Patent ID: 8024804
Filing Date: 2011-09-20
Classification: G06F,H04L

Abstract:
1. A method for detecting application level attacks and for protecting web applications, comprising: receiving a plurality of attack indications based on data transmitted on the network, wherein the attack indications are generated in response to violation of at least a plurality of profiles of a protected web application, the attack indications comprise an anomaly, and wherein the anomaly is a deviation from at least a normal behavior profile of a protected web application, the plurality of attack indications being of at least one of a maximal average latency (MAL) profile, a maximal latency (ML) profile, and a maximal access rate (MAR) profile of the protected application; iteratively applying a set of correlation rules to correlate the plurality of attack indications by applying a first rule of the set of correlation rules to the attack indications to obtain a first result; and if the first result does not indicate on a potential attack applying a next rule in the set of correlation rules until a result indicating on a potential attack is detected or all rules in the set of correlation rules are applied, wherein the set of correlation rules corresponds to the particular type of an application level attack, to determine if the MAL profile and ML profile are violated, the MAL profile and the MAR profile are violated, or the ML profile and the MAR profile are violated; generating an alert if at least one rule of the set of correlation rules applied on the plurality of attack indications indicate that at least a violation occurred; wherein the application level attack comprises at least one of a directory traversal attack, a cross site scripting attack, an automatic reconnaissance attack, a search engine hacking attack, and an application denial of service attack.