System and method for pattern-based detection and mitigation of zero-day vulnerability exploitation

Abstract

A method implemented on an electronic device detects and mitigates software attacks exploiting a zero-day vulnerability, such as Spring4Shell, against a computer server. At least one initial identifier, which indicates an attempt to extract a predetermined type of information on the computer server, is detected within an activity log of the computer server to thereby indicate occurrence of an initial stage. Then, prior to elapsing of a search window having a predetermined time duration, at least one subsequent identifier, which indicates an attempt to perform remote code execution on the computer server, is detected within the activity log of the computer server. Then, a source of network activity associated with the detected identifiers is detected, and a security response associated with the identified source of network activity is performed to mitigate the exploitation of the vulnerability.