of observations is below the predefined threshold.

9. The method of claim 1, wherein the determining whether the subsequent login request was successful includes:

extracting from a login response associated with the subsequent login request, a combination of login indications and corresponding values in that login response; and

determining that the subsequent login request was successful if the extracted combination exist in the updated NBP.

10. The method of claim 1, wherein the first actionable data comprises at least one of:

a user identification, a session identification, a user name, an internet protocol address, and actions performed by the user.

11. The method of claim 1, wherein the second actionable data comprises at least one of:

a session identification, a user identification, and an internet protocol address associated with the user.

12. The method of claim 11, wherein the second actionable data is utilized for detecting brute force attacks.

13. A computer program product including a non-transitory computer-readable storage medium comprising instructions, said instructions when executed on a computer enables the computer to implement a method to track and identify identity of a user using a client to access a web application on a protected server, the method comprising:

monitoring client requests for the web application sent from a client to the protected sever, and replies to those client requests sent from the protected server to the client;

identifying candidate authentication forms in the replies to the client requests sent from the protected server to the client;

determining which of the candidate authentication forms in those replies are authentication forms;

generating a normal behavior profile (NBP) associated with the web application, wherein said NBP includes authentication form identifiers corresponding to those of the candidate authentication forms determined to be the authentication forms;

monitoring, using the authentication form identifiers, login requests sent from the client to the protected server, and login responses with login indications sent from the protected server to the client in response to the login requests;

identifying, for each of the authentication form identifiers in the NBP, a combination of login indications and corresponding values in the login responses that indicates a successful login request;

generating an updated NBP by adding to the NBP, for each of the authentication form identifiers in the NBP, the combination of login indications and corresponding values identified to be indicating a successful login request;

determining, using the updated NBP, whether a subsequent login request submitted by the user was successful;

saving a first actionable data if the subsequent login request is determined to be successful; and

saving a second actionable data if the subsequent login request is determined to be unsuccessful.

14. The computer program product of claim 13, wherein the implemented method further comprises:

attaching a corresponding user identification to each subsequent login request submitted by the user.

15. The computer program product of claim 13, wherein the updated NBP further includes, for each of the authentication form identifiers in the NBP, a combination of login indications and corresponding values indicating an unsuccessful login request.

16. The computer program product of claim 13, wherein the authentication forms are hypertext markup language (HTML) forms.

17. The computer program product of claim 13, wherein the combination of login indications comprises at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

18. The computer program product claim 13, wherein the determining which of the candidate authentication forms are authentication forms includes:

counting a number of occurrences of each of the candidate authentication forms during a predefined time interval; and

determining that the candidate authentication forms are in fact authentication forms if the corresponding number of occurrences exceeds a predefined threshold.

19. The computer program product of claim 18, wherein the candidate authentication forms are identified by identifier parameters comprising at least one of:

an input field of type password, and an input field of type text.

20. The computer program product of claim 13, wherein the identifying the combination of login indications and corresponding values that indicates a successful login request includes:

counting a number of observations of each combination of login indications and corresponding values during a predefined time interval;

determining a combination of login indications and corresponding values indicates a successful login request if a corresponding number of observations exceeds a predefined threshold; and

determining a combination of login indications and corresponding values indicates an unsuccessful login request if a the corresponding number of observations is below the predefined threshold.

21. The computer program product of claim 13, wherein the determining whether the subsequent login request was successful includes:

extracting from a login response associated with the subsequent login request, a combination of login indications and corresponding values in that login response; and

determining that the subsequent login request was successful if the extracted combination exist in the updated NBP.

22. The computer program product of claim 13, wherein the first actionable data comprises at least one of:

a user identification, a session identification, a user name, an internet protocol address, and actions performed by the user.

23. The computer program product of claim 22, wherein the first actionable data is utilized to track the user across a plurality of sessions.

24. The computer program product of claim 13, wherein the second actionable data comprises at least one of:

a session identification, a user identification, and an IP address associated with the user.

25. The computer program product of claim 24, wherein the second actionable data is utilized for detecting brute force attacks.

26. A security system having user awareness capabilities for tracking and identifying the identity of users accessing a web application on a protected server, the system comprises:

a secure server coupled to a secure gateway and operable to generate an application normal behavior profile (NBP) that includes;

authentication form identifiers of the web application, wherein the authentication form identifiers corresponds to those of candidate authentication forms, that are in replies sent from the protected server to a client in response to client requests for the web application, determined to be actual authentication forms; and

for each of the authentication form identifiers, a combination of login indications and corresponding values indicating a successful login request, wherein the login indications are in login responses sent from the protected server to the client in response to the login requests associated with the authentication forms; and

at least one secure gateway installed in a line of traffic between a client and a web server and operable to determine using the application NBP whether a login request from the client was successful.

27. The security system of claim 26, wherein the login request is submitted by a user.

28. The security system of claim 27, wherein the secure gateway is further operable to save first actionable data on a successful login request and further operable to save second actionable data on an unsuccessful login request and labeling each login request with an identity of the actual user.

29. The security system of claim 27, wherein to determine whether the login request was successful, the system is operable to extract values of a combination of login indications and corresponding values from a login response associated with the login request;

and further operable to determine that the login request was successful if the extracted combination exist in the application NBP.

30. The security system of claim 28, wherein the first actionable data comprises at least one of:

a user identification, a session identification, a user name, an internet protocol address, and actions performed by the user.

31. The security system of claim 30, wherein the first actionable data actionable data is utilized to track users across a plurality of sessions.

32. The security system of claim 28, wherein the second actionable data comprises at least one of:

a session identification, a user identification, and an internet protocol address associated with the user.

33. The security system of claim 32, wherein the second actionable data is utilized for detecting brute force attacks.

34. A method for tracking and identifying an identity of a user using a client to access a web application on a protected server, the method comprising:

receiving an application normal behavior profile (NBP) of the web application at a secure gateway on a device, wherein the application NBP includes;

authentication form identifiers corresponding to authentication forms that have been in replies sent from the protected server to a client in response to client requests for the web application; and

for each of the authentication form identifiers, a successful login pattern that includes a combination of login indications and corresponding values indicating a successful login request, wherein the successful login pattern was sent in login responses from the protected server to the client in response to the login requests that include the authentication forms with user entered information and that have been successfully authenticated;

determining by the secure gateway using the application NBP whether a subsequent login request submitted by the user was successful; and

storing a first actionable data if the subsequent login request was successful, wherein the first actionable data comprises user identifiers associated with the user to track the user across a plurality of sessions.

35. The method of claim 34, wherein the application NBP further includes, for each of the authentication form identifiers in the application NBP, at least one combination of login indications and corresponding values indicating an unsuccessful login request.

36. The method of claim 34, wherein the authentication forms are hypertext markup language (HTML) forms.

37. The method of claim 34, wherein the combination of login indications comprises at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

38. The method of claim 34, wherein the determining whether the subsequent login request was successful includes:

extracting, from a login response associated with the subsequent login request, a combination of login indications and corresponding values in that login response; and

determining that the subsequent login request is successful if the extracted combination matches one of the successful login indications in the application NBP.

39. The method of claim 34, wherein the first actionable data comprises at least one of:

a user identification, a session identification, a user name, an internet protocol address, and actions performed by the user.

40. The method of claim 34, further comprising:

storing a second actionable data if the subsequent login request is unsuccessful.

41. The method of claim 40, wherein the second actionable data comprises at least one of:

a session identification, a user identification, and an internet protocol address associated with the user.

42. The method of claim 40, wherein the second actionable data is utilized for detecting brute force attacks.

43. A computer program product including a non-transitory computer-readable storage medium comprising instructions, said instructions when executed on a computer enables the computer to implement a method to track and identify identity of a user using a client to access a web application on a protected server, the method comprising:

receiving an application normal behavior profile (NBP) of the web application at a secure gateway on a device, wherein the application NBP includes;

authentication form identifiers corresponding to authentication forms that have been in replies sent from the protected server to a client in response to client requests for the web application; and

for each of the authentication form identifiers, a successful login pattern that includes a combination of login indications and corresponding values indicating a successful login request, wherein the successful login pattern was sent in login responses from the protected server to the client in response to the login requests that include the authentication forms with user entered information and that have been successfully authenticated;

determining by the secure gateway using the application NBP whether a subsequent login request submitted by the user was successful; and

storing a first actionable data if the subsequent login request was successful, wherein the first actionable data comprises user identifiers associated with the user to track the user across a plurality of sessions.

44. The computer program product of claim 43, wherein the application NBP further includes, for each of the authentication form identifiers in the application NBP, at least one combination of login indications and corresponding values indicating an unsuccessful login request.

45. The computer program product of claim 43, wherein the authentication forms are hypertext markup language (HTML) forms.

46. The computer program product of claim 43, wherein the combination of login indications comprises at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

47. The computer program product of claim 43, wherein the determining whether the subsequent login request was successful includes:

extracting, from a login response associated with the subsequent login request, a combination of login indications and corresponding values in that login response; and

determining that the subsequent login request is successful if the extracted combination matches one of the successful login indications in the application NBP.

48. The computer program product of claim 43, wherein the first actionable data comprises at least one of:

a user identification, a session identification, a user name, an internet protocol address, and actions performed by the user.

49. The computer program product of claim 43, wherein the implemented method further comprising:

storing a second actionable data if the subsequent login request is unsuccessful.

50. The computer program product of claim 49, wherein the second actionable data comprises at least one of:

a session identification, a user identification, and an internet protocol address associated with the user.

51. The computer program product of claim 49, wherein the second actionable data is utilized for detecting brute force attacks.

52. A method in a system coupled between a protected server and a client for tracking successful logins to the protected server by a user using the client, the method comprising:

automatically learning an authentication form by inspecting replies being sent from the protected server to the client, wherein the protected server sends the authentication form to the client as part of an authentication service to allow the user to log on to the protected server;

automatically learning, using the learnt authentication form, a combination of login indications and values for those login indications that indicates a successful login, wherein the automatically learning the combination of login indications and the values includes;

monitoring login responses being sent from the protected server to the client, wherein the login responses are those responses sent by the protected server to the client in reply to login requests that include the learnt authentication form with user entered information and that are sent from the client to the protected server;

generating an application normal behavior profile (NBP) that includes, for the learnt authentication form, the combination of login indications and the values of those login indications determined to indicate the successful login; and

determining by a secure gateway on a device of the system using the application NBP whether a subsequent login request was successful by using the application NBP and respective login response to that subsequent login request.

53. The method of claim 52, wherein the automatically learning the combination of login indications and the values also includes automatically learning combination of login indications and their values in login responses that indicates a failed login.

54. The method of claim 52, wherein the combination of login indications comprises at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

55. The method of claim 52, wherein the monitoring login responses includes:

counting a number of observations of each of a plurality of combinations of login indications and corresponding values during a predefined time interval; and

determining that at least one of the combinations of login indications and corresponding values indicates a successful login if the corresponding number of observations exceeds a predefined threshold.

56. The method of claim 52, wherein the automatically learning an authentication form includes:

identifying candidate authentication forms in the replies being sent from the protected server to the client;

counting a number of occurrences of each of the candidate authentication forms identified; and

determining that at least one of the candidate authentication forms is in fact an authentication form if the number of occurrences exceeds a predefined threshold.

57. The method of claim 56, wherein the candidate authentication forms are identified by identifier parameters comprising at least one of:

an input field of type password, and an input field of type text.

58. A computer program product including a non-transitory computer-readable storage medium comprising instructions, said instructions when executed on a computer enables the computer to implement a method for tracking successful logins to a protected server by a user using a client, the method comprising:

automatically learning an authentication form by inspecting replies being sent from the protected server to the client, wherein the protected server sends the authentication form to the client as part of an authentication service to allow the user to log on to the protected server;

automatically learning, using the learnt authentication form, a combination of login indications and values for those login indications that indicates a successful login, wherein the automatically learning the combination of login indications and the values includes;

monitoring login responses being sent from the protected server to the client, wherein the login responses are those responses sent by the protected server to the client in reply to login requests that include the learnt authentication form with user entered information and that are sent from the client to the protected server;

generating an application normal behavior profile (NBP) that includes, for the learnt authentication form, the combination of login indications and the values of those login indications determined to indicate the successful login; and

determining by a secure gateway on a device of the system using the application NBP whether a subsequent login request was successful by using the application NBP and respective login response to that subsequent login request.

59. The computer program product of claim 58, wherein the automatically learning the combination of login indications and the values also includes automatically learning combination of login indications and their values in login responses that indicates a failed login.

60. The computer program product of claim 58, wherein the combination of login indications comprises at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

61. The computer program product of claim 58, wherein automatically learning the combination of login indications and the values includes:

counting a number of observations of each of a plurality of combinations of login indications and corresponding values during a predefined time interval; and

determining that at least one of the combinations of login indications and corresponding values indicates a successful login if the corresponding number of observations exceeds a predefined threshold.

62. The computer program product of claim 58, wherein the automatically learning an authentication form includes:

identifying candidate authentication forms in the replies being sent from the protected server to the client;

counting a number of occurrences of each of the candidate authentication forms identified; and

determining that at least one of the candidate authentication forms is in fact an authentication form if the number of occurrences exceeds a predefined threshold.

63. The computer program product of claim 62, wherein the candidate authentication forms are identified by identifier parameters comprising at least one of:

an input field of type password, and an input field of type text.

64. A method in a system coupled between a protected server and clients for tracking successful logins to the protected server by users using the clients, the method comprising:

automatically learning authentication forms by monitoring replies being sent from the protected server to the clients for identifier parameters indicative of authentication forms, wherein the protected server sends such authentication forms to the clients as part of an authentication service to allow the users to log on to the protected server;

automatically learning, for the learnt authentication forms, login patterns that when present in login responses being sent from the protected server to the client indicate successful logins, the automatically learning the login patterns includes,

identifying login attempts, sent from the clients to the protected server, in the form of login requests that include the learnt authentication forms with user entered information;

monitoring, by a secure gateway on a device of the system, the login responses sent from the protected server to the clients that are in reply to the identified login attempts; and

determining which combinations of login indications and their values in the login responses are the login patterns of successful logins;

generating, by a secure server, an application normal behavior profile (NBP) that represents, for the learnt authentication forms, the login patterns of successful logins; and

determining by the secure gateway whether a subsequent login request was successful by using the application NBP and respective login response to that subsequent login request.

65. The method of claim 64, wherein the automatically learning the login patterns also includes determining which combinations of login indications and their values in the login responses are login patterns of failed logins.

66. The method of claim 64, wherein the combination of login indications comprises at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

67. The method of claim 64, wherein the determining which combinations of login indications and their values includes:

counting a number of observations of each of the combinations and their values during a predefined time interval; and

determining that those of the combinations of login indications and their values whose corresponding number of observations exceeds a predefined threshold are the login patterns of successful logins.

68. The method of claim 64, wherein the automatically learning authentication forms includes:

identifying candidate authentication forms in the replies being sent from the protected server to the client;

counting a number of occurrences of each of the candidate authentication forms identified; and

determining that at least one of the candidate authentication forms is in fact an authentication form if the number of occurrences exceeds a predefined threshold.

69. The method of claim 68, wherein the identifier parameter comprises at least one of:

an input field of type password, and an input field of type text.

70. A computer program product including a non-transitory computer-readable storage medium comprising instructions, said instructions when executed in a system enables a method for tracking successful logins to a protected server by users using clients, the method comprising:

automatically learning authentication forms by monitoring replies being sent from the protected server to the clients for identifier parameters indicative of authentication forms, wherein the protected server sends such authentication forms to the clients as part of an authentication service to allow the users to log on to the protected server;

automatically learning, for the learnt authentication forms, login patterns that when present in login responses being sent from the protected server to the client indicate successful logins, the automatically learning the login patterns includes,

identifying login attempts, sent from the clients to the protected server, in the form of login requests that include the learnt authentication forms with user entered information;

monitoring, by a security gateway on a device of the system, the login responses sent from the protected server to the clients that are in reply to the identified login attempts; and

determining which combinations of login indications and their values in the login responses are the login patterns of successful logins;

generating, by a secure server, an application normal behavior profile (NBP) that represents, for the learnt authentication forms, the login patterns of successful logins; and

determining by the secure gateway whether a subsequent login request was successful by using the application NBP and respective login response to that subsequent login request.

71. The computer program product of claim 70, wherein the automatically learning the login patterns also includes determining which combinations of login indications and their values in the login responses are login patterns of failed logins.

72. The computer program product of claim 70, wherein the combination of login indications comprises at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

73. The computer program product of claim 70, wherein the determining which combinations of login indications and their values includes:

counting a number of observations of each of the combinations and their values during a predefined time interval; and

determining that those of the combinations of login indications and their values whose corresponding number of observations exceeds a predefined threshold are the login patterns of successful logins.

74. The computer program product of claim 70, wherein the automatically learning authentication forms includes:

identifying candidate authentication forms in the replies being sent from the protected server to the client;

counting a number of occurrences of each of the candidate authentication forms identified; and

determining that those of the candidate authentication forms whose corresponding number of occurrences exceeds a predefined threshold is in fact authentication forms.

75. The computer program product of claim 74, wherein the identifier parameter comprises at least one of:

an input field of type password, and an input field of type text.

76. A system, coupled between a protected server and clients, having user awareness capabilities for tracking, across a plurality of sessions, successful logins to the protected server by users using the clients, the system comprises:

a secure gateway installed in a line of traffic between the client and the protected server and to;

inspect, as part of an automatic process for learning an authentication form used as part of an authentication service to allow the users to log on to the protected server, for occurrences of the authentication form in replies being sent from the protected server to the clients;

monitor, as part of an automatic process for learning a login pattern indicative of a successful login, for observations of the login patterns in login responses being sent from the protected server to the clients, wherein the login responses are in those responses sent by the protected server to the clients in reply to login attempts being sent from the clients to the protected server that include the authentication form with user entered information;

a secure server coupled to the secure gateway and to automatically generate an application NBP that represents the login pattern of the successful login for the authentication form; and

the secure gateway is also to determine whether a subsequent login request was successful by using the application NBP and respective login response to that subsequent login request.

77. The system of claim 76, wherein the authentication form is a hypertext markup language (HTML) form.

78. The system of claim 76, wherein the authentication form is learned if the number of occurrences of that authentication exceeds a predefined threshold.

79. The system of claim 76, wherein the login pattern includes a combination of login indications and their values, the login indications being at least one of:

a response code, existence of redirect directives, and a target URL of redirect directives.

80. The system of claim 76, wherein the login pattern of successful logins is learned if the number of observations of that login pattern exceeds a predefined threshold.

81. The system of claim 80, wherein the login responses are also monitored for learning login patterns of failed logins, and each of the login patterns of failed logins are learned if a corresponding number of observations of that login pattern being sent in login responses from the protected server to the clients are below the predefined threshold.