AUTOMATED NETWORK INTERFACE ATTACK RESPONSE

• US 20170085579A1
• Filed: 09/18/2015
• Published: 03/23/2017
• Est. Priority Date: 09/18/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ionescu, Paul, ONUT, IOSIF V.
• Granted Patent: US 9,998,482 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

An attack upon a web interface is detected in real-time. The web interface is one of many web interfaces across many ports across many computer systems within a network. Data on the attack is gathered. The attack data includes traffic data. Variants of the attack are determined based on data of the attack. The variants are selected from a predetermined set of attack variants. The attacked interface is scanned with the selected attack variants. The web interface is identified as vulnerable to at least one variant of the attack. In response to this identification, the attack is responded to without human intervention.

Claims

1. A method of scanning for security threats, the method comprising:

detecting, in real-time, an attack on a web interface of a computing system having a plurality of web interfaces;

gathering data on the attack;

determining variants of the attack based on data of the attack, wherein the variants are a subset of a predetermined set of attack variants;

scanning, based on the attack, the web interface with the variants of the attack;

determining vulnerability of the web interface to the variants of the attack; and

responding to the attack without human intervention based on the determined vulnerability of the web interface to the variants of the attack.

2. The method of claim 1, wherein the data includes a type of the attack and payload data of the attack.

3. The method of claim 2, wherein determining variants of the attack further comprises:

cross-referencing the type of attack and payload data of the attack against the predetermined set of attack variants which includes correlations between attack variants, types of attacks, and payload data of attacks; and

identifying the variants of the attack as correlating with the type of attack and the payload data of the attack.

4. The method of claim 3, further comprising:

determining that the web interface has been previously scanned with one or more variants of the predetermined set of attack variants; and

wherein the variants of the attack do not include the one or more variants.

5. The method of claim 1, wherein the data includes an originating network address of the attack;

and

wherein responding to the attack further comprises blocking the originating network address of the attack.

6. The method of claim 1, wherein the data includes cookies of a client which executed the attack and wherein determining the variants of the attack comprises determining the variants of the attack based on the cookies.

7. The method of claim 1, further comprising:

detecting a second attack on the web interface;

gathering data on the second attack;

determining variants of the second attack based on data of the second attack;

scanning the web interface with variants of the second attack;

determining vulnerability of the web interface to the variants of the second attack; and

logging the second attack in response to determining that the web interface is not vulnerable to the second attack.

8. The method of claim 1, wherein scanning the web interface with the variants of the attack comprises scanning the web interface with the variants of the attack in response to determining that the web interface has not been previously scanned with the variants of the attack.

9. The method of claim 1, further comprising:

determining a subset of the plurality of web interfaces which correlate to the attacked web interface and which have not been previously scanned with the variants of the attack; and

scanning the subset of the plurality of web interfaces with the variants of the attack.

10. A computer system comprising:

a memory; and

one or more processing circuits communicatively coupled to the memory, wherein the one or more processing circuits are configured to;

detect, in real-time, an attack on a web interface of a computing system having a plurality of web interfaces;

gather data on the attack;

determine variants of the attack based on data of the attack, wherein the variants are a subset of a predetermined set of attack variants;

scan, based on the attack, the web interface with the variants of the attack;

determine vulnerability of the web interface to the variants of the attack; and

respond to the attack without human intervention based on the determined vulnerability of the web interface to the variants of the attack.

11. The computer system of claim 10, wherein the data includes a type of the attack and payload data of the attack and the one or more processing circuits are configured to determine the variants of the attack by being further configured to:

cross-reference the type of attack and payload data of the attack against the predetermined set of attack variants which includes correlations between attack variants, types of attacks, and payload data of attacks; and

identify the variants of the attack as correlating with the type of attack and the payload data of the attack.

12. The computer system of claim 11, wherein the one or more processing circuits are further configured to:

determine that the web interface has been previously scanned with one or more variants of the predetermined set of attack variants; and

wherein the variants of the attack do not include the one or more variants.

13. The computer system of claim 10, wherein the computing system resides in a demilitarized zone (DMZ) of a computing network.

14. The computer system of claim 10, wherein the one or more processing circuits are further configured to:

detect a second attack on the web interface;

gather data on the second attack;

determine variants of the second attack based on data of the second attack;

scan the web interface with variants of the second attack;

determine vulnerability of the web interface to the variants of the second attack; and

log the second attack in response to determining that the web interface is not vulnerable to the second attack.

15. The computer system of claim 14, wherein the one or more processing circuits are further configured to:

determine a subset of the plurality of web interfaces which correlate to the attacked web interface and which have not been previously scanned with the variants of the attack; and

scan the subset of the plurality of web interfaces with the variants of the attack.

16. A computer program product for scanning for security threats, the computer program product disposed upon a computer readable storage medium, the computer program product comprising computer program instructions that, when executed by a computer processor of a computer, cause the computer to:

detect, in real-time, an attack on a web interface of a computing system having a plurality of web interfaces;

gather data on the attack;

determine variants of the attack based on data of the attack, wherein the variants are a subset of a predetermined set of attack variants;

scan, based on the attack, the web interface with the variants of the attack;

determine vulnerability of the web interface to the variants of the attack; and

respond to the attack without human intervention based on the determined vulnerability of the web interface to the variants of the attack.

17. The computer program product of claim 16, wherein the data includes a type of the attack and payload data of the attack and the computer program product comprising instructions regarding determining the variants of the attack which, when executed by the computer processor, cause the computer to:

cross-reference the type of attack and payload data of the attack against the predetermined set of attack variants which includes correlations between attack variants, types of attacks, and payload data of attacks; and

identify the variants of the attack as correlating with the type of attack and the payload data of the attack.

18. The computer program product of claim 17, the computer program product further comprising instructions which, when executed by the computer processor, cause the computer to:

determine that the web interface has been previously scanned with one or more variants of the predetermined set of attack variants; and

wherein the variants of the attack do not include the one or more variants.

19. The computer program product of claim 16, the computer program product further comprising instructions which, when executed by the computer processor, cause the computer to:

detect a second attack on the web interface;

gather data on the second attack;

determine variants of the second attack based on data of the second attack;

scan the web interface with variants of the second attack;

determine vulnerability of the web interface to the variants of the second attack; and

log the second attack in response to determining that the web interface is not vulnerable to the second attack.

20. The computer program product of claim 16, wherein the computer program product further comprising instructions for scanning the web interface with the variants of the attack which, when executed by the computer processor, cause the computer to:

scan the web interface with the variants of the attack in response to determining that the web interface has not been previously scanned with the variants of the attack.