Patent ID: 8051484
Filing Date: 2011-11-01
Classification: G06F,H04L

Abstract:
1. A method for detecting and blocking web attacks by enforcing combinations of read-only parameters using a list of names of bound parameters and a list of binding uniform resource locators (URLs), wherein the list of binding URLs includes only source URLs, wherein each source URL was in a prior URL request that generated a response with at least one parameter on the list of names of bound parameters, wherein the list of names of bound parameters includes only parameters that were previously deemed to be read-only parameters, the method comprising: receiving a first URL request that is sent from a client to a server, wherein the first URL request is on the list of binding URLs; receiving a first response that is in reply to the first URL request, wherein the first response includes a hyper-text markup language (HTML) element that comprises a plurality of parameters, a value for each of the plurality of parameters, and a target URL attribute; computing a binding correlation value (BCV), which is a single correlation value that is computed over a combination of the plurality of parameter names and their values that are within the HTML element of the first response; saving the BCV using the target URL attribute of the HTML element as an entry key for that BCV; receiving a second URL request that includes the target URL attribute from the HTML element in the first response; identifying, in the second URL request, all parameters with a name that is on the list of bound parameters; computing, as a request BCV, a single correlation value over a combination of all of those parameters in the second URL request that were identified and their corresponding values in the second URL request; comparing the request BCV to the BCV previously saved for the target URL attribute; and denying the second URL request if the request BCV does not match the BCV previously saved.