Web Application Firewalls Research Articles

Using WAF to protect the university’s internal services in the Zero Trust structure

The article presents the results of a pilot study on the use of a Web Application Firewall (Web Application Firewall or WAF) to protect the internal services of the information educational environment of the university (IEEU). It is shown that this task is extremely important in the context of globalization of education. The use of WAF is performed in the Zero Trust structure. The system was tested in two stages. Firstly, tools were used to automate the search for web vulnerabilities (web vulnerability scanners) IEEU. At the second stage, manual testing of applications for vulnerabilities of SQL injection, cross-site scripting and Path Traversal attacks was carried out. It is shown that the results obtained make it possible to improve the protection of services in the university’s local networks, which is important for achieving the ultimate goal effective protection of end users and IEEU services in the context of globalization of education. It has been established that the use of WAF in systems with zero trust is a fairly common option for protecting services within organizations, including educational ones. It is shown that the use of open WAF solutions in the Zero Trust structure allows you to more flexibly and personally adjust protection to the appropriate needs of university services.

DASH Framework Using Machine Learning Techniques and Security Controls

Interest in video streaming has increased recently, as it constitutes most of the traffic on the Internet and cellular networks. These networks use different video streaming technologies. One of the most famous technologies is DASH (which stands for Dynamic Adaptive Steaming using HTTP). DASH adapts streaming parameters according to network conditions and uses the HTTP protocol to communicate between the user and the server. DASH faces many challenges that may lead to video interruptions and poor quality of user experiences (QoE) such as bad network conditions and buffering level control. In addition to the lack of studies, we cover security issues for these types of services. In this paper, we proposed an integrated framework that consists of four components: quality prediction model, precache model, light web application firewall, and a monitoring system. These four components improve QoE and precache and increase the level of security. The results of the quality prediction model are used to predict the quality of the next segments depending on the user’s network conditions and in the precache model to improve caching to reduce the load on the streaming system and rely more on cache servers. The proposed web application firewall is a light version used to defend against video streaming attacks and verify the existence of necessary HTTP headers. The quality predictor model with the generated dataset achieved 97% classification accuracy using DecisionTree, and this experiment proved the strong relationship between congestion periods and streaming quality, which is s the main key in QoE.

Web Application Firewall Using Machine Learning and Features Engineering

Web application security has become a major requirement for any business, especially with the wide web attacks spreading despite the defensive measures and the continuous development of software frameworks and servers. In this study, we present a proposed model for a web application firewall that used machine learning and features engineering to detect common web attacks. Our proposed model analyses incoming requests to the webserver, parses these requests to extract four features that describe completely HTTP request parts (URL, payload, and headers), and classifies whether a request is normal or an anomaly. We took into consideration the limitation of previous works that use URL and payload only in classification and provided five features that describe and summarize all parts of the HTTP request using features engineering and previous experience in the field of the software security domain. Extracted features are length of request, percentage of characters allowed, percentage of special characters, and attack weight. These features were calculated for four different datasets CSIC 2010, HTTPParams 2015, Hybrid dataset (CSIC 2010 and HTTPParams), and real logs for the compromised web server. We evaluated our proposed model by using these updated datasets with four classification algorithms (Naive Bayes, logistic regression, decision tree, and support vector machine) with two methods (train test split and cross-validation) to negate the probability of overfitting and ensure that features are effective. Features values for a normal request are usually short request length, large allowed character ratio, small special character ratio, and zero attack weight or close to zero. Features values for anomaly requests are large request length, small allowed character percentage, large special character percentage, and very large numerically attack weight. Our proposed model achieved a classification accuracy of 99.6% with datasets used in research studies in this field and 98.8% with datasets of real web servers.

Deep Learning for Vulnerability and Attack Detection on Web Applications: A Systematic Literature Review

Web applications are the best Internet-based solution to provide online web services, but they also bring serious security challenges. Thus, enhancing web applications security against hacking attempts is of paramount importance. Traditional Web Application Firewalls based on manual rules and traditional Machine Learning need a lot of domain expertise and human intervention and have limited detection results faced with the increasing number of unknown web attacks. To this end, more research work has recently been devoted to employing Deep Learning (DL) approaches for web attacks detection. We performed a Systematic Literature Review (SLR) and quality analysis of 63 Primary Studies (PS) on DL-based web applications security published between 2010 and September 2021. We investigated the PS from different perspectives and synthesized the results of the analyses. To the best of our knowledge, this study is the first of its kind on SLR in this field. The key findings of our study include the following. (i) It is fundamental to generate standard real-world web attacks datasets to encourage effective contribution in this field and to reduce the gap between research and industry. (ii) It is interesting to explore some advanced DL models, such as Generative Adversarial Networks and variants of Encoders–Decoders, in the context of web attacks detection as they have been successful in similar domains such as networks intrusion detection. (iii) It is fundamental to bridge expertise in web applications security and expertise in Machine Learning to build theoretical Machine Learning models tailored for web attacks detection. (iv) It is important to create a corpus for web attacks detection in order to take full advantage of text mining in DL-based web attacks detection models construction. (v) It is essential to define a common framework for developing and comparing DL-based web attacks detection models. This SLR is intended to improve research work in the domain of DL-based web attacks detection, as it covers a significant number of research papers and identifies the key points that need to be addressed in this research field. Such a contribution is helpful as it allows researchers to compare existing approaches and to exploit the proposed future work opportunities.

Web Intrusion Detection Systems Comparison: Techniques and usage

Web attacks are one of the most concern these days. Vulnerable applications require protection, which can be provided through web application firewalls (WAF) and web intrusion detection systems (WIDS). Some of them are signature based and some detect / protect through anomaly detection. Various commercial solutions have been offered by vendors like CISCO ACE application firewall, Barracuda application firewall etc. Open source community has also contributed some formidable solutions like ModSecurity, PHPIDS, Ironbee, WebKnight and Snort etc. No solution has yet proven to be the silver bullet and this area is still a subject of active research. Inability to detect any novel attack has been the common weakness and has lead to various techniques being proposed for identifying zero-day attacks. In this paper, we analyze various commercial and open source web application protection solutions and make comparative analyses of their strengths andweaknesses, identifying any areas that still need attention of the research community.

Dynamic Web Application Firewall Detection Supported by Cyber Mimic Defense Approach

Dynamic Web Application Firewall Detection Supported by Cyber Mimic Defense Approach

Peningkatan Keamanan Aplikasi Web Menggunakan Web Application Firewall (WAF) Pada Sistem Informasi Manajemen Kampus Terintegrasi

Increasing the security of web applications on the integrated campus management information system needs to be done because the application is accessed by public networks so that there are many attacks and attempts to prevent threats from attackers. This study applies a Web Application Firewall (WAF)-based application security using ModeSecurity and Core Rules Set from Owasp which aims to improve the security system of the web application by using a firewall. This study uses an experimental method by implementing a Web Application Firewall (WAF) as a web-based protection system, then the process of analysis and testing to obtain accurate advice on firewall implementation. The results of this study indicate that the firewall used with Web Application Firewall (WAF)-based ModeSecurity has succeeded in stopping attacks from attackers using Cross Site Scripting (XSS) and SQL Injection methods.

An enhanced deep learning based framework for web attacks detection, mitigation and attacker profiling

Protecting web applications is becoming challenging every passing day, primarily because of attack sophistication, omnipresence of web applications and over-reliance on traditional Web Application Firewalls (WAFs). Advanced Persistent Threats (APTs) make overwhelming use of web attacks during infiltration and expansion phase. Noteworthy research has been carried out to detect web attacks using deep learning because traditional approaches fail against complicated attacks having crafted payloads, scripts and cookie manipulations. This paper proposes a framework based on an enhanced hybrid approach where Deep Learning model is nested with a Cookie Analysis Engine for web attacks detection, mitigation and attacker profiling in real time. We first generated a huge dataset over a period of time and trained our Convolution Neural Network (CNN) based deep learning model using Hypertext Transfer Protocol (HTTP) request parameters like Type, Content length, Data and Requested URL etc. We also developed a Cookie Analysis Engine that checks all incoming cookie(s) for integrity, mutations and failed sanitization checks and informs the user about probable privacy infringement by third party cookies. The framework analyzes the cascading output from the classifier and cookie analysis engine and takes the final decision. We performed rigorous testing of the proposed framework wherein it was first validated on our own custom dataset giving an accuracy of 99.94%. It was also validated on a publicly available benchmark dataset and gave an accuracy of 98.74%. When deployed in a controlled real time environment, the attacker profiling feature enabled the framework to save useful processing time as the deep learning classifier does not get triggered for every incoming request. This makes it easy to deploy in any environment to protect web applications in real time.

Penerapan Sistem Keamanan Web Menggunakan Metode Web Aplication Firewall

The application of a security system on the web needs to be done considering that the web itself can be accessed through a public network. In this study, a Web Application Firewall (WAF)-based security system will be implemented using modsecurity, in which the purpose of implementing this web security system is to understand the concept of a security system on the web and pay attention to the results before the application of the firewall and after the application of the firewall on the web. This research uses experimental research methods, in this study the implementation of a web application firewall (WAF) using modsecurity as a web security system is carried out, then an analysis is carried out to get the right recommendations for a firewall as a web security system. The results of this study indicate that a firewall using the modSecurity module and rule based on the Web Application Firewall (WAF) on a web security system can block SQL Injection, Cross Site Scripting (XSS), and Command Execution by displaying an error message to the user who performs the command.

Traffic and overhead analysis of applied pre-filtering ACL firewall on HPC service network

In an high-performance computing (HPC), supercomputing service environment, the security of infrastructure nodes that are points of contact for researchers is very important. We have applied various security devices such as anti-DDoS, IPS, firewall, web application firewall, and etc. on an HPC service network to provide more secure supercomputing services. Firewalls are a common and essential element of network security devices with the ability to block network traffic according to pre-defined rules. With the increasing demands for services, cyberattacks, as well as overheads on firewall policies have also increased. To reduce this overhead, in our previous research, we analyzed dropped packets log and performed a method on the firewall as Abnormal IP that can detect and deny anomalous IPs in real-time. As the number of abnormal IPs increased, the performance of the firewall significantly deteriorated. To solve this problem, we applied access control list (ACL) at the front-end of the firewall to perform pre-filtering, thereby improving the performance of the firewall on the HPC service network. This research is expected to contribute as a preliminary study in the HPC field by deriving pre-filtering ACL to reduce the CPU load of firewall server by showing the result of about 21.5% improvement in performance.

Bridging the Gap between Web Application Firewall and Web Applications

Bridging the Gap between Web Application Firewall and Web Applications

A new WAF architecture with machine learning for resource-efficient use

Web Application Firewalls penalizes everyone, including latency in all requests, whether they are malicious or not. Several studies have reported the benefits of using Machine Learning to extract new rules to detect malware and malicious web requests. However, comparing the metrics of the models with their use of computational resources remains to be accomplished. This work aims to show a distributed WAF architecture, using ML classifiers as one of its components. Instead of having an enforcement point that analyzes the complete HTTP protocol for violations in this architecture, we have a trained classifier to detect them. The first part of this work verifies the viability of using classifiers based on their metrics, such as accuracy and recall. We analyze two datasets and make comparisons about their use. The second part of this paper compares ML models’ prediction processing time and a rules-based engine’s processing time. The classifiers used in this paper had a processing time of about 18x less than a rule-based engine. We also show that a classifier can find errors in the classification of a dataset generated by a WAF based on rules. We present samples and experimental codes to show the difference in approaches.

Search of real network addresses of web applications using the CDN service

In the following research, we have considered the problem of finding real network addresses of web applications. For this purpose, we have used a service, which based on providing content delivery to networks. Thus, the known solutions are analyzed, and their features of use are established. Among them, the focus of this service on speeding up the operation and security of web applications is highlighted. Taking into account these features, this issue is complicated by the focus on describing the technical capabilities of the already known solutions. This limits the detection of web application of configuration vulnerabilities. To prevent this, the capabilities of content delivery networks have been used. This use is based on redirecting HTTPS traffic through their servers and, as a result, hiding the real IP address of the web application. The most common implementations of the service based on content delivery networks are highlighted. The focus on the web application firewall is shown. Its applicability at the configuration of DNS requests and finding of real network addresses is established. Also, the most typical methods of their search are identified. Among them, the emphasis is placed on the use of services for viewing current and archival data of Internet resources; using MX records as sources of IP addresses; sending letters by e-mail to the specified (correct or incorrect) e-mail addresses; finding subdomains without a configured service of content delivery networks; obtaining an SSL certificate; using DNS name research tools. The implementation of these methods is demonstrated by the selected software. To do this, the criteria are introduced and their capabilities are compared. The results of using the selected software show the limitations of its functionality. To prevent this, it is recommended to combine methods of searching for real network addresses of web applications using the service of content delivery networks.

An Improved Feature Extraction Approach for Web Anomaly Detection Based on Semantic Structure

Anomaly-based Web application firewalls (WAFs) are vital for providing early reactions to novel Web attacks. In recent years, various machine learning, deep learning, and transfer learning-based anomaly detection approaches have been developed to protect against Web attacks. Most of them directly treat the request URL as a general string that consists of letters and roughly use natural language processing (NLP) methods (i.e., Word2Vec and Doc2Vec) or domain knowledge to extract features. In this paper, we proposed an improved feature extraction approach which leveraged the advantage of the semantic structure of URLs. Semantic structure is an inherent interpretative property of the URL that identifies the function and vulnerability of each part in the URL. The evaluations on CSIC-2020 show that our feature extraction method has better performance than conventional feature extraction routine by more than average dramatic 5% improvement in accuracy, recall, and F1-score.

Signature-based and Machine-Learning-based Web Application Firewalls: A Short Survey

Web Application Firewalls (WAF) have evolved to protect web applications from attack. A signature-based WAF responds to threats through the implementation of application-specific rules which block malicious traffic. However, these rules must be continually adapted to address evolving threats. The resultant rules can become complex and difficult to maintain, requiring that the administrator possesses a high-level of skills and detailed knowledge of the application. Not to mention the challenges of zero-day attacks! A WAF can deliver high rates of false positives and false negatives that can adversely impact the performance and can provide poor protection against zero-day attacks. This paper aims to provide a short review showing the development of WAFs based on machine-learning-based methods. It discusses their merits and limitations as well as identifying open issues. It assesses which of them can provide countermeasures to zero-day attacks and are easy to configure and maintain to keep them up to date. It was found that machine-learning-based methods have advantages over signature/rule-based methods as the former can address the vulnerability to zero-day attacks and can be easier to configure and keep up to date. The survey also determined that the effectiveness of machine-learning-based WAFs in protecting current attack patterns targeting web application frameworks is still an open area for further investigation.

INTEGRATION AND PROTECTION OF IOT DEVICES IN THE AVAILABLE INFRASTRUCTURE OF THE COMPUTER NETWORK OF THE EDUCATIONAL INSTITUTIONS

The development of computer networks is gaining momentum. There are new challenges to data security and the end users themselves. With the advent of the Internet of Things, this problem has become quite acute for network engineers and cyber analysts. Increasingly, there are illegal actions to interfere with the work of the network itself and the use of users' devices for criminal purposes. Various distributed attacks, SQL injections and identity theft are becoming more complex. Given the growing infrastructure of both the network and IoT devices, there is a need to protect them. Especially when it comes to the computer network of a higher education institution. Where little attention is usually paid to full infrastructure protection, and with the integration of IoT devices, such possible gaps can occur quite a lot. This article attempts to reveal theoretical approaches to the design and implementation of a computer network of higher education institutions, which in recent years are increasingly beginning to suffer from outside interference. Possible attacks on the infrastructure of higher education institutions are analyzed, as well as the possibility of attack and interference in the work of IoT devices based on the killer chain approach. Internet The possibility of using a web application firewall and appropriate software for security and incident management at the L5-L7 OSI level is considered in such networks. Preliminary testing of the network for the ability to respond to L3-L4 level attacks using standard firewall capabilities. And with the response to interventions at the upper levels of the OSI L5-L7 model, namely: SQL injections, distributed DDoS, bot-net attacks. The results are summarized and further directions of research are determined, which are based on the improvement of the group security policy for the higher education institution. Development of security infrastructure for IoT devices and the ability to respond quickly to non-standard attacks.

Применение машинного обучения в защите веб-приложений

Security of network systems has become a necessity, as more and more important information is stored and used online. The spread of web applications opens up new attack vectors. Traditional security mechanisms, such as firewalls, are not designed to protect web applications and therefore do not provide adequate protection. Current attacks cannot be prevented only by blocking ports 80 (HTTP) and 443 (HTTPS). Preventative measures (such as web application firewall rules) are not always possible. Signature methods for detection are always behind the actual event. Protocol-enforced network firewalls usually provide the first line of defense, delaying most major attacks on the network perimeter. They mainly work on the network, session, and transport layers of the reference network model (OSI). Developers have significantly expanded the capabilities of network firewalls to control the integrity of a wide range of top-level protocols, such as DNS, FTP, HTTP, SMTP, and TFTP. Standard firewalls can help restrict or allow access to network ports. Although application proxy firewalls exist, they cannot understand the specific content of all web applications run by an enterprise. The purpose of this article is to study the features of using machine learning in web application protection. Methods of web application security and learning neural networks were studied. The result of this work is a theoretical overview of the neural network security of a web application.

A Review on Machine Learning and Deep Learning Perspectives of IDS for IoT: Recent Updates, Security Issues, and Challenges

Internet of Things (IoT) is widely accepted technology in both industrial as well as academic field. The objective of IoT is to combine the physical environment with the cyber world and create one big intelligent network. This technology has been applied to various application domains such as developing smart home, smart cities, healthcare applications, wireless sensor networks, cloud environment, enterprise network, web applications, and smart grid technologies. These wide emerging applications in variety of domains raise many security issues such as protecting devices and network, attacks in IoT networks, and managing resource-constrained IoT networks. To address the scalability and resource-constrained security issues, many security solutions have been proposed for IoT such as web application firewalls and intrusion detection systems. In this paper, a comprehensive survey on Intrusion Detection System (IDS) for IoT is presented for years 2015–2019. We have discussed various IDS placement strategies and IDS analysis strategies in IoT architecture. The paper discusses various intrusions in IoT, along with Machine Learning (ML) and Deep Learning (DL) techniques for detecting attacks in IoT networks. The paper also discusses security issues and challenges in IoT.

An adaptive anomaly request detection framework based on dynamic web application profiles

Web application firewall is a highly effective application in protecting the application layer and database layer of websites from attack access. This paper proposes a new web application firewall deploying method based on Dynamic Web application profiling (DWAP) analysis technique. This is a method to deploy a firewall based on analyzing website access data. DWAP is improved to integrate deeply into the structure of the website to increase the compatibility of the anomaly detection system into each website, thereby improving the ability to detect abnormal requests. To improve the compatibility of the web application firewall with protected objects, the proposed system consists of two parts with the main tasks are: i) Detect abnormal access in web application (WA) access; ii) Semi-automatic update the attack data to the abnormal access detection system during WA access. This new method is applicable in real-time detection systems where updating of new attack data is essential since web attacks are increasingly complex and sophisticated.

Improving Efficiency of Web Application Firewall to Detect Code Injection Attacks with Random Forest Method and Analysis Attributes HTTP Request

In the era of information technology, the use of computer technology for both work and personal use is growing rapidly with time. Unfortunately, with the increasing number and size of computer networks and systems, their vulnerability also increases. Protecting web applications of organizations is becoming increasingly relevant as most of the transactions are carried out over the Internet. Traditional security devices control attacks at the network level, but modern web attacks occur through the HTTP protocol at the application level. On the other hand, the attacks often come together. For example, a denial of service attack is used to hide code injection attacks. The system administrator spends a lot of time to keep the system running, but they may forget the code injection attacks. Therefore, the main task for system administrators is to detect network attacks at the application level using a web application firewall and apply effective algorithms in this firewall to train web application firewalls automatically for increasing his efficiency. The article introduces parameterization of the task for increasing the accuracy of query classification by the random forest method, thereby creating the basis for detecting attacks at the application level.