Patent ID: 7752662

Claim:
A method for detection of zero day worm attacks on a protected web application, wherein the method comprises: parsing a hypertext transfer protocol (HTTP) request received by the protected web application to extract at least one HTTP request parameter; comparing the at least one extracted HTTP request parameter against a normal behavior profile (NBP) of the protected web application comprises: checking if the URL in the HTTP request of the protected web application is not listed in the reliable paths list; checking if the URL in the HTTP request of the protected web application references a directory in the vulnerable directories list; checking if a host header field in the HTTP request of the protected web application is invalid; checking if the HTTP request of the protected web application does not include a session identifier; checking if the HTTP request of the protected web application belongs to a previously established session; wherein a deviation from the NBP of protected web application is identified if, all checks result with an affirmative answer; a deviation from NBP identifies a zero day worm attack; and generating an alert indicating a zero day worm attack if a deviation from the NBP is identified, wherein the zero day attack is an initial appearance of a web worm.