WO2025264197A1 - A data management platform for security incidents - Google Patents
A data management platform for security incidentsInfo
- Publication number
- WO2025264197A1 WO2025264197A1 PCT/TR2025/050139 TR2025050139W WO2025264197A1 WO 2025264197 A1 WO2025264197 A1 WO 2025264197A1 TR 2025050139 W TR2025050139 W TR 2025050139W WO 2025264197 A1 WO2025264197 A1 WO 2025264197A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- data
- waf
- sql database
- attacks
- organized
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F40/00—Handling natural language data
- G06F40/20—Natural language analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
Definitions
- This invention is related to a data management platform for security incidents, which may be adopted by large-scale enterprises, government agencies, financial institutions and healthcare providers and may be used in security operations centers to meet the needs of institutions and organizations in cybersecurity, network management and data analytics.
- WAF Web Application Firewalls
- the patent application No. US9432335B1 describes "Cloud-Based Multi-Layered Security Architecture with Firewalled Virtual Network Partitions".
- the invention includes a virtual network, a web application firewall (WAF) portion to receive network traffic for one or more other portions of the virtual network; a first firewall connected to the WAF; web server portion, connected to the first firewall, to receive web traffic; a second firewall connected to the web server portion; an application server portion, connected to the second firewall, to perform application services for one or more servers of the web server portion; a third firewall connected to the application server portion; a database server portion connected to the third firewall; a fourth firewall connected to the database server portion, the application server portion, and the web server portion; an active directory portion, connected to the fourth firewall, to perform authentication of one or more access requests associated with the virtual network; and a utility portion, connected to the first firewall and the fourth firewall.
- WAF web application firewall
- the patent application no. CN117971866A describes "WAF Rule Engine Optimization Method and Device Based on Lexical Analysis".
- the invention describes a WAF rule engine optimization method based on lexical analysis.
- the method includes the following steps: decoding a user claim to obtain a user input parameter value; converting the parameter value entered by the user into a token string; and performing lexical analysis on the token string and determining whether the user request is a malicious one based on the result of the lexical analysis. Thanks to the WAF rule engine optimization based on lexical analysis, the false alarm rate of the WAF is reduced at a low cost, and only lexical analysis is required instead of complete grammatical analysis, so the workload is small and the analysis difficulty is low.
- WAFs web application firewalls
- These applications prevent and record various attacks.
- This recorded data is transmitted to log file-based monitoring systems and manual data recording methods. These data are usually recorded in log files, then processed manually. These manual processes are time-consuming and error-prone, making it difficult to properly analyze and securely store data.
- manual data entry options provided by Excel or simple database applications. In such manual processes, the possibility of human error in the recorded data is high and analysis and reporting may be disrupted.
- the present invention is a data management platform for security incidents capable of overcoming the disadvantages mentioned above, and characterized by integrated operation of WAF and SQL database, real-time analysis and storage of data, being very fast compared to primitive methods, providing easy reporting, being low cost, and easy to use.
- the invention is a platform that enables real-time detection and recording of attacks on web applications and the secure analysis and reporting of this data. Thanks to the integration of WAF and SQL database, attack data is continuously collected and transferred securely with the data transfer module, thus eliminating errors and delays that may occur in manual processes. Storing data in a central SQL database not only maintains data integrity, but also speeds up analysis and reporting. Furthermore, the cost-effective and user-friendly nature of this system makes it viable even for small and medium-sized businesses. Thanks to the storage module, data can be stored in an orderly and organized manner and analyzed in the long term and contribute to the creation of an effective defense strategy against security vulnerabilities. In this way, institutions can take quick and proactive measures against cyberattacks and increase data security.
- Figure 1 is a schematic view of the components of the system.
- the invention consists of WAF (1), which detects attacks by monitoring web applications and records these attacks with timestamps and types, SQL database (2) where data collected by WAF (1) is organized, data transfer module (3) where the data collected by the WAF (1) is securely transmitted in real time to the SQL database (2) via a data transfer interface where the format and transfer protocols are managed, and storage module (4) where data organized in SQL database (2) is stored for analysis and reporting.
- WAF (1) which detects attacks by monitoring web applications and records these attacks with timestamps and types
- SQL database (2) where data collected by WAF (1) is organized
- data transfer module (3) where the data collected by the WAF (1) is securely transmitted in real time to the SQL database (2) via a data transfer interface where the format and transfer protocols are managed
- storage module (4) where data organized in SQL database (2) is stored for analysis and reporting.
- the constituent parts of the invention are essentially: WAF (1), SQL database (2), data transfer module (3), and storage module (4).
- the present invention is a system that detects attacks by monitoring web applications and enables data on these attacks to be securely recorded, analyzed, and reported.
- the system includes the WAF (1) (Web Application Firewall) component, which primarily detects potential threats and attacks on web applications.
- WAF (1) captures all types of cyberattacks on web applications, along with timestamps and attack types.
- This attack data is transferred into SQL database (2), the core data management element of the system, to be stored securely and consistently in a central data repository.
- This attack data collected by WAF (1) is transmitted to SQL database (2) via the data transfer module (3) for secure and efficient transportation and organization of data.
- This module (3) manages the format and transfer protocols of the collected data, enabling the data to be transferred in real-time and securely.
- SQL Database (2) incoming data is organized via a storage module (4) and stored for analysis.
- This module (4) enables the structuring and organization of the collected data so that the data can be easily integrated into the analysis and reporting processes.
- the storage module (4) preserves data integrity, making it possible to store data for long periods of time and report it when necessary. The integrity of this system enables attacks to be detected, monitored, and managed more quickly and effectively, allowing institutions to respond more quickly and efficiently to cybersecurity risks.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Artificial Intelligence (AREA)
- Audiology, Speech & Language Pathology (AREA)
- Computational Linguistics (AREA)
- General Health & Medical Sciences (AREA)
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
This invention is related to a data management platform for security incidents, which may be adopted by large-scale enterprises, government agencies, financial institutions and healthcare providers and may be used in security operations centers to meet the needs of institutions and organizations in cybersecurity, network management and data analytics, characterized in that it comprises a WAF (1) which detects attacks by monitoring web applications and records these attacks with timestamps and types thereof, a SQL database (2) where the data collected by WAF (1) is organized, a data transfer module (3) where data collected by WAF (1) is securely transmitted in real time to SQL database (2) via a data transfer interface where the format and transfer protocols are managed, and a storage module (4) in which the data organized in the SQL database (2) are stored for the analyzing and reporting processes.
Description
A DATA MANAGEMENT PLATFORM FOR SECURITY INCIDENTS
Technological Field:
This invention is related to a data management platform for security incidents, which may be adopted by large-scale enterprises, government agencies, financial institutions and healthcare providers and may be used in security operations centers to meet the needs of institutions and organizations in cybersecurity, network management and data analytics.
State of the Art:
Today, web applications are becoming vulnerable to cyberattacks, and therefore security measures are critical. Web Application Firewalls (WAF), in this context, are a widely used technology to protect web applications. By analyzing the incoming traffic, WAFs detect and block malicious requests, and record attack data during this process. However, the existing systems face several challenges in managing, storing, and analyzing the collected data. Conventional WAF solutions often focus only on attack detection and do not offer adequate mechanisms to securely store the collected data in a central data repository. This leads to problems such as data loss, delays, and inaccurate analysis results. In addition, the existing systems often require manual intervention in data transfer processes, which increases the risk of errors and increases the intervention time to the incidents.
The patent application No. US9432335B1 describes "Cloud-Based Multi-Layered Security Architecture with Firewalled Virtual Network Partitions". The invention includes a virtual network, a web application firewall (WAF) portion to receive network traffic for one or more other portions of the virtual network; a first firewall connected to the WAF; web server portion, connected to the first firewall, to receive web traffic; a second firewall connected to the web server portion; an application server portion, connected to the second firewall, to perform application services for one or more servers of the web server portion; a third firewall connected to the application server portion; a database server portion connected to the third firewall; a fourth firewall connected to the database server portion, the application server portion, and the web server portion;
an active directory portion, connected to the fourth firewall, to perform authentication of one or more access requests associated with the virtual network; and a utility portion, connected to the first firewall and the fourth firewall.
The patent application no. CN117971866A describes "WAF Rule Engine Optimization Method and Device Based on Lexical Analysis". The invention describes a WAF rule engine optimization method based on lexical analysis. The method includes the following steps: decoding a user claim to obtain a user input parameter value; converting the parameter value entered by the user into a token string; and performing lexical analysis on the token string and determining whether the user request is a malicious one based on the result of the lexical analysis. Thanks to the WAF rule engine optimization based on lexical analysis, the false alarm rate of the WAF is reduced at a low cost, and only lexical analysis is required instead of complete grammatical analysis, so the workload is small and the analysis difficulty is low.
The above describes web application firewalls (WAFs) with various designs. These applications prevent and record various attacks. This recorded data is transmitted to log file-based monitoring systems and manual data recording methods. These data are usually recorded in log files, then processed manually. These manual processes are time-consuming and error-prone, making it difficult to properly analyze and securely store data. In addition, there are manual data entry options provided by Excel or simple database applications. In such manual processes, the possibility of human error in the recorded data is high and analysis and reporting may be disrupted.
Definition of the Invention:
The present invention is a data management platform for security incidents capable of overcoming the disadvantages mentioned above, and characterized by integrated operation of WAF and SQL database, real-time analysis and storage of data, being very fast compared to primitive methods, providing easy reporting, being low cost, and easy to use.
The invention is a platform that enables real-time detection and recording of attacks on web applications and the secure analysis and reporting of this data. Thanks to the integration of WAF and SQL database, attack data is continuously collected and
transferred securely with the data transfer module, thus eliminating errors and delays that may occur in manual processes. Storing data in a central SQL database not only maintains data integrity, but also speeds up analysis and reporting. Furthermore, the cost-effective and user-friendly nature of this system makes it viable even for small and medium-sized businesses. Thanks to the storage module, data can be stored in an orderly and organized manner and analyzed in the long term and contribute to the creation of an effective defense strategy against security vulnerabilities. In this way, institutions can take quick and proactive measures against cyberattacks and increase data security.
Description of the Drawings:
The invention will be described with reference to the accompanying figures, so that the features of the invention will be more clearly understood and appreciated, however it is not intended to limit the invention to these particular embodiments. On the contrary, it is intended all alternatives, modifications and equivalences that may be included in the field of the invention as defined by the accompanying claims are within the scope. It should be understood that the details shown are for the sole purpose of illustrating preferred embodiments of the present invention and are intended to provide the most useful and easily understandable description of both the embodiment of the methods and the rules and conceptual features of the invention. In the drawings;
Figure 1 is a schematic view of the components of the system.
The figures which will help understand this invention are numbered as indicated in the accompanying drawing and are given below with their names.
Description of the References:
1. WAF
2. SQL Database
3. Data Transfer Module
4. Storage Module
Description of the Invention:
The invention consists of WAF (1), which detects attacks by monitoring web applications and records these attacks with timestamps and types, SQL database (2) where data collected by WAF (1) is organized, data transfer module (3) where the data collected by the WAF (1) is securely transmitted in real time to the SQL database (2) via a data transfer interface where the format and transfer protocols are managed, and storage module (4) where data organized in SQL database (2) is stored for analysis and reporting.
Detailed Description of the Invention:
The constituent parts of the invention are essentially: WAF (1), SQL database (2), data transfer module (3), and storage module (4).
The present invention is a system that detects attacks by monitoring web applications and enables data on these attacks to be securely recorded, analyzed, and reported. The system includes the WAF (1) (Web Application Firewall) component, which primarily detects potential threats and attacks on web applications. WAF (1) captures all types of cyberattacks on web applications, along with timestamps and attack types. This attack data is transferred into SQL database (2), the core data management element of the system, to be stored securely and consistently in a central data repository. This attack data collected by WAF (1) is transmitted to SQL database (2) via the data transfer module (3) for secure and efficient transportation and organization of data. This module (3) manages the format and transfer protocols of the collected data, enabling the data to be transferred in real-time and securely. This eliminates delays and errors that arise in manual processes, providing a quick solution for timely analysis of data. Within SQL Database (2), incoming data is organized via a storage module (4) and stored for analysis. This module (4) enables the structuring and organization of the collected data so that the data can be easily integrated into the analysis and reporting processes. The storage module (4) preserves data integrity, making it possible to store data for long periods of time and report it when necessary. The integrity of this system enables attacks to be detected, monitored, and managed more quickly and effectively, allowing institutions to respond more quickly and efficiently to cybersecurity risks.
Claims
1 . A data management platform for security incidents, characterized in that it comprises: - a WAF (1) which detects attacks by monitoring web applications and records these attacks with timestamps and types thereof,
- a SQL database (2) where the data collected by WAF (1) is organized,
- a data transfer module (3) where data collected by WAF (1) is securely transmitted in real time to SQL database (2) via a data transfer interface where the format and transfer protocols are managed, and
- a storage module (4) in which the data organized in the SQL database
(2) are stored for the analyzing and reporting processes.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| EP25824212.2A EP4725161A1 (en) | 2024-11-07 | 2025-02-17 | A data management platform for security incidents |
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| TR2024/015352 | 2024-11-07 | ||
| TR2024/015352A TR2024015352A2 (en) | 2024-11-07 | 2024-11-07 | SECURITY EVENTS DATA MANAGEMENT PLATFORM |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2025264197A1 true WO2025264197A1 (en) | 2025-12-26 |
Family
ID=98213895
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/TR2025/050139 Pending WO2025264197A1 (en) | 2024-11-07 | 2025-02-17 | A data management platform for security incidents |
Country Status (3)
| Country | Link |
|---|---|
| EP (1) | EP4725161A1 (en) |
| TR (1) | TR2024015352A2 (en) |
| WO (1) | WO2025264197A1 (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109845228A (en) * | 2017-09-28 | 2019-06-04 | 量子位安全有限公司 | Network traffic recording system and method for real-time detection of network hacking attacks |
| CN112134844A (en) * | 2020-08-20 | 2020-12-25 | 广东网堤信息安全技术有限公司 | Framework of Web application firewall system |
| CN117614717A (en) * | 2023-12-01 | 2024-02-27 | 海南电网有限责任公司信息通信分公司 | A full-process processing system and method based on network security alarm events |
-
2024
- 2024-11-07 TR TR2024/015352A patent/TR2024015352A2/en unknown
-
2025
- 2025-02-17 EP EP25824212.2A patent/EP4725161A1/en active Pending
- 2025-02-17 WO PCT/TR2025/050139 patent/WO2025264197A1/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109845228A (en) * | 2017-09-28 | 2019-06-04 | 量子位安全有限公司 | Network traffic recording system and method for real-time detection of network hacking attacks |
| CN112134844A (en) * | 2020-08-20 | 2020-12-25 | 广东网堤信息安全技术有限公司 | Framework of Web application firewall system |
| CN117614717A (en) * | 2023-12-01 | 2024-02-27 | 海南电网有限责任公司信息通信分公司 | A full-process processing system and method based on network security alarm events |
Non-Patent Citations (2)
| Title |
|---|
| DARMAWAN IRFAN, NURIDWAN AFAN, RAHMATULLOH ALAM, GUNAWAN ROHMAT, RIZAL RANDI: "Real-time Web Application Firewall Monitoring uses the OWASP CRS Framework", 2024 NINTH INTERNATIONAL CONFERENCE ON INFORMATICS AND COMPUTING (ICIC), IEEE, 24 October 2024 (2024-10-24) - 2024-10-25, pages 1 - 6, XP093389195, DOI: 10.1109/icic64337.2024.10956835 * |
| MCNALLY STEPHEN; CURRAN KEVIN: "Web Application Vulnerabilities", 2024 8TH INTERNATIONAL SYMPOSIUM ON COMPUTER SCIENCE AND INTELLIGENT CONTROL (ISCSIC), IEEE, 6 September 2024 (2024-09-06), pages 359 - 366, XP034862166, DOI: 10.1109/ISCSIC64297.2024.00081 * |
Also Published As
| Publication number | Publication date |
|---|---|
| EP4725161A1 (en) | 2026-04-15 |
| TR2024015352A2 (en) | 2024-11-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9602530B2 (en) | System and method for predicting impending cyber security events using multi channel behavioral analysis in a distributed computing environment | |
| US20200097676A1 (en) | Data based web application firewall | |
| Saraiva et al. | CyberSoc framework a systematic review of the state-of-art | |
| US20250286899A1 (en) | Identifying unauthorized entities from network traffic | |
| Diederichsen et al. | A graph database-based approach to analyze network log files | |
| Kidmose et al. | Featureless discovery of correlated and false intrusion alerts | |
| CN115051865A (en) | Security situation perception system for realizing data maintenance | |
| WO2025264197A1 (en) | A data management platform for security incidents | |
| US20090222876A1 (en) | Positive multi-subsystems security monitoring (pms-sm) | |
| CN115481166A (en) | Data storage method and device, electronic equipment and computer storage medium | |
| CN119167358A (en) | An effective network security incident monitoring method and system based on big data model | |
| Khan | Multi-agent based forensic analysis framework for infrastructures involving storage networks | |
| Thallapally | How to Build and Maintain a Powerful Logging and Monitoring System. | |
| CN117692243A (en) | Attack link restoration method, device, computer equipment and storage medium | |
| Kishore et al. | Big data as a challenge and opportunity in digital forensic investigation | |
| Syed et al. | Fast attack detection using correlation and summarizing of security alerts in grid computing networks | |
| Xu et al. | ThreatPilot: Attack-Driven Threat Intelligence Extraction | |
| Gnatyuk et al. | Software System for Cybersecurity Events Correlation and Incident Management in Critical Infrastructure | |
| Suthar et al. | Big Data Forensics: Challenges and Approaches | |
| CN120185903B (en) | A domain name access control method, program product, electronic device, and storage medium | |
| US12621255B2 (en) | Scalable utilization of encrypted platform device connection for legal intercept of messaging data | |
| CN119561770B (en) | Xinchuang Cloud Security Operation and Maintenance Method and Device | |
| RU2834858C1 (en) | Method and system for eliminating duplicate correlation chains of events when detecting information security incidents | |
| Banoth et al. | Evaluating Alerts, Working with Network Security Data, Incident Response Models | |
| Afonso et al. | Improving DNS security using active firewalling with network probes |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| ENP | Entry into the national phase |
Ref document number: 2025824212 Country of ref document: EP Effective date: 20260112 |
|
| ENP | Entry into the national phase |
Ref document number: 2025824212 Country of ref document: EP Effective date: 20260112 |
|
| ENP | Entry into the national phase |
Ref document number: 2025824212 Country of ref document: EP Effective date: 20260112 |
|
| ENP | Entry into the national phase |
Ref document number: 2025824212 Country of ref document: EP Effective date: 20260112 |