Dynamic learning method and adaptive normal behavior profile (NBP) architecture for providing fast protection of enterprise applications

• US 8,713,682 B2
• Filed: 06/14/2010
• Issued: 04/29/2014
• Est. Priority Date: 12/02/2003
• Status: Active Grant

• Current Assignee: Imperva Incorporated (Thales SA)
• Original Assignee: Imperva Incorporated (Thales SA)
• Inventors: Boodaei, Michael, Kramer, Shlomo, Shulman, Amichai
• Primary Examiner(s): Paliwal, Yogesh
• Application Number:
  US12/814,753
• Publication Number:
  US 20100251377A1
• Time in Patent Office: 1,415 Days
• Field of Search: 726/25, 726/1, 726/2
• US Class Current: 726/25
• CPC Class Codes: G06F 16/217 Database tuning G06F16/2282 takes precedence; database performance monitoring G06F11/3409
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An adaptive normal behavior profile (NBP) architecture for providing fast protection of enterprise applications are disclosed. The adaptive NBP architecture includes a plurality of profile items. Each profile item includes a plurality of profile properties holding the descriptive values of the respective item. An application-level security system can identify and prevent attacks targeted at enterprise applications by matching application events against at least a single profile item in the adaptive NBP.

Claims

1. A method performed by network sensors and a secure server for protection of applications residing on servers of a secured system, wherein the method comprises:

entering a learn mode of the secured system;

collecting, by the network sensors, application events by one or more of analyzing network level protocol attributes to reconstruct application requests and polling information about recent application events from the servers on which the applications reside;

analyzing the application events;

generating a normal behavior profile (NBP) based on the analysis of the application events, wherein the NBP comprises at least a plurality of profile items and each of the plurality profile items comprises a profile property;

performing in the secure server analysis on the NBP, wherein the analysis comprises;

computing a percentage of learning progress for each profile item out of the total number of the application events received over a predefined time; and

determining the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold; and

exiting the learn mode and entering a protect mode for the secured system for at least the profile items determined to be stable.

2. The method of claim 1, wherein the method further comprises distributing at least the stable profile items of the NBP to the network sensors coupled to at least one protected device.

3. The method of claim 2, wherein the applications reside in the protected device.

4. The method of claim 3, wherein the protected device is at least one of a web server and a database server.

5. The method of claim 1, wherein each of the network sensors is at least one of a structured query language (SQL) sensor and a hypertext transfer protocol (HTTP) sensor.

6. The method of claim 1, wherein the NBP is a hierarchic data structure.

7. The method of claim 6, wherein each of the profile properties comprises a descriptive value of its corresponding profile item.

8. The method of claim 1, wherein one of the profile properties for each of the profile items comprises at least a current state of the profile property, wherein the current state is one of a learn state and an enforceable state.

9. The method of claim 1, wherein one of the profile properties for each of the profile items comprises at least a current state of the profile property, wherein possible states for the current state include a learn state, an enforceable state, and a non-enforceable state.

10. The method of claim 1, wherein the profile item comprises at least one of a current state of the profile item and a distinguishable name.

11. The method of claim 10, wherein the current state is at least one of a learn state, a protect state, a deleted state, a decayed state and a merged state.

12. The method of claim 1, wherein the NBP represents at least one of a HTTP profile and a SQL profile.

13. The method of claim 1, wherein analyzing the application events further comprises:

performing a lexical analysis; and

performing a syntax analysis.

14. The method of claim 13, wherein performing the lexical analysis comprises:

breaking each of the plurality of application events into tokens; and

creating a representation of the application event using the tokens'"'"' properties.

15. The method of claim 13, wherein performing the syntax analysis comprises:

breaking each of the application events into functional units; and

classifying the functional units as identification units and property units.

16. The method of claim 15, wherein the identification units are used for identifying the application events.

17. The method of claim 15, wherein the property units describe the properties of the application events.

18. The method of claim 15, wherein generating the NBP further comprises:

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

19. The method of claim 1, wherein the NBP is an adaptive NBP that is automatically updated while the system is operating in the protect mode.

20. The method of claim 1, wherein the application requests include HTTP requests.

21. The method of claim 1, wherein the network sensors are placed on each network segment that is coupled to the secured servers the applications reside on.

22. The method of claim 1, wherein at least one of the network sensors sniffs traffic.

23. The method of claim 1, wherein at least one of the network sensors operates in the line of traffic.

24. The method of claim 1, further comprising:

collecting, by one of the network sensors, an additional application event;

identifying the additional application event as a potential attack based on comparison to only the parts of the NBP determined to be stable.

25. The method of claim 1, wherein the exiting the learn mode and entering the protect mode includes changing a current state of only the profile items determined to be stable to a PROTECT state.

26. The method of claim 1, wherein the exiting the learn mode and entering the protect mode includes distributing at least the profile items determined to be stable to at least one of the network sensors and protecting the applications using only the stable items of the NBP.

27. The method of claim 1, wherein the exiting occurs on a per profile item basis and includes automatically distributing to the network sensors the stable profile items when they are determined to be stable.

28. The method of claim 1, wherein the profile items include a URL item and a parameter item, and wherein the profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

29. The method of claim 28, wherein at least one of the applications is a web application, and the URL item describes a single URL within that web application.

30. The method of claim 29, wherein the parameter item describes a list of parameters of HTTP requests submitted to a web server.

31. The method of claim 28, wherein the profile items also comprise at least a web application item, a virtual folder item, and a cookie item, wherein the web application item describes a single web application in the web server group, wherein the virtual folder item defines a virtual folder within the web application, and the cookie item comprises cookies for the web application.

32. The method of claim 1, wherein the profile items include one or more of a table access item and a query item, wherein the table access item has profile properties that define the enforcement mode for each type of query, and wherein a query item defines an SQL query and has a profile property that holds the SQL query.

33. The method of claim 32, wherein the table access item defines the access profile of database clients to a database table.

34. The method of claim 32, wherein the types of queries include select, update, delete, and insert.

35. The method of claim 32, wherein the query item'"'"'s distinguished name is the normalized text of the query.

36. The method of claim 32, wherein the profile items also comprise a source group item that defines a homogeneous group of database clients having access to database servers.

37. The method of claim 1, wherein:

the analyzing the application events comprises;

performing syntax analysis to generate functional units; and

classifying the functional units as identification units and property units, wherein the identification units are used for identifying the application events, and wherein the property units describe the property of the application events; and

the generating the NBP comprises;

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

38. A non-transitory, tangible computer-readable media which has stored in it instructions, which when executed by a secure server of a secured system for protection of applications, cause the secure server to perform the steps of:

entering a learn mode;

generating a normal behavior profile (NBP) based on an analysis of application events collected by network sensors that one or more of analyze network level protocol attributes to reconstruct application requests and poll information about recent application events from servers, wherein the NBP comprises at least a plurality of profile items and each of the plurality profile items comprises a profile property;

performing analysis on the NBP, wherein the analysis comprises;

computing a percentage of learning progress for each profile item out of the total number of the application events received over a predefined time; and

determining the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold; and

exiting the learn mode and entering a protect mode for at least the profile items determined to be stable.

39. The computer-readable media of claim 38, wherein the instructions further cause the secure server to perform the step of:

distributing at least the stable profile items of the NBP to the network sensors coupled to at least one protected device.

40. The computer-readable media of claim 39, wherein the applications reside in the protected device.

41. The computer-readable media of claim 40, wherein the protected device is at least one of a web server and a database server.

42. The computer-readable media of claim 38, wherein each of the network sensors is at least one of a structured query language (SQL) sensor and a hypertext transfer protocol (HTTP) sensor.

43. The computer-readable media of claim 38, wherein the NBP is a hierarchic data structure.

44. The computer-readable media of claim 43, wherein each of the profile properties comprises a descriptive value of its corresponding profile item.

45. The computer-readable media of claim 38, wherein one of the profile properties for each of the profile items comprises at least a current state of the profile property, wherein the current state is one of a learn state and an enforceable state.

46. The computer-readable media of claim 38, wherein one of the profile properties for each of the profile items comprises at least a current state of the profile property, wherein possible states for the current state include a learn state, an enforceable state, and a non-enforceable state.

47. The computer-readable media of claim 38, wherein the profile item comprises at least one of a current state of the profile item and a distinguishable name.

48. The computer-readable media of claim 47, wherein the current state is at least one of a learn state, a protect state, a deleted state, a decayed state and a merged state.

49. The computer-readable media of claim 38, wherein the NBP represents at least one of a HTTP profile and a SQL profile.

50. The computer-readable media of claim 38, wherein the analysis of the application events includes a lexical analysis and a syntax analysis.

51. The computer-readable media of claim 50, wherein the lexical analysis comprises:

breaking each of the plurality of application events into tokens; and

creating a representation of the application event using the tokens'"'"' properties.

52. The computer-readable media of claim 50, wherein the syntax analysis comprises:

breaking each of the application events into functional units; and

classifying the functional units as identification units and property units.

53. The computer-readable media of claim 52, wherein the identification units are used for identifying the application events.

54. The computer-readable media of claim 52, wherein the property units describe the properties of the application events.

55. The computer-readable media of claim 52, wherein generating the NBP further comprises:

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

56. The computer-readable media of claim 38, wherein the NBP is an adaptive NBP that is automatically updated while the system is operating in the protect mode.

57. The computer-readable media of claim 38, wherein the application requests include HTTP requests.

58. The computer-readable media of claim 38, wherein the network sensors are placed on each network segment that is coupled to the secured servers the applications reside on.

59. The computer-readable media of claim 38, wherein at least one of the network sensors sniffs traffic.

60. The computer-readable media of claim 38, wherein at least one of the network sensors operates in the line of traffic.

61. The computer-readable media of claim 38, further comprising:

receiving an irregular event from one of the network sensors that identified an additional application event as a potential attack based on comparison to only the parts of the NBP determined to be stable.

62. The computer-readable media of claim 38, wherein the exiting the learn mode and entering the protect mode includes changing a current state of only the profile items determined to be stable to a protect state.

63. The computer-readable media of claim 38, wherein the exiting the learn mode and entering the protect mode includes distributing at least the profile items determined to be stable to at least one of the network sensors and protecting the applications using only the stable items of the NBP.

64. The computer-readable media of claim 38, wherein the exiting occurs on a per profile item basis and includes automatically distributing to the network sensors the stable profile items when they are determined to be stable.

65. The computer-readable media of claim 38, wherein the profile items include a URL item and a parameter item, and wherein the profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

66. The computer-readable media of claim 65, wherein at least one of the applications is a web application, and the URL item describes a single URL within that web application.

67. The computer-readable media of claim 66, wherein the parameter item describes a list of parameters of HTTP requests submitted to a web server.

68. The computer-readable media of claim 65, wherein the profile items also comprise at least a web application item, a virtual folder item, and a cookie item, wherein the web application item describes a single web application in the web server group, wherein the virtual folder item defines a virtual folder within the web application, and the cookie item comprises cookies for the web application.

69. The computer-readable media of claim 38, wherein the profile items include one or more of a table access item and a query item, wherein the table access item has profile properties that define the enforcement mode for each type of query, and wherein a query item defines an SQL query and has a profile property that holds the SQL query.

70. The computer-readable media of claim 69, wherein the table access item defines the access profile of database clients to a database table.

71. The computer-readable media of claim 69, wherein the types of queries include select, update, delete, and insert.

72. The computer-readable media of claim 69, wherein the query item'"'"'s distinguished name is the normalized text of the query.

73. The computer-readable media of claim 69, wherein the profile items also comprise a source group item that defines a homogeneous group of database clients having access to database servers.

74. The computer-readable media of claim 38, wherein:

the analysis of the application events includes;

a syntax analysis to generate functional units; and

a classification of the functional units as identification units and property units, wherein the identification units are used for identifying the application events, and wherein the property units describe the property of the application events; and

the generating the NBP comprises;

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

75. A method performed by network sensors and a secure server for protection of an application of a secured system, wherein the application resides on a server, wherein the method comprises:

entering a learn mode of the secured system;

collecting application events gathered and reconstructed by the network sensors of the secured system analyzing network level protocol attributes;

analyzing the application events;

generating a normal behavior profile (NBP) based on the analysis of the application events, wherein the NBP comprises at least a plurality of profile items and each of the plurality profile items comprises a profile property;

performing in the secure server analysis on the NBP, wherein the analysis comprises;

computing a percentage of learning progress for each profile item out of the total number of the application events received over a predefined time; and

determining the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold; and

exiting the learn mode and entering a protect mode for the secured system for at least the profile items determined to be stable.

76. The method of claim 75, wherein the method further comprises distributing at least the stable profile items of the NBP to the network sensors.

77. The method of claim 75, wherein the server is a web server.

78. The method of claim 75, wherein each of the network sensors is a hypertext transfer protocol (HTTP) sensor.

79. The method of claim 75, wherein the NBP is a hierarchic data structure.

80. The method of claim 79, wherein each of the profile properties comprises a descriptive value of its corresponding profile item.

81. The method of claim 75, wherein one of the profile properties for each of the profile items comprises at least a current state of the profile property, wherein the current state is one of a learn state and an enforceable state.

82. The method of claim 75, wherein one of the profile properties for each of the profile items comprises at least a current state of the profile property, wherein possible states for the current state include a learn state, an enforceable state, and a non-enforceable state.

83. The method of claim 75, wherein the profile item comprises at least one of a current state of the profile item and a distinguishable name.

84. The method of claim 83, wherein the current state is at least one of a learn state, a protect state, a deleted state, a decayed state and a merged state.

85. The method of claim 75, wherein the NBP represents a HTTP profile.

86. The method of claim 75, wherein analyzing the application events further comprises performing a syntax analysis.

87. The method of claim 86, wherein performing the syntax analysis comprises:

breaking each of the application events into functional units; and

classifying the functional units as identification units and property units.

88. The method of claim 87, wherein the identification units are used for identifying the application events.

89. The method of claim 87, wherein the property units describe the properties of the application events.

90. The method of claim 87, wherein generating the NBP further comprises:

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

91. The method of claim 75, wherein the NBP is an adaptive NBP that is automatically updated while the system is operating in the protect mode.

92. The method of claim 75, wherein the application requests include HTTP requests.

93. The method of claim 75, wherein the network sensors are placed on each network segment that is coupled to the server the application resides on.

94. The method of claim 75, wherein at least one of the network sensors sniffs traffic.

95. The method of claim 75, wherein at least one of the network sensors operates in the line of traffic.

96. The method of claim 75, further comprising:

collecting, by one of the network sensors, an additional application event;

identifying the additional application event as a potential attack based on comparison to only the parts of the NBP determined to be stable.

97. The method of claim 75, wherein the exiting the learn mode and entering the protect mode includes changing a current state of only the profile items determined to be stable to a protect state.

98. The method of claim 75, wherein the exiting the learn mode and entering the protect mode includes distributing at least the profile items determined to be stable to at least one of the network sensors and protecting the application using only the stable items of the NBP.

99. The method of claim 75, wherein the exiting occurs on a per profile item basis and includes automatically distributing to the network sensors the stable profile items when they are determined to be stable.

100. The method of claim 75, wherein the profile items include a URL item and a parameter item, and wherein the profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

101. The method of claim 100, wherein the application is a web application, and the URL item describes a single URL within that web application.

102. The method of claim 101, wherein the parameter item describes a list of parameters of HTTP requests submitted to a web server.

103. The method of claim 100, wherein the profile items also comprise at least a web application item, a virtual folder item, and a cookie item, wherein the web application item describes a single web application in the web server group, wherein the virtual folder item defines a virtual folder within the web application, and the cookie item comprises cookies for the web application.

104. The method of claim 75, wherein:

the analyzing the application events comprises;

performing syntax analysis to generate functional units; and

classifying the functional units as identification units and property units, wherein the identification units are used for identifying the application events, and wherein the property units describe the property of the application events; and

the generating the NBP comprises;

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

105. A non-transitory, tangible computer-readable media which has stored in it instructions, which when executed by a secure server of a secured system for protection of an application, cause the secure server to perform the steps of:

entering a learn mode;

generating a normal behavior profile (NBP) based on an analysis of application events gathered and reconstructed by network sensors of the secured system analyzing network level protocol attributes, wherein the NBP comprises at least a plurality of profile items and each of the plurality profile items comprises a profile property;

performing analysis on the NBP, wherein the analysis comprises;

computing a percentage of learning progress for each profile item out of the total number of the application events received over a predefined time; and

determining the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold; and

exiting the learn mode and entering a protect mode for at least the profile items determined to be stable.

106. The computer-readable media of claim 105, wherein the instructions further cause the secure server to perform the step of distributing at least the stable profile items of the NBP to the network sensors.

107. The computer-readable media of claim 105, wherein the application is on a web server.

108. The computer-readable media of claim 105, wherein each of the network sensors is a hypertext transfer protocol (HTTP) sensor.

109. The computer-readable media of claim 105, wherein the NBP is a hierarchic data structure.

110. The computer-readable media of claim 109, wherein each of the profile properties comprises a descriptive value of its corresponding profile item.

111. The computer-readable media of claim 105, wherein one of the profile properties for each of the profile items comprises at least a current state of the profile property, wherein the current state is one of a learn state and an enforceable state.

112. The computer-readable media of claim 105, wherein one of the profile properties for each of the profile items comprises at least a current state of the profile property, wherein possible states for the current state include a learn state, an enforceable state, and a non-enforceable state.

113. The computer-readable media of claim 105, wherein the profile item comprises at least one of a current state of the profile item and a distinguishable name.

114. The computer-readable media of claim 113, wherein the current state is at least one of a learn state, a protect state, a deleted state, a decayed state and a merged state.

115. The computer-readable media of claim 105, wherein the NBP represents a HTTP profile.

116. The computer-readable media of claim 105, wherein the analysis of the application events includes a syntax analysis.

117. The computer-readable media of claim 116, wherein the syntax analysis comprises:

breaking each of the application events into functional units; and

classifying the functional units as identification units and property units.

118. The computer-readable media of claim 117, wherein the identification units are used for identifying the application events.

119. The computer-readable media of claim 117, wherein the property units describe the properties of the application events.

120. The computer-readable media of claim 117, wherein generating the NBP further comprises:

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

121. The computer-readable media of claim 105, wherein the NBP is an adaptive NBP that is automatically updated while the system is operating in the protect mode.

122. The computer-readable media of claim 105, wherein the application requests include HTTP requests.

123. The computer-readable media of claim 105, wherein the network sensors are placed on each network segment that is coupled to the server the application resides on.

124. The computer-readable media of claim 105, wherein at least one of the network sensors sniffs traffic.

125. The computer-readable media of claim 105, wherein at least one of the network sensors operates in the line of traffic.

126. The computer-readable media of claim 105, further comprising:

receiving an irregular event from one of the network sensors that identified an additional application event as a potential attack based on comparison to only the parts of the NBP determined to be stable.

127. The computer-readable media of claim 105, wherein the exiting the learn mode and entering the protect mode includes changing a current state of only the profile items determined to be stable to a protect state.

128. The computer-readable media of claim 105, wherein the exiting the learn mode and entering the protect mode includes distributing at least the profile items determined to be stable to at least one of the network sensors and protecting the application using only the stable items of the NBP.

129. The computer-readable media of claim 105, wherein the exiting occurs on a per profile item basis and includes automatically distributing to the network sensors the stable profile items when they are determined to be stable.

130. The computer-readable media of claim 105, wherein the profile items include a URL item and a parameter item, and wherein the profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

131. The computer-readable media of claim 130, wherein the application is a web application, and the URL item describes a single URL within that web application.

132. The computer-readable media of claim 131, wherein the parameter item describes a list of parameters of HTTP requests submitted to a web server.

133. The computer-readable media of claim 130, wherein the profile items also comprise at least a web application item, a virtual folder item, and a cookie item, wherein the web application item describes a single web application in the web server group, wherein the virtual folder item defines a virtual folder within the web application, and the cookie item comprises cookies for the web application.

134. The computer-readable media of claim 105, wherein:

the analysis of the application events includes;

a syntax analysis to generate functional units; and

a classification of the functional units as identification units and property units, wherein the identification units are used for identifying the application events, and wherein the property units describe the property of the application events; and

the generating the NBP comprises;

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

135. A network security system that utilizes a dynamic learning process for protection of applications, wherein the security system comprises:

a plurality of network sensors, placed on each network segment that is coupled to servers the applications reside on, configured to collect application events by one or more of analyzing network level protocol attributes and polling one or more of the applications for information about recent application events, during a learn mode;

a computer coupled to the plurality of network sensors, the computer configured to generate normal behavior profiles (NBPs) during the learn mode of the security system, wherein the computer further configured to perform an analysis to determine, for each of the NBPs, if the NBP is stable, wherein the analysis comprises;

a computation of a percentage of learning progress for each profile item in the NBP out of the total number of the application events received over a predefined time; and

a determination that the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold.

136. The security system of claim 135, wherein said computer is also to distribute at least the stable profile items of the NBPs to the network sensors, and wherein the network sensors are also to determine whether additional application events are potential attacks based on comparison of the additional application events to the parts of the NBP determined to be stable.

137. The security system of claim 135, wherein each of the applications is at least one of a web application and a database.

138. The security system of claim 135, wherein each of the network sensors is at least one of a structured query language (SQL) sensor and a hypertext transfer protocol (HTTP) sensor.

139. The security system of claim 135, wherein at least one of the NBPs is a hierarchic data structure.

140. The security system of claim 135, wherein at least one of the NBPs comprises a plurality of profile items and each of the plurality of the profile items comprises a profile property.

141. The security system of claim 135, wherein the dynamic learning process comprises an analysis of the application events.

142. The security system of claim 135, wherein a given one of the NBPs is considered stable if at least one of its plurality of profile items is stable.

143. The security system of claim 135, wherein the secure sever is also configured to distribute at least one of the stable NBPs to those of the network sensors placed on those of the network segments coupled to at least one of the servers on which at least one of the applications resides.

144. The security system of claim 135, wherein at least one of the NBPs represents at least one of a HTTP profile and a SQL profile.

145. The security system of claim 135, wherein at least one of the NBPs is an adaptive NBP that is automatically updatable while the system is operating in the PROTECT mode.

146. The security system of claim 135, wherein at least one of the network sensors sniffs traffic.

147. The security system of claim 135, wherein at least one of the network sensors operates in the line of traffic.

148. The security system of claim 135, wherein the computer is also configured to distribute at least the profile items determined to be stable to at least one of the network sensors and to cause that network sensor to enter a protect mode using only the stable profile items.

149. The security system of claim 135, wherein the computer is also configured to automatically distribute to the appropriate network sensors the stable profile items when they are determined to be stable.

150. The security system of claim 135, wherein the profile items include a URL item and a parameter item, and wherein the profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

151. The security system of claim 150, wherein at least one of the applications is a web application, and the URL item describes a single URL within that web application.

152. The security system of claim 151, wherein the parameter item describes a list of parameters of HTTP requests submitted to a web server.

153. The security system of claim 150, wherein the profile items also comprise at least a web application item, a virtual folder item, and a cookie item, wherein the web application item describes a single web application in the web server group, wherein the virtual folder item defines a virtual folder within the web application, and the cookie item comprises cookies for the web application.

154. The security system of claim 135, wherein the profile items include one or more of a table access item and a query item, wherein the table access item has profile properties that define the enforcement mode for each type of query, and wherein a query item defines an SQL query and has a profile property that holds the SQL query.

155. The security system of claim 154, wherein the table access item defines the access profile of database clients to a database table.

156. The security system of claim 154, wherein the types of queries include select, update, delete, and insert.

157. The security system of claim 154, wherein the query item'"'"'s distinguished name is the normalized text of the query.

158. The security system of claim 154, wherein the profile items also comprise a source group item that defines a homogeneous group of database clients having access to database servers.

159. A network security system that utilizes a dynamic learning process for protection of an application, wherein the security system comprises:

a plurality of network sensors, placed on each network segment that is coupled to a server the application resides on, configured to collect application events by analyzing network level protocol attributes, during a learn mode;

a computer coupled to the plurality of network sensors, the computer configured to generate a normal behavior profile (NBP) during the learn mode of the security system, wherein the computer is further configured to perform an analysis to determine, for each of the NBPs, if the NBP is stable, wherein the analysis comprises;

a computation of a percentage of learning progress for each profile item in the NBP out of the total number of the application events received over a predefined time; and

a determination that the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold.

160. The security system of claim 159, wherein said computer is also to distribute at least the stable profile items of the NBP to the network sensors, and wherein the network sensors are also to determine whether additional application events are potential attacks based on comparison of the additional application events to the parts of the NBP determined to be stable.

161. The security system of claim 159, wherein the application is a web application.

162. The security system of claim 159, wherein each of the network sensors is a hypertext transfer protocol (HTTP) sensor.

163. The security system of claim 159, wherein the NBP is a hierarchic data structure.

164. The security system of claim 159, wherein the NBP comprises a plurality of profile items and each of the plurality of the profile items comprises a profile property.

165. The security system of claim 159, wherein the dynamic learning process comprises an analysis of the application events.

166. The security system of claim 159, wherein the NBP is considered stable if at least one of its plurality of profile items is stable.

167. The security system of claim 159, wherein the NBP represents a HTTP profile.

168. The security system of claim 159, wherein the NBP is an adaptive NBP that is automatically updatable while the system is operating in the protect mode.

169. The security system of claim 159, wherein at least one of the network sensors sniffs traffic.

170. The security system of claim 159, wherein at least one of the network sensors operates in the line of traffic.

171. The security system of claim 159, wherein the computer is also configured to distribute at least the profile items determined to be stable to the network sensors and to cause that network sensors to enter a protect mode using only the stable profile items.

172. The security system of claim 159, wherein the computer is also configured to automatically distribute to the network sensors the stable profile items when they are determined to be stable.

173. The security system of claim 159, wherein the profile items include a URL item and a parameter item, and wherein the profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

174. The security system of claim 173, wherein the application is a web application, and the URL item describes a single URL within that web application.

175. The security system of claim 174, wherein the parameter item describes a list of parameters of HTTP requests submitted to a web server.

176. The security system of claim 173, wherein the profile items also comprise at least a web application item, a virtual folder item, and a cookie item, wherein the web application item describes a single web application in the web server group, wherein the virtual folder item defines a virtual folder within the web application, and the cookie item comprises cookies for the web application.

177. A method, performed by a sensor and a secure server, for protecting an application installed on a server, the method comprising:

collecting in the sensor from an application layer protocol application requests sent by clients to the application installed on the server;

automatically building, based on the collected application requests, a normal behavior profile (NBP), wherein the NBP characterizes the application;

automatically performing analysis to determine that at least part of the NBP is stable, wherein the performing comprises;

computing a percentage of learning progress for different parts of the NBP; and

determining the respective part is stable if the percentage of learning progress exceeds a predefined threshold;

deploying by the secure server at least the stable part of the NBP to the sensor;

collecting an additional application request in the sensor; and

identifying the additional application request as a potential attack based on comparison to the stable part of the NBP.

178. The method of claim 177, wherein the deploying is automatic responsive to the determination of stability.

179. The method of claim 177, wherein the performing analysis comprises computing a Bayesian probability for a mistake.

180. The method of claim 177, wherein:

the NBP comprises at least a plurality of profile items and a plurality of profile properties, wherein each of the plurality of profile items comprises at least one profile property, wherein the profile items and the profile properties characterize the application;

the computing includes computing the percentage of learning progress for each profile item and profile property out of the total number of the application requests received over a predefined time; and

the determining includes determining the respective profile item or the profile property as stable if the percentage of learning progress exceeds a predefined threshold.

181. The method of claim 177, further comprising:

polling, by a second sensor, information about recent application collecting in a second sensor from an application layer protocol application requests sent by clients to the application installed on the server;

automatically building, based on the collected application requests, a normal behavior profile (NBP), wherein the NBP characterizes the application.

182. The method of claim 177, wherein the application requests are HTTP requests and the collecting includes gathering and reconstructing the HTTP requests.

183. The method of claim 177, the collecting, automatically building, performing, deploying, and identifying are performed without any prior knowledge of the application semantics.

184. The method of claim 177, wherein the server is a web server.

185. The method of claim 177, wherein the NBP is a hierarchic data structure.

186. The method of claim 177, wherein the NBP represents a HTTP profile.

187. The method of claim 177, wherein the NBP is an adaptive NBP that is automatically updated while the system is operating in a protect mode.

188. The method of claim 177, wherein the network sensor sniffs traffic.

189. The method of claim 177, wherein the sensors operates in the line of traffic.

190. The method of claim 177, wherein the performing includes changing a current state of only profile items of the NBP determined to be stable to a protect state.

191. The method of claim 190, wherein the deploying includes distributing at least the profile items determined to be stable to the sensor.

192. The method of claim 177, wherein the performing occurs on a per profile item basis within the NBP, and the deploying includes distributing to the sensor the stable profile items when they are determined to be stable.

193. The method of claim 192, wherein the profile items include a URL item and a parameter item, and wherein profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

194. A non-transitory, tangible computer-readable media which has stored in it instructions, which when executed by a computer of a secured system for protection of applications, cause the computer to perform the steps of:

receiving application events processed by sensors coupled between clients and servers on which the applications reside;

analyzing the application events;

generating a normal behavior profile (NBP) based on results of the step of analyzing the application events, the NBP comprises at least a plurality of profile items and each of the plurality profile items comprises a profile property;

automatically performing analysis to determine if any of the profile items of the NBP are stable, wherein a given one of said profile items is considered stable when it is ready to detect anomalous application events, and wherein the performing comprises;

computing a percentage of learning progress for the profile items of the NBP; and

determining the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold;

deploying the stable profile items of the NBP to the sensors to use for detecting anomalous application events.

195. The non-transitory, tangible computer-readable media of claim 194, wherein the deploying is automatic responsive to the determination of stability.

196. The non-transitory, tangible computer-readable media of claim 194, wherein the receiving, analyzing, generating, performing, and deploying are performed without any prior knowledge of the applications semantics.

197. The non-transitory, tangible computer-readable media of claim 194, wherein each of the sensors is at least one of a structured query language (SQL) sensor and a hypertext transfer protocol (HTTP) sensor.

198. The non-transitory, tangible computer-readable media of claim 194, wherein the NBP is a hierarchic data structure.

199. The non-transitory, tangible computer-readable media of claim 194, wherein the NBP represents at least one of a HTTP profile and a SQL profile.

200. The non-transitory, tangible computer-readable media of claim 194, wherein analyzing the application events further comprises:

performing a lexical analysis;

and performing a syntax analysis.

201. The non-transitory, tangible computer-readable media of claim 200, wherein performing the lexical analysis comprises:

breaking each of the plurality of application events into tokens; and

creating a representation of the application event using the tokens'"'"' properties.

202. The non-transitory, tangible computer-readable media of claim 200, wherein performing the syntax analysis comprises:

breaking each of the application events into functional units; and

classifying the functional units as identification units and property units.

203. The non-transitory, tangible computer-readable media of claim 202, wherein the identification units are used for identifying the application events.

204. The non-transitory, tangible computer-readable media of claim 202, wherein the property units describe the properties of the application events.

205. The non-transitory, tangible computer-readable media of claim 202, wherein generating the NBP further comprises:

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

206. The non-transitory, tangible computer-readable media of claim 194, wherein the performing analysis comprises computing a Bayesian probability for a mistake.

207. The non-transitory, tangible computer-readable media of claim 194, wherein:

the NBP also comprises a plurality of profile properties, wherein each of the plurality of profile items comprises at least one profile property, wherein the profile items and the profile properties characterize the application

the computing includes computing the percentage of learning progress for each profile item and profile property out of the total number of the application requests received over a predefined time; and

the determining includes determining the respective profile item or the profile property as stable if the percentage of learning progress exceeds a predefined threshold.

208. The non-transitory, tangible computer-readable media of claim 194, wherein the NBP is an adaptive NBP that is automatically updated while the system is operating in a protect mode.

209. The non-transitory, tangible computer-readable media of claim 194, wherein the application events are based on HTTP requests.

210. The non-transitory, tangible computer-readable media of claim 194, wherein at least one of the sensors sniffs traffic.

211. The non-transitory, tangible computer-readable media of claim 194, wherein at least one of the sensors operates in the line of traffic.

212. The non-transitory, tangible computer-readable media of claim 194, wherein the profile items include a URL item and a parameter item, and wherein profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

213. The non-transitory, tangible computer-readable media of claim 212, wherein at least one of the applications is a web application, and the URL item describes a single URL within that web application.

214. The non-transitory, tangible computer-readable media of claim 213, wherein the parameter item describes a list of parameters of HTTP requests submitted to a web server.

215. The non-transitory, tangible computer-readable media of claim 194, wherein the profile items include one or more of a table access item and a query item, wherein the table access item has profile properties that define the enforcement mode for each type of query, and wherein a query item defines an SQL query and has a profile property that holds the SQL query.

216. The non-transitory, tangible computer-readable media of claim 215, wherein the table access item defines the access profile of database clients to a database table.

217. The non-transitory, tangible computer-readable media of claim 215, wherein the types of queries include select, update, delete, and insert.

218. The non-transitory, tangible computer-readable media of claim 215, wherein the query item'"'"'s distinguished name is the normalized text of the query.

219. The non-transitory, tangible computer-readable media of claim 215, wherein the profile items also comprise a source group item that defines a homogeneous group of database clients having access to database servers.

220. The non-transitory, tangible computer-readable media of claim 194, wherein:

the analyzing the application events comprises;

performing syntax analysis to generate functional units; and

classifying the functional units as identification units and property units, wherein the identification units are used for identifying the application events, and wherein the property units describe the property of the application events; and

the generating the NBP comprises;

gathering the property units having at least one similar identification unit to form the profile property; and

attaching the profile property to its corresponding profile item.

221. A network security system that utilizes a dynamic learning process for protection of applications, wherein the security system comprises:

a plurality of network sensors, coupled between clients and servers on which the applications reside, configured to collect application events; and

a computer, coupled to the plurality of network sensors, configured to automatically generate a normal behavior profiles (NBP) based on the collected application events, to automatically perform analysis to determine if at least part of that NBP is stable, and to deploy at least the stable parts of the NBP to the network sensors to use for detecting anomalous application events, wherein the analysis comprises;

a computation of a percentage of learning progress for different parts of the NBP; and

a determination that the respective part is stable if the percentage of learning progress exceeds a predefined threshold.

222. The security system of claim 221, wherein each of the applications is at least one of a web application and a database.

223. The security system of claim 221, wherein each of the network sensors is at least one of a structured query language (SQL) sensor and a hypertext transfer protocol (HTTP) sensor.

224. The security system of claim 221, wherein the NBP is a hierarchic data structure.

225. The security system of claim 221, wherein the NBP comprises a plurality of profile items and each of the plurality of the profile items comprises a profile property.

226. The security system of claim 225, wherein the NBP is considered stable if at least one of its plurality of profile items is stable.

227. The security system of claim 221, wherein the dynamic learning process comprises an analysis of the application events.

228. The security system of claim 221, wherein the NBP represents at least one of a HTTP profile and a SQL profile.

229. The security system of claim 221, wherein the NBP is an adaptive NBP that is automatically updatable while the system is operating in a PROTECT mode.

230. The security system of claim 221, wherein at least one of the network sensors sniffs traffic.

231. The security system of claim 221, wherein at least one of the network sensors operates in the line of traffic.

232. The security system of claim 221, wherein the deployment includes distribution of at least profile items of the NBP determined to be stable to at least one of the network sensors and entry of that network sensor into a protect mode using only the stable profile items.

233. The security system of claim 221, wherein the computer is also configured to automatically perform the deployment of profile items of the NBP when they are determined to be stable.

234. The security system of claim 233, wherein the profile items include a URL item and a parameter item, and wherein profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

235. The security system of claim 234, wherein at least one of the applications is a web application, and the URL item describes a single URL within that web application.

236. The security system of claim 235, wherein the parameter item describes a list of parameters of HTTP requests submitted to a web server.

237. The security system of claim 233, wherein the profile items include one or more of a table access item and a query item, wherein the table access item has profile properties that define the enforcement mode for each type of query, and wherein a query item defines an SQL query and has a profile property that holds the SQL query.

238. The security system of claim 237, wherein the table access item defines the access profile of database clients to a database table.

239. The security system of claim 238, wherein the types of queries include select, update, delete, and insert.

240. The security system of claim 237, wherein the query item'"'"'s distinguished name is the normalized text of the query.

241. The security system of claim 237, wherein the profile items also comprise a source group item that defines a homogeneous group of database clients having access to database servers.

242. An application level security system to protect a web server and a database server comprising:

a first network sensor, coupled between a client and the web server, to collect HTTP requests sent by the client to the web server;

a second network sensor, coupled between the web server and the database server, to collect any SQL requests sent to the database server as a consequence of the HTTP requests;

a computer coupled to the first network sensor and the second network sensor, to execute a profiling process to automatically generate a first and second normal behavior profile (NBP) respectively for the web server and the database server based respectively on the collected HTTP requests and the collected SQL requests, to automatically perform analysis to determine whether the first and second NBP comprise at least one stable profile item useable to detect anomalies, and to upload copies of the NBPs with at least one stable profile item, wherein the first NBP characterizes the web server and a copy is uploaded to the first network sensor, wherein the second NBP characterizes the database server and a copy is uploaded to the second network sensor, wherein the analysis comprises;

a computation of a percentage of learning progress for each profile item in the NBP; and

a determination that the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold.

243. The security system of claim 242, wherein the first network sensor, upon receiving the uploaded copy of the first NBP, is also to compare the HTTP requests to the stable profile items of the uploaded copy of the first NBP and to report to the computer those of the HTTP requests that deviate from the stable profile items of the NBP.

244. The security system of claim 242, wherein the uploaded copy of the first NBP held by the first network sensor includes only a subset of the information existing in the first NBP held by the computer.

245. The security system of claim 242, wherein the second network sensor, upon receiving the uploaded copy of the second NBP, is also to compare the SQL requests to the stable profile items of the uploaded copy of the second NBP and to report to the computer those of the SQL requests that deviate from the stable profile items of the NBP.

246. The security system of claim 242, wherein the uploaded copy of the second NBP held by the second network sensor includes only a subset of the information existing in the second NBP held by the computer.

247. The security system of claim 242, wherein the profiling process is a dynamic learning process.

248. The security system of claim 242, wherein a decision is made during the profiling process as to whether to use an application event for protection or learning based on a single profile item in the NBP, wherein the NBP comprises a plurality of profile items, wherein each item comprises at least one profile property.

249. The security system of claim 242, wherein the NBPs are hierarchic data structures.

250. The security system of claim 242, wherein the NBPs comprise a plurality of profile items and each of the plurality of the profile items comprises a profile property.

251. The security system of claim 242, wherein the NBPs are adaptive NBPs that is automatically updatable while the system is operating in a PROTECT mode.

252. The security system of claim 242, wherein at least one of the network sensors sniffs traffic.

253. The security system of claim 242, wherein at least one of the network sensors operates in the line of traffic.

254. The security system of claim 242, wherein the computer is also configured to perform the upload of a given one of the NBPs when one of the profile items is determined to be stable.

255. The security system of claim 242, wherein the profile items of the first NBP include a URL item and a parameter item, and wherein profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

256. The security system of claim 255, wherein the URL item describes a single URL within the web server.

257. The security system of claim 256, wherein the parameter item describes a list of parameters of HTTP requests submitted to the web server.

258. The security system of claim 242, wherein the profile items of the second NBP include one or more of a table access item and a query item, wherein the table access item has profile properties that define the enforcement mode for each type of query, and wherein a query item defines an SQL query and has a profile property that holds the SQL query.

259. The security system of claim 258, wherein the table access item defines the access profile of database clients to a database table.

260. The security system of claim 259, wherein the types of queries include select, update, delete, and insert.

261. The security system of claim 258, wherein the query item'"'"'s distinguished name is the normalized text of the query.

262. The security system of claim 258, wherein the profile items also comprise a source group item that defines a homogeneous group of database clients having access to database servers.

263. A network security system that utilizes a dynamic learning process for protection of a web application on a web server, wherein the security system comprises:

a computer configured to automatically generate a normal behavior profiles (NBP) based on application events collected by a sensor coupled to receive HTTP requests sent from clients to the web application, to automatically perform analysis to determine when different profile items within the NBP become stable such that they are usable to detect anomalies, and to automatically deploy the stable profile items of the NBP to the sensor to use for detecting anomalous HTTP requests, wherein the analysis comprises;

a computation of a percentage of learning progress for each profile item in the NBP; and

a determination that the respective profile item is stable if the percentage of learning progress exceeds a predefined threshold.

264. The security system of claim 263, wherein the NBP is a hierarchic data structure.

265. The security system of claim 263, wherein each of the profile items comprises a profile property.

266. The security system of claim 263, wherein the dynamic learning process comprises an analysis of the application events.

267. The security system of claim 263, wherein the NBP is an adaptive NBP that is automatically updatable while the system is operating in a PROTECT mode.

268. The security system of claim 263, wherein the sensor sniffs traffic.

269. The security system of claim 263, wherein the sensor operates in the line of traffic.

270. The security system of claim 263, wherein the profile items include a URL item and a parameter item, and wherein profile properties corresponding to the parameter item include a length restriction on a parameter'"'"'s value and a parameter type for the parameter.

271. The security system of claim 270, wherein the URL item describes a single URL within the web application.

272. The security system of claim 270, wherein the parameter item describes a list of parameters of the HTTP requests submitted to the web application.