Web driven alert verification

Web application firewall (WAF) examines malicious traffic to and from a web application via a set of security rules. It plays a significant role in securing Web applications against web attacks. However, as web attacks grow in sophistication, it is becoming increasingly difficult for WAFs to block the mutated malicious payloads designed to bypass their defenses. In response to this critical security issue, we have developed a novel learning-based framework called <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small>, designed to unveil potential bypasses in WAF detections and suggest rules to fortify their security. Using a combination of shadow models and payload generation techniques, we can identify malicious payloads and remove or modify them as needed. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small> generates signatures for these malicious payloads using advanced clustering and regular expression matching techniques to repair any security gaps we uncover. In our comprehensive evaluation of eight real-world WAFs, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small> improved the true rejection rate of mutated malicious payloads from 21% to 96%, with no false rejections. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small> achieves a false acceptance rate 3× lower than State-of-the-Art methods for generating malicious payloads. With <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">WAFBooster</small>, we have taken a step forward in securing web applications against the ever-evolving threats.

Abstract— Nowadays, web attacks have become more complicated, leading to the difficulty of traditional web application firewalls (WAFs) in recognizing those threats, especially when dealing with new attacks. Hence, machine learning/deep learning (ML/DL) approaches have been applied to the field of web attack detection with proven success. However, most existing ML/DL-based web attack detectors focus on a specific type of attack due to the difference in the payload of various attacks, which sets a border to the capability of those solutions in detecting new attack types. In this paper, we propose a novel DL-based solution for web attack detection, named DL-WAD, leveraging deep learning and natural language processing techniques. Moreover, DL-WAD is designed with a data preprocessing mechanism aimed at differentiating between regular web requests and malicious ones that carry attack payloads encompassing multiple types of web attacks. The experiment results indicate the effectiveness of our solution in protecting the target web services from a wide range of attacks with high accuracy.

Web application security has become a major requirement for any business, especially with the wide web attacks spreading despite the defensive measures and the continuous development of software frameworks and servers. In this study, we present a proposed model for a web application firewall that used machine learning and features engineering to detect common web attacks. Our proposed model analyses incoming requests to the webserver, parses these requests to extract four features that describe completely HTTP request parts (URL, payload, and headers), and classifies whether a request is normal or an anomaly. We took into consideration the limitation of previous works that use URL and payload only in classification and provided five features that describe and summarize all parts of the HTTP request using features engineering and previous experience in the field of the software security domain. Extracted features are length of request, percentage of characters allowed, percentage of special characters, and attack weight. These features were calculated for four different datasets CSIC 2010, HTTPParams 2015, Hybrid dataset (CSIC 2010 and HTTPParams), and real logs for the compromised web server. We evaluated our proposed model by using these updated datasets with four classification algorithms (Naive Bayes, logistic regression, decision tree, and support vector machine) with two methods (train test split and cross-validation) to negate the probability of overfitting and ensure that features are effective. Features values for a normal request are usually short request length, large allowed character ratio, small special character ratio, and zero attack weight or close to zero. Features values for anomaly requests are large request length, small allowed character percentage, large special character percentage, and very large numerically attack weight. Our proposed model achieved a classification accuracy of 99.6% with datasets used in research studies in this field and 98.8% with datasets of real web servers.

Sophisticated technology in the world has been developing very rapidly, especially in terms of accessing all the information that is on the web. Website is one of technological sophistication that presents various kinds of information needed, from children to adults easily accessing websites on the internet. Unwittingly the number of accesses made by users around the world causes a web server or a place that provides a website will be weak and can occur down. When a web server becomes weak, hackers will use it to attack the web server, retrieve data, important information, and even more fatal is when user data is stolen and misused by hackers. The web developers only focus on a website appearance but do not focus on access and security of the website. Therefore, we need an optimal web server that can accommodate the many accesses caused by users and the security of the web server to safeguard data and information stored. This research applies a package namely Reverse Proxy which is used to optimize a web server and Web Application Firewall which is used to maintain the security of a web server.

Cross-Site Scripting (XSS) is an unremitting problem for the Web. Since its initial public documentation in 2000 until now, XSS has been continuously on top of the vulnerability statistics. Even though there has been a considerable amount of research and developer education to address XSS on the source code level, the overall number of discovered XSS problems remains high. Because of this, various approaches to mitigate XSS have been proposed as a second line of defense, with HTML sanitizers, Web Application Firewalls, browser-based XSS filters, and the Content Security Policy being some prominent examples. Most of these mechanisms focus on script tags and event handlers, either by removing them from user-provided content or by preventing their script code from executing. In this paper, we demonstrate that this approach is no longer sufficient for modern applications: We describe a novel Web attack that can circumvent all of theses currently existing XSS mitigation techniques. In this attack, the attacker abuses so called script gadgets (legitimate JavaScript fragments within an application's legitimate code base) to execute JavaScript. In most cases, these gadgets utilize DOM selectors to interact with elements in the Web document. Through an initial injection point, the attacker can inject benign-looking HTML elements which are ignored by these mitigation techniques but match the selector of the gadget. This way, the attacker can hijack the input of a gadget and cause processing of his input, which in turn leads to code execution of attacker-controlled values. We demonstrate that these gadgets are omnipresent in almost all modern JavaScript frameworks and present an empirical study showing the prevalence of script gadgets in productive code. As a result, we assume most mitigation techniques in web applications written today can be bypassed.

Finding differences between programs with similar functionality is an important security problem as such differences can be used for fingerprinting or creating evasion attacks against security software like Web Application Firewalls (WAFs) which are designed to detect malicious inputs to web applications. In this paper, we present SFADIFF, a black-box differential testing framework based on Symbolic Finite Automata (SFA) learning. SFADIFF can automatically find differences between a set of programs with comparable functionality. Unlike existing differential testing techniques, instead of searching for each difference individually, SFADIFF infers SFA models of the target programs using black-box queries and systematically enumerates the differences between the inferred SFA models. All differences between the inferred models are checked against the corresponding programs. Any difference between the models, that does not result in a difference between the corresponding programs, is used as a counterexample for further refinement of the inferred models. SFADIFF's model-based approach, unlike existing differential testing tools, also support fully automated root cause analysis in a domain-independent manner. We evaluate SFADIFF in three different settings for finding discrepancies between: (i) three TCP implementations, (ii) four WAFs, and (iii) HTML/JavaScript parsing implementations in WAFs and web browsers. Our results demonstrate that SFADIFF is able to identify and enumerate the differences systematically and efficiently in all these settings. We show that SFADIFF is able to find differences not only between different WAFs but also between different versions of the same WAF. SFADIFF is also able to discover three previously-unknown differences between the HTML/JavaScript parsers of two popular WAFs (PHPIDS 0.7 and Expose 2.4.0) and the corresponding parsers of Google Chrome, Firefox, Safari, and Internet Explorer. We confirm that all these differences can be used to evade the WAFs and launch successful cross-site scripting attacks.

Web Application Firewalls (WAFs) serve as a critical defense mechanism against various web-based attacks such as SQL Injection (SQLi), Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), Remote Code Execution (RCE), and NoSQL Injection. However, modern adversaries often craft evasive and obfuscated payloads capable of bypassing traditional WAF rules. To effectively assess and challenge the robustness of WAFs, we propose DEG-WAF, a Deep Evasion Generation framework that leverages Large Language Models (LLM) in conjunction with Reinforcement Learning (RL) to generate evasive payloads against WAFs. The system consists of four core components: a payload generation agent based on a pre-trained LLM (OPT-125M), a reward model that approximates WAF behavior, a grammar-based sampling agent that ensures syntactic validity, and an RL agent trained with either Proximal Policy Optimization (PPO) or Advantage Actor-Critic (A2C) to fine-tune generation strategies. Experimental evaluations on real-world WAFs, including ModSecurity and SafeLine, demonstrate that the A2C-based model significantly outperforms baseline LLMs—achieving a bypass success rate of 80.16% on SQLi and 74.70% on NoSQLi for ModSecurity, and 97.8% on RCE for SafeLine. These results underscore the potential of our LLM-RL framework to serve as a robust foundation for evaluating and enhancing the resilience of WAF systems under adversarial conditions.

The increasing complexity and sophistication of web-based applications have made them vulnerable to various security threats. Web Application Firewalls (WAFs) have emerged as an essential security measure to protect web applications from common attacks such as SQL injection, cross-site scripting (XSS), and others. This research paper explores the techniques and challenges involved in controlling web traffic using a Web Application Firewall. The paper discusses the working principles of WAFs, the various methods employed to analyze and filter web traffic, and the effectiveness of these techniques in mitigating different types of attacks. Additionally, the paper highlights the challenges faced in deploying and managing WAFs and provides insights into potential future developments in the field. This research paper delves into the techniques and challenges associated with controlling web traffic using a Web Application Firewall. It explores the fundamental principles of WAFs, including signature-based filtering, behavior-based analysis, whitelisting, blacklisting, rate limiting, and protection against common vulnerabilities. The paper evaluates the effectiveness of these techniques in mitigating various attacks and highlights the challenges involved in deploying and managing WAFs, such as configuration complexity, false positives and negatives, performance impact, and integration with existing security infrastructure. Furthermore, the paper discusses emerging trends and potential future directions in the field, including the integration of machine learning and artificial intelligence, advanced behavioral analysis techniques, and cloud-based architectures.

Internet and computer systems are an indispensable part of daily life. The number of web applications have increased with the development of technology and digital transformation. Web applications have high risk for security since the applications is not developed securely, contains vulnerabilities and easily accessible by hackers. Web application firewall is used to protect web applications from attacks. Signature-based and anomaly-based methods are used in web application firewalls. In this research, anomaly-based web application firewall model was developed using natural language processing techniques and linear support vector machine learning algorithm. Word n-gram and character n-gram natural language processing techniques were compared by performing separate models. Proposed model achieve higher detection performance with using the character n-gram compared to other studies. According to the results of the experiment proposed model is capable of detection web attacks effectively with the overall detection accuracy rate of 99.53%.

Web applications are not protected by today's network level firewalls, because they allow access to TCP port 80 without restrictions. However, many successful attacks today are not on the network level, but on application level. For protecting against application level attacks, a firewall must understand the application protocols, that are used on its open ports. This happens in application level firewalls and for Web application in Web application firewalls. The underlying concepts of Web application firewalls differ much from the concepts of traditional network level firewalls. This book explains the underlying concepts of Web application firewalls. Afterwards, they are applied to a collection of security requirements, that application developers should respect today for developing a secure Web application. A Web application firewall is capable of automatically implementing many of these requirements. As a result, Web application developers can ignore these requirements, because the Web applications firewall already ensures their implementation and therefore the security of the Web application. This book is intended for anyone, who is interested in securing his Web application.

Protecting Web Based Applications: A Best Practices Guide

A critical review of the techniques used for anomaly detection of HTTP-based attacks: taxonomy, limitations and open challenges

Web Application Firewall (WAF) is widely deployed in cloud to protect web applications, whose performance becomes one of the major bottlenecks for web services. In this paper, we comprehensively analyze several root causes that downgrade WAF’s efficiency. Inspired by that, we build a caching system RuleCache to devise optimization strategies for improving WAF’s performance. Among, Rule Ordering Cache is online learning an optimal order of the ruleset for a better performance of blocking. Rule Result Cache reuses rule results of targets, saving large repetitive computations. Additionally, Rule Prepruning Cache aims to cut extra overhead by processing the static rules in the offline stage. Our evaluation demonstrates that the prototype can improve the performance by up to 3.85x, 1.57x, and 2.4x respectively with the above modules, and up to 5.5x in total.

In the contemporary digital landscape, the security of web applications is a pressing concern. Cyber threats continue to evolve, challenging the resilience of existing defense mechanisms. This project introduces an innovative Web Application Firewall (WAF) strengthened by Neural Network (NN) technologies. The primary aim of this project is to enhance web application security by proactively identifying and thwarting malicious attacks. Leveraging deep learning techniques, the NN-based WAF analyzes incoming HTTP requests in real time, distinguishing between legitimate and potentially harmful traffic. Through meticulous data collection, feature engineering, and model training, the WAF exhibits robust and adaptive behavior. This project represents a pivotal advancement in web application security. By harnessing the power of neural networks, it provides real-time protection against a wide spectrum of cyber threats. The NN-based WAF adapts to the evolving threat landscape, making it an indispensable tool for safeguarding web applications in an era of dynamic and persistent security challenges.

As part of a continuing research for evaluating threats posed for exposed attack surface, this study will provide a consolidated view of exploitability of vulnerable applications presenting a web attack surface of an organization exposed to an attacker. While testing and scanning technologies like Static Analysis Security Testing (SAST), Dynamic Analysis Security Testing (DAST), Application Ethical Hack (Penetration Testing), a monitoring technology like the Web Application Firewall (WAF) provides web traffic information of the number of transaction requests for every application under study. To ensure validity, reliability, and completeness of observation multiple applications must be observed. Research from a prior study is referenced that shows correlation between incoming WAF requests and existing vulnerabilities. Using correlation analysis, vulnerabilities metrics, and a threat model analysis help identify pathways to an attack. A vulnerability map-based attack tree can be developed using Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE) information. The threat model analysis and vulnerability-based attack tree can help in simulation studies of possible attacks. This attack tree will show the linkages between vulnerabilities and a lineage pointing to how an attack could travel from the incoming WAF requests to deep down into the application code of exposed and existing, open vulnerabilities travelling laterally to create a more expanded attack crossing trust boundaries using application data flow.