Patent ID: 9027136
Filing Date: 2015-05-05
Classification: H04L

Abstract:
1. A method in a computing device communicatively coupled to a web application layer attack detector (AD), wherein the AD is communicatively coupled between a Hypertext Transfer Protocol (HTTP) client and a web application server to protect the web application server against web application layer attacks, and wherein the AD applies rules that each comprise a condition including a set of one or more attributes, wherein each of the set of attributes includes an attribute identifier and a set of one or more attribute values, the method comprising: receiving, from the AD, an alert package comprising a web application layer request message sent by the HTTP client to the web application server, wherein the alert package was sent responsive to a set of one or more packets that collectively carried the web application layer request message and that resulted in the condition of one of the rules being met, wherein the set of packets are sent using a protocol stack including an application layer that carries web application layer request messages, a transport layer under the application layer to provide end-to-end communication services, and a network layer under the transport layer to route data supplied by the transport layer; automatically generating, using the received alert package and without relying on a web application layer response message, a new set of one or more attribute values for each of a set of one or more attribute identifiers, wherein said automatically generating comprises: transmitting, for delivery to the AD, the new set of attribute values for each of the set of attribute identifiers for a different rule than the one of the rules that caused the sending of the alert package to be used in the AD to protect the web application server against web application layer attacks from the HTTP client or any other HTTP client.