A Whitelist Detection Mechanism Based on Modsecurity

Abstract

Modsecurity is a popular web application firewall prototype system, which mainly employs blacklist mechanism. By analyzing the characteristics of attack and extracting features into rules, the blacklist mechanism can filter the typical malicious attacks effectively. However, there still exists some disadvantages in it. For example, over strict rules library can easily lead to misjudgment, and the large numbers of rules will constrain the concurrent access to the web server. To overcome these drawbacks, we propose a white list mechanism on the basis of Modsecurity blacklist, which adds trusted URL to white list and makes these URL directly access to the web server without filtering by blacklist. Furthermore, our scheme can effectively reduce the response time of concurrent access to the web server.