Patent ID: 11961021
Assignee: IVANTI, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A method for providing intelligent web application security based on enhancing an application knowledge base in real time to create a comprehensive application attack surface, the method comprising:
capturing, by an intelligent interceptor module, synchronous and asynchronous HTTP requests and response sequences within a target application resulting from user actions in real time;
passing, by the intelligent interceptor module, the synchronous and asynchronous HTTP requests and response sequences to a data processing module, wherein:
the synchronous HTTP requests and response sequences comprise traditional GET and POST HTTP requests between a client and a server,
each response from the server entirely replaces a currently displayed web page that belongs to the target application on a client side, and
the asynchronous HTTP requests and responses comprise HTTP request, response sequences using technologies that modify a Document Object Model state of a target web page that belongs to the target application without having to reload the target web page completely;

creating, by the data processing module, a structured content hierarchy from captured unstructured HTTP(S) data;
passing, by the data processing module, the structured content hierarchy to a knowledge module;
creating, by the knowledge module, a concept hierarchy from the structured content hierarchy;
further generating, by the knowledge module, a target application ontology from the concept hierarchy;
storing, by the knowledge module, the target application ontology in a knowledge base; and
creating, by an intelligent scanner, offensive ontology-based payloads while testing the target application for complex web application attacks.