Method and apparatus for proactively identifying and mitigating malware attacks via hosted web assets

• US 10,860,715 B2
• Filed: 05/19/2017
• Issued: 12/08/2020
• Est. Priority Date: 05/26/2016
• Status: Active Grant

• Current Assignee: Barracuda Networks Incorporated
• Original Assignee: Barracuda Networks Incorporated
• Inventors: Shi, Fleming M., Miron, Nitzan
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US15/600,511
• Publication Number:
  US 20170344743A1
• Time in Patent Office: 1,299 Days
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A new approach is proposed that contemplates systems and methods to provide identification and mitigation of malware attack via Web assets hosted on a Web application, site, or platform in an automated and proactive manner. From the moment the Web assets are hosted on the Web application platform and protected by a Web application security device, the hosted Web assets are constantly monitored and assessed for potential risks. Whenever there is a new instance or a modification of a Web asset, a copy of the Web asset is automatically downloaded and analyzed for potential vulnerabilities. If a suspicious indicator of malicious contents in the Web asset is detected during the analysis, a plurality of security policies are created and applied to the Web application security device to mitigate threats of the Web asset and protect users of the Web application against malware attacks via the tampered Web asset.

Claims

1. A system to support identification and mitigation of malware attack via hosted Web assets, comprising:

a Web asset assessment engine configured to

initiate an assessment of a Web asset from one or more Web assets hosted by a target Web application or site protected by a Web application security device, wherein each of the Web assets is a URL or a document object, and wherein the assessment is initiated responsive to detecting that the Web asset is being added or modified on the target Web application or site protected by the Web application security device;

download only the Web asset to be assessed in its native form from the target Web application or site for assessment over a communication channel;

a threat detection engine configured to

accept and evaluate the Web asset downloaded from the target Web application or site for risk of malicious contents by generating a risk score for the Web asset to the target Web application or site, wherein the Web asset is evaluated by generating an authenticating signature of the Web asset and comparing it to a referencing signature that was previously generated and embedded within the Web asset;

identify a set of one or more malicious Web assets hosted on the target Web application or site based on their risk scores to the target Web application or site;

a protection policy application engine configured to create and correlate a plurality of policies with the set of one or more identified malicious Web assets to mitigate threats of the malicious Web assets hosted on the target Web application or site.

2. The system of claim 1, wherein:

the target Web application or site is a social networking site where a community of users are affected when the malicious Web assets are shared by the users of the target Web application or site.

3. The system of claim 1, wherein:

the Web application security device is a Web application firewall configured to protect the Web assets hosted by the target Web application or site.

4. The system of claim 1, wherein:

the Web asset assessment engine is configured to utilize its web-client capabilities to establish a communication channel with the target Web application or site, wherein the communication channel reaches the target Web application or site either internally through a private network protected by the Web application security device or externally through the Web application security device.

5. The system of claim 1, wherein:

the Web asset assessment engine is configured to scan through the Web assets to track newly hosted Web assets and changes to the existing Web assets to incrementally pick only those Web assets that are new or have changed since the last scan for assessment.

6. The system of claim 5, wherein:

the Web asset assessment engine is event-driven, which initiates the assessment when the new Web asset is hosted on the target Web application or an existing Web asset has been modified.

7. The system of claim 1, wherein:

the Web asset assessment engine is timer-based, which periodically checks the target Web application or site for any newly hosted Web asset since the last check and initiates the assessment if any newly hosted Web asset is found.

8. The system of claim 1, wherein:

the Web asset assessment engine is configured to mark each Web asset to be assessed with contextual meta-data to indicate a path to the Web asset on the target Web application or site for retrieval.

9. The system of claim 1, wherein:

the Web asset assessment engine is configured to download all of the Web assets to be assessed in a batch to reduce communication overhead between the Web asset assessment engine and the target Web application or site.

10. The system of claim 1, wherein:

the threat detection engine is configured to perform qualitative and/or quantitative data analysis on the Web asset to determine if the Web asset has been tampered with the malicious contents.

11. The system of claim 1, wherein:

the threat detection engine is configured to communicate with the Web asset assessment engine synchronously wherein each Web asset is evaluated as soon as it is downloaded from the target Web application or site.

12. The system of claim 1, wherein:

the threat detection engine is configured to communicate with the Web asset assessment engine asynchronously wherein each downloaded Web asset is first saved and maintained before it is evaluated at a later time.

13. The system of claim 12, wherein:

the threat detection engine is configured to provide the risk score of the Web asset back to the Web asset assessment engine to be synchronized with the corresponding Web asset it maintains.

14. The system of claim 1, wherein:

the protection policy application engine is configured to insert the policies to the Web application security device to prevent access to, block or remove the malicious Web assets from the target Web application or site to protect users of applications and other hosted Web assets of the target Web application or site or a client system having downloaded the Web asset from the target Web application or site.

15. The system of claim 1, further comprising:

a threat summary and reporting engine running on a host and configured to generate a report that summarizes threat posed by the Web assets based on the risk scores that have been generated for the Web assets.

16. The system of claim 15, wherein:

the protection policy application engine is configured to provide the report, upon request, to a user/system administrator of the target Web application or site as part of a warning message that the Web asset hosted on the target Web application or site has been tampered and may affect other hosted Web assets and/or applications of the target Web application or site or a client system having downloaded the Web asset from the target Web application or site.

17. A computer-implemented method to support identification and mitigation of malware attack via hosted Web assets, comprising:

initiating an assessment of a Web asset from one or more Web assets hosted by a target Web application or site protected by a Web application security device, wherein each of the Web assets is a URL or a document object, and wherein the assessment is initiated responsive to detecting that the Web asset is being added or modified on the target Web application or site protected by the Web application security device;

downloading only the Web asset to be assessed in its native form from the target Web application or site for assessment over a communication channel;

accepting and evaluating the Web asset downloaded from the target Web application or site for risk of malicious contents by generating a risk score for the Web asset to the target Web application or site, wherein the Web asset is evaluated by generating an authenticating signature of the Web asset and comparing it to a referencing signature that was previously generated and embedded within the Web asset;

identifying a set of one or more malicious Web assets hosted on the target Web application or site based on their risk scores to the target Web application or site;

creating and correlating a plurality of policies with the set of one or more identified malicious Web assets to mitigate threats of the malicious Web assets hosted on the target Web application or site.

18. The method of claim 17, further comprising:

establishing a communication channel with the target Web application or site, wherein the communication channel reaches the target Web application or site either internally through a private network protected by the Web application security device or externally through the Web application security device.

19. The method of claim 17, further comprising:

scanning through the Web assets to track newly hosted Web assets and changes to the existing Web assets to incrementally pick only those Web assets that are new or have changed since the last scan for assessment.

20. The method of claim 17, further comprising:

periodically checking the target Web application or site for any newly hosted Web asset since the last check and initiating the assessment if any newly hosted Web asset is found.

21. The method of claim 17, further comprising:

marking each Web asset to be assessed with contextual meta-data to indicate a path to the Web asset on the target Web application or site for retrieval.

22. The method of claim 17, further comprising:

downloading all of the Web assets to be assessed in a batch to reduce communication overhead between the Web asset assessment engine and the target Web application or site.

23. The method of claim 17, further comprising:

performing qualitative and/or quantitative data analysis on the Web asset to determine if the Web asset has been tampered with the malicious contents.

24. The method of claim 17, further comprising:

communicating with the Web asset assessment engine synchronously wherein each Web asset is evaluated as soon as it is downloaded from the target Web application or site.

25. The method of claim 17, further comprising:

communicating with the Web asset assessment engine asynchronously wherein each downloaded Web asset is first saved and maintained before it is evaluated at a later time;

providing the risk score of the Web asset back to the Web asset assessment engine to be synchronized with the corresponding Web asset it maintains.

26. The method of claim 17, further comprising:

inserting the policies to the Web application security device to prevent access to, block or remove the malicious Web assets from the target Web application or site to protect users of applications and other hosted Web assets of the target Web application or site or a client system having downloaded the Web asset from the target Web application or site.

27. The method of claim 17, further comprising:

generating a report that summarizes threat posed by the Web assets based on the risk scores that have been generated for the Web assets.

28. The method of claim 27, further comprising:

providing the report, upon request, to a user/system administrator of the target Web application or site as part of a warning message that the Web asset hosted on the target Web application or site has been tampered and may affect other hosted Web assets and/or applications of the target Web application or site or a client system having downloaded the Web asset from the target Web application or site.

29. At least one computer-readable storage medium having computer-executable instructions embodied thereon, wherein, when executed by at least one processor, the computer-executable instructions cause the at least one processor to:

initiate an assessment of a Web asset from one or more Web assets hosted by a target Web application or site protected by a Web application security device, wherein each of the Web assets is a URL or a document object, and wherein the assessment is initiated responsive to detecting that the Web asset is being added or modified on the target Web application or site protected by the Web application security device;

download only the Web asset to be assessed in its native form from the target Web application or site for assessment over a communication channel;

accept and evaluate the Web asset downloaded from the target Web application or site for risk of malicious contents by generating a risk score for the Web asset to the target Web application or site, wherein the Web asset is evaluated by generating an authenticating signature of the Web asset and comparing it to a referencing signature that was previously generated and embedded within the Web asset;

identify a set of one or more malicious Web assets hosted on the target Web application or site based on their risk scores to the target Web application or site;

create and correlate a plurality of policies with the set of one or more identified malicious Web assets to mitigate threats of the malicious Web assets hosted on the target Web application or site.