Method for active identification and automatic release rule generation of WAF false interception

Abstract

The application discloses a kind of WAF misinterception active identification and automatically generated release rule method.WAF misinterception active identification and automatically generated release rule method includes: correlation analysis WAF alarm and interception log, and user information related data, to determine the relationship between WAF alarm and interception log and user, generate the rich WAF alarm and interception log containing user information;Based on user, rich WAF alarm and interception log are grouped, and based on threat determination strategy, according to each group of log, it is judged whether the corresponding user of it is threat user;From rich WAF alarm and interception log, rich WAF interception log is screened out, and based on interception rule, rich WAF interception log is grouped;Based on misinterception determination strategy, according to each group of interception log, it is judged whether the corresponding rule of it occurs misinterception;For the rule that misinterception occurs, adaptive release processing is carried out.The application effectively guarantees the safe operation of business while guaranteeing the stability and coherence of business.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method for proactively identifying and automatically generating release rules for WAF (Web Application Firewall) false blocking. Background Technology

[0002] WAF (Web Application Firewall) is an important method for protecting web applications, such as websites like Taobao. Before an HTTP request to access a website is submitted to the site, it must first undergo security testing by the WAF. WAF supports the detection of security attacks and risks, including SQL injection, command injection, code injection, deserialization, and information leakage. When a risk is identified, WAF will block the relevant request or response to defend against the target website.

[0003] However, even with various WAF products on the market, no WAF product can completely eliminate false blocking; this is virtually impossible. Such risks are even more pronounced during business changes, a situation that WAF products cannot avoid. If a WAF product experiences large-scale false blocking, the impact on business operations can be fatal, potentially causing numerous service outages in a short period. Traditional methods for dealing with WAF false blocking involve waiting for users to submit support tickets, which the operations team then manually investigates, a process that can take hours or even days. Other methods analyze false blocking risks based on IP addresses and response codes, but these have limited applicability and are not very effective. Summary of the Invention

[0004] This invention provides a method for proactively identifying and automatically generating release rules for WAF false blocking, in order to solve the problem of poor performance of existing false blocking handling methods.

[0005] The method for proactively identifying and automatically generating allowance rules for WAF false blocking according to embodiments of the present invention includes:

[0006] Correlation analysis is performed on WAF alarm and interception logs and user information-related data to determine the relationship between the WAF alarm and interception logs and users, and to generate enriched WAF alarm and interception logs containing user information;

[0007] Based on the user's grouping of the enriched WAF alarm and interception logs, and based on the threat determination strategy, it is determined whether the user corresponding to each group of logs is a threat user.

[0008] The enriched WAF interception logs are filtered out from the enriched WAF alarm and interception logs, and the enriched WAF interception logs are grouped according to the interception rules.

[0009] Based on the false blocking detection strategy, it is determined whether the corresponding rule of each group of blocking logs has been falsely blocked;

[0010] Adaptive handling is used to allow rules that are mistakenly blocked.

[0011] According to some embodiments of the present invention, the correlation analysis of WAF alarm and interception logs and user information-related data to determine the relationship between the WAF alarm and interception logs and the user, and to generate enriched WAF alarm and interception logs containing user information, includes:

[0012] Correlation analysis is performed on WAF alarm and interception logs, WAF access logs, and user session data to generate enriched WAF alarm and interception logs containing username information;

[0013] For the remaining WAF alarms and interception logs that cannot be enriched to include username information, they are grouped according to a preset standard and user IDs are randomly generated to generate enriched WAF alarms and interception logs containing random user IDs.

[0014] According to some embodiments of the present invention, the grouping of the enriched WAF alarm and interception logs based on user input includes:

[0015] The enriched WAF alarms and interception logs are grouped based on application and user preferences.

[0016] According to some embodiments of the present invention, the step of determining whether a user corresponding to each group of logs is a threat user based on a threat determination strategy includes:

[0017] For each group of logs, a threat score is calculated based on scoring points and a weighting strategy for those scoring points. The scoring points include: the number of duplicate entries deduplicated by matching interception rules, the number of duplicate entries deduplicated by matching alarm rules, the number of deduplicated applications triggered by alarm or interception rules and scored according to the weighting strategy, the number of deduplicated application interfaces triggered by alarm or interception rules, and user-defined scoring points.

[0018] Based on the threat score and threat score threshold, it is determined whether a user is a threat user.

[0019] According to some embodiments of the present invention, the step of determining whether a rule corresponding to each group of interception logs has been falsely intercepted based on the false interception determination strategy includes:

[0020] For each group of intercepted logs, a false interception score is calculated based on the bonus points and a weighted strategy for the bonus points. The bonus points include: the total number of deduplicated users excluding threat users, the creation time of the matching interception rule, and user-defined bonus points.

[0021] Based on the false interception score and the false interception score threshold, it is determined whether the rule has caused a false interception.

[0022] According to some embodiments of the present invention, the adaptive allowance processing for rules that have been falsely blocked includes:

[0023] Based on the false blocking score corresponding to the false blocking rule and the preset blacklist and whitelist, determine whether the false blocking rule meets the adaptive repair conditions;

[0024] For false blocking rules that meet the adaptive repair conditions, allow them to pass according to the allow rules selected by the user.

[0025] According to some embodiments of the present invention, determining whether a false blocking rule meets the adaptive repair condition by combining the false blocking score corresponding to the false blocking rule and a preset blacklist or whitelist includes:

[0026] If the false blocking score corresponding to a false blocking rule is less than the preset repair score, and the false blocking rule is in the preset blacklist, then the false blocking rule is determined to meet the adaptive repair conditions.

[0027] According to some embodiments of the present invention, the release rules include:

[0028] Once the first condition is met, the entire blocking rule is allowed.

[0029] Once the second condition is met, allow the blocking rules that match the application list that were mistakenly blocked by the blocking rules to proceed.

[0030] After the third condition is met, the blocking rules matching the relevant application interfaces of the application list that were mistakenly blocked by the blocking rules are allowed to proceed.

[0031] User-defined rules.

[0032] According to an embodiment of the present invention, a device for proactively identifying and automatically generating allowance rules for WAF false interception includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the method for proactively identifying and automatically generating allowance rules for WAF false interception as described above.

[0033] According to an embodiment of the present invention, a computer-readable storage medium stores an information transmission implementation program, which, when executed by a processor, implements the steps of the method for proactively identifying and automatically generating release rules for WAF false interception as described above.

[0034] By adopting the embodiments of the present invention, an innovative automatic analysis method for WAF false blocking is introduced, which can quickly and automatically repair false blocking problems based on the analysis results, effectively ensuring the safe operation of services while ensuring the stability and continuity of services.

[0035] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0036] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of the embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. In the drawings:

[0037] Figure 1 This is a flowchart of the method for proactively identifying and automatically generating release rules for WAF false interception in an embodiment of the present invention;

[0038] Figure 2 This is a flowchart of WAF interception and alarm log enrichment and user information in an embodiment of the present invention;

[0039] Figure 3 This is a flowchart of the user threat analysis in an embodiment of the present invention;

[0040] Figure 4 This is a flowchart of WAF false interception analysis in an embodiment of the present invention;

[0041] Figure 5 This is an adaptive false interception repair flowchart in an embodiment of the present invention. Detailed Implementation

[0042] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the invention and to fully convey the scope of the invention to those skilled in the art. Furthermore, in some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0043] like Figure 1 As shown in the figure, the method for proactively identifying and automatically generating allowance rules for WAF false blocking according to an embodiment of the present invention includes:

[0044] S1, perform correlation analysis on WAF alarm and interception logs and user information-related data to determine the relationship between the WAF alarm and interception logs and the user, and generate enriched WAF alarm and interception logs containing user information; this step enables the WAF alarm and interception logs to carry user information and be associated with the user.

[0045] S2, based on user-defined grouping of the enriched WAF alarm and interception logs, and based on a threat determination strategy, determining whether the user corresponding to each group of logs is a threat user. In this step, the user can be the sole grouping element, or it can be one of the grouping elements combined with other user-defined grouping elements to complete the grouping of the enriched WAF alarm and interception logs. The threat determination strategy can be set and modified by the user. Based on the threat determination strategy, it can be determined whether the user is a threat user within that group. If the grouping factor is only the user, it can be directly determined whether the user is a threat user. If the grouping factors include other user-defined factors in addition to the user, it can be determined whether the user under the other factor conditions is a threat user through judgment.

[0046] S3, Filter out the enriched WAF interception logs from the enriched WAF alarm and interception logs, and group the enriched WAF interception logs based on the interception rules; similarly, the "based on the interception rules" described here can be understood as the interception rules being the only factor for grouping, or the interception rules being merely a grouping element that needs to be coordinated with other user-defined grouping elements to complete the grouping.

[0047] S4, based on the false blocking judgment strategy, determines whether the corresponding rule of each group of blocking logs has been falsely blocked;

[0048] The false blocking determination strategy can be set and modified by the user. Based on the false blocking determination strategy, it can be determined whether a blocking rule has been falsely blocked. If the grouping factor is only a blocking rule, it can be directly determined whether the blocking rule is a false blocking rule. If the grouping factor includes other user-defined factors in addition to the blocking rule, it can be determined whether the blocking rule is a false blocking rule under the conditions of other factors.

[0049] S5 adaptively allows rules that are mistakenly blocked.

[0050] By adopting the embodiments of the present invention, an innovative automatic analysis method for WAF false blocking is introduced, which can automatically complete the detection of false blocking and automatically trigger the adaptive release processing of false blocking. The entire process is automatically implemented, which can ensure the real-time performance of false blocking processing, effectively protect the secure operation of the business, and ensure the stability and continuity of the business.

[0051] Based on the above embodiments, further variant embodiments are proposed. It should be noted that, in order to keep the description brief, only the differences from the above embodiments are described in each variant embodiment.

[0052] According to some embodiments of the present invention, the correlation analysis of WAF alarm and interception logs and user information-related data to determine the relationship between the WAF alarm and interception logs and the user, and to generate enriched WAF alarm and interception logs containing user information, includes:

[0053] Correlation analysis is performed on WAF alarm and interception logs, WAF access logs, and user session data to generate enriched WAF alarm and interception logs containing username information;

[0054] For the remaining WAF alarms and interception logs that cannot be enriched to include username information, they are grouped according to a preset standard and user IDs are randomly generated to generate enriched WAF alarms and interception logs containing random user IDs.

[0055] For example, refer to Figure 2 As shown, the process retrieves WAF alarm and interception logs, extracts specified features (such as the Sessionid field, SID, or any custom field or combination in the Cookie), and optionally supports the selection of other feature information for extraction. Then, it performs correlation analysis with WAF access logs (requests and responses) through custom correlation rules (optionally, such as retrieving data from the Login interface return header set-cookie in the WAF access log based on the SID field in the Cookie in the alarm). Data that meets the correlation criteria is further processed by custom extraction rules (optionally, such as extracting the username field value as userid from the request postdata). This process optionally supports the participation of other custom WAF log enrichment models in the calculation. The result of the calculation is generated as an enriched WAF log (containing username information).

[0056] For WAF logs that cannot be enriched according to the above process (such as those from applications without accounts), data can be grouped and random user IDs can be generated based on fields such as application, IP, and cookie, or optionally other fields. Alternatively, a WAF can be deployed to inject JavaScript to obtain browser fingerprints and generate random user IDs, or other custom random user ID generation methods can be added. The final result is an enriched WAF log (containing random user IDs).

[0057] According to some embodiments of the present invention, the grouping of the enriched WAF alarm and interception logs based on user input includes:

[0058] The enriched WAF alarms and interception logs are grouped based on application and user preferences.

[0059] It's understandable that different users are in different groups, and different applications are also in different groups. In practice, you can first divide users into multiple large groups, and then further subdivide each large group into multiple smaller groups based on the application.

[0060] Using this method for grouping, the final determination of threat users is based on the granularity of the user's role in a specific application.

[0061] According to some embodiments of the present invention, the step of determining whether a user corresponding to each group of logs is a threat user based on a threat determination strategy includes:

[0062] For each group of logs, a threat score is calculated based on scoring points and a weighting strategy for those scoring points. The scoring points include: the number of duplicate entries deduplicated by matching interception rules, the number of duplicate entries deduplicated by matching alarm rules, the number of deduplicated applications triggered by alarm or interception rules and scored according to the weighting strategy, the number of deduplicated application interfaces triggered by alarm or interception rules, and user-defined scoring points.

[0063] Based on the threat score and threat score threshold, it is determined whether a user is a threat user.

[0064] For example, such as Figure 3 As shown, the threat determination strategy, which determines whether the user corresponding to each group of logs is a threat user, includes:

[0065] Retrieve all enriched WAF logs (alarms & interceptions);

[0066] Group by application & user or optionally by other custom criteria;

[0067] Feature extraction and weighted calculation are performed on the grouped data:

[0068] Analyze the number of duplicate matching and blocking rules within the group and score them according to the weighted strategy;

[0069] Analyze the number of duplicate matching alarm rules within the group and score them according to the weighted strategy;

[0070] Analyze the number of duplicate applications triggered by alarms or blocking rules within the group and score them according to the weighted strategy;

[0071] Analyze the number of deduplication application interfaces triggered by alarms or blocking rules within the group and score them according to the weighting strategy;

[0072] Optional additional custom feature analysis and maintenance can be added;

[0073] The total threat score can be obtained using a built-in or custom threat score calculation method, or optionally calculated using algorithms such as machine learning.

[0074] Finally, based on the threshold, the threat user generates a list of threat users and a threat score.

[0075] According to some embodiments of the present invention, the step of determining whether a rule corresponding to each group of interception logs has been falsely intercepted based on the false interception determination strategy includes:

[0076] For each group of intercepted logs, a false interception score is calculated based on the bonus points and a weighted strategy for the bonus points. The bonus points include: the total number of deduplicated users excluding threat users, the creation time of the matching interception rule, and user-defined bonus points.

[0077] Based on the false interception score and the false interception score threshold, it is determined whether the rule has caused a false interception.

[0078] For example, refer to Figure 4 As shown, the false blocking determination strategy, which determines whether a rule corresponding to each group of blocking logs has been falsely blocked based on the false blocking determination strategy, includes:

[0079] Retrieve data from WAF logs that cannot be enriched (e.g., data from applications without accounts), and retrieve intercepted logs.

[0080] Grouping can be done according to rules or, optionally, according to custom criteria.

[0081] Feature extraction and weighted calculation are performed on the data within the group:

[0082] Analyze the total number of duplicate application usernames within the group, excluding threatening users, and score them according to a weighted strategy (the larger the total number, the higher the score);

[0083] Analyze the total number of unique random user IDs in the group, excluding threat users, and score them according to a weighted strategy (the default weight is lower than the application username);

[0084] Analyze the creation time of rules within the group and score them according to a weighted strategy (the more recent the rule is, the lower the score);

[0085] Optional additional custom feature analysis and maintenance can be added;

[0086] The total threat score can be obtained based on a built-in or custom threat score calculation method, or optionally calculated based on algorithms such as machine learning (e.g., summation).

[0087] Finally, the threshold is used to determine whether the rule has been falsely blocked. If the threshold is not met, it is ignored. If the threshold is met, the rule, false blocking threat score, application list, application interface list or other custom fields are generated and the rule enters the adaptive false blocking repair process, and an alarm is sent at the same time.

[0088] According to some embodiments of the present invention, the adaptive allowance processing for rules that have been falsely blocked includes:

[0089] Based on the false blocking score corresponding to the false blocking rule and the preset blacklist and whitelist, determine whether the false blocking rule meets the adaptive repair conditions;

[0090] For false blocking rules that meet the adaptive repair conditions, allow them to pass according to the allow rules selected by the user.

[0091] According to some embodiments of the present invention, determining whether a false blocking rule meets the adaptive repair condition by combining the false blocking score corresponding to the false blocking rule and a preset blacklist or whitelist includes:

[0092] If the false blocking score corresponding to a false blocking rule is less than the preset repair score, and the false blocking rule is in the preset blacklist, then the false blocking rule is determined to meet the adaptive repair conditions.

[0093] According to some embodiments of the present invention, the release rules include:

[0094] Once the first condition is met, the entire blocking rule is allowed.

[0095] Once the second condition is met, allow the blocking rules that match the application list that were mistakenly blocked by the blocking rules to proceed.

[0096] After the third condition is met, the blocking rules matching the relevant application interfaces of the application list that were mistakenly blocked by the blocking rules are allowed to proceed.

[0097] User-defined rules.

[0098] For example, such as Figure 5 As shown, after identifying the risk of false blocking, this embodiment of the invention supports the production and distribution of adaptive false blocking direction strategies to resolve the risk of false blocking in real time and prevent business interruption. Specifically, it includes the following steps:

[0099] Retrieve data on false blocking (false blocking rules, application list, application API list, or other custom fields).

[0100] Perform adaptive repair judgment for false blocking (based on threat score, blacklist / whitelist (rule name, application name, interface rule, or optional user-defined policy)). If the judgment does not meet the requirements, stop the action and end the process. If the judgment meets the requirements, continue the adaptive release process for false blocking.

[0101] If the conditions are met, proceed to the adaptive false interception repair rule generation engine (which generates an adaptive direction repair strategy based on the rules):

[0102] Optionally, the entire rule can be allowed if certain conditions are met;

[0103] Optionally, certain conditions must be met before an application can be allowed into this application list based on matching rules.

[0104] Optionally, applications may be allowed to enter this application list if certain conditions are met, and the relevant application interfaces match the relevant rules.

[0105] Users can optionally add custom rule generation methods;

[0106] Finally, the adaptive false interception repair rules are output.

[0107] The output rules enter the rule distribution module (responsible for distributing the generated rules to the connected WAF platform) to distribute policies to multi-source heterogeneous WAFs on various platforms. This completes the risk of false blocking.

[0108] The method for proactively identifying and automatically generating allowance rules to resolve false blocking in WAF according to the present invention is described in detail below with reference to the accompanying drawings and a specific embodiment. It is to be understood that the following description is merely exemplary and should not be construed as a specific limitation of the present invention.

[0109] This invention primarily addresses the issue of widespread service failures caused by false blocking by Web Application Firewall (WAF). It supports accurate identification of false blocking risks and optionally automatic mitigation of these risks. By integrating with WAF access logs and other records, this invention obtains WAF blocking data and links it to application login data or other session identification data. After mapping the relationship between blocked requests and users, it learns the user risk level based on this data, identifying high-risk and low-risk users. Optionally, it groups users according to each WAF blocking policy to analyze how many low-risk user requests each WAF rule blocked within a certain period. If a WAF rule blocks more than a certain threshold of low-risk users or meets other conditions, it can optionally automatically close the rule or issue a closure order to the specified interface of the service, issuing a false blocking alarm to notify security engineers to analyze and optimize the WAF blocking rules or generate its own allow rules.

[0110] In detail, the method for proactively identifying and automatically generating allowance rules to resolve false blocking in WAF according to embodiments of the present invention includes:

[0111] I. WAF Alarms and User Information Enrichment

[0112] like Figure 2 As shown, this embodiment of the invention first analyzes WAF alarms and interception logs to identify the relationship between WAF alarms and interception logs and users, in order to perform further analysis. Specifically:

[0113] Retrieve WAF alarms and interception logs, extract specified features (such as the Sessionid field, SID, or any custom field or combination in the Cookie), and optionally support the selection of other feature information for extraction. Then perform correlation analysis with WAF access logs (requests and responses), and perform correlation through custom correlation rules (optionally, such as obtaining data in the Login interface return header set-cookie in the WAF access log that is equal to the SID value based on the SID field in the Cookie in the alarm). Data that meets the correlation criteria is further entered into custom extraction rules (optionally, such as extracting the username field value as userid in the request postdata). This process optionally supports the participation of other custom WAF log enrichment models in the calculation. The result of the calculation is generated as enriched WAF logs (containing username information).

[0114] For WAF logs that cannot be enriched according to the above process (such as those from applications without accounts), data can be grouped and random user IDs can be generated based on fields such as application, IP, and cookie, or optionally other fields. Alternatively, a WAF can be deployed to inject JavaScript to obtain browser fingerprints and generate random user IDs, or other custom random user ID generation methods can be added. The final result is an enriched WAF log (containing random user IDs).

[0115] Merge enriched WAF logs (containing username information) and enriched WAF logs (containing random user IDs) to generate enriched WAF log data (containing user information).

[0116] II. User Threat Analysis

[0117] like Figure 3 User threat analysis is performed on enriched WAF logs (containing user information) to identify threat users (malicious users, users at risk of attack). The detailed process is as follows:

[0118] Retrieve data from WAF logs that cannot be enriched (e.g., system applications without accounts), and retrieve all logs (alarms & interceptions);

[0119] Group by application & user or optionally by other custom criteria;

[0120] Feature extraction and weighted calculation are performed on the grouped data:

[0121] Analyze the number of duplicate matching and blocking rules within the group and score them according to the weighted strategy;

[0122] Analyze the number of duplicate matching alarm rules within the group and score them according to the weighted strategy;

[0123] Analyze the number of duplicate applications triggered by alarms or blocking rules within the group and score them according to the weighted strategy;

[0124] Analyze the number of deduplication application interfaces triggered by alarms or blocking rules within the group and score them according to the weighting strategy;

[0125] Optional additional custom feature analysis and maintenance can be added;

[0126] The total threat score can be obtained based on a built-in or custom threat score calculation method, or optionally calculated based on algorithms such as machine learning.

[0127] Finally, based on the threshold, the threat user generates a list of threat users and a threat score.

[0128] III. WAF False Interception Analysis

[0129] like Figure 4 As shown, this process calculates and analyzes WAF false blocking based on the processed data described above:

[0130] Retrieve data from WAF logs that cannot be enriched (e.g., data from applications without accounts), and retrieve intercepted logs;

[0131] Group according to rules or optionally according to custom conditions;

[0132] Feature extraction and weighted calculation are performed on the data within the group:

[0133] Analyze the total number of duplicate application usernames within the group, excluding threatening users, and score them according to a weighted strategy (the larger the total number, the higher the score);

[0134] Analyze the total number of unique random user IDs in the group, excluding threat users, and score them according to a weighted strategy (the default weight is lower than the application username);

[0135] Analyze the creation time of rules within the group and score them according to a weighted strategy (the more recent the rule is, the lower the score);

[0136] Optional additional custom feature analysis and maintenance can be added;

[0137] The total threat score can be obtained based on a built-in or custom threat score calculation method, or optionally calculated based on algorithms such as machine learning (e.g., summation).

[0138] Finally, the threshold is used to determine whether the rule has been falsely blocked. If the threshold is not met, it is ignored. If the threshold is met, the rule, false blocking threat score, application list, application interface list or other custom fields are generated and the rule enters the adaptive false blocking repair process, and an alarm is sent at the same time.

[0139] IV. Adaptive error blocking repair

[0140] After identifying the risk of false blocking, this embodiment of the invention supports the production and distribution of adaptive false blocking direction strategies to resolve the risk of false blocking in real time and prevent the risk of service interruption. Figure 5 As shown, it includes:

[0141] Retrieve false blocking data (false blocking rules, application list, application interface list, or other custom fields);

[0142] Perform adaptive repair judgment for false blocking (based on threat score, blacklist / whitelist (rule name, application name, interface rule or optional user-defined policy)). If the judgment does not meet the requirements, stop the action and end the process. If the judgment meets the requirements, continue the adaptive release process for false blocking.

[0143] If the conditions are met, proceed to the adaptive false interception repair rule generation engine (which generates an adaptive direction repair strategy based on the rules):

[0144] Optionally, the entire rule can be allowed if certain conditions are met;

[0145] Optionally, certain conditions must be met before an application can be allowed into this application list based on matching rules.

[0146] Optionally, applications may be allowed to enter this application list if certain conditions are met, and the relevant application interfaces match the relevant rules.

[0147] Users can optionally add custom rule generation methods;

[0148] Finally, the adaptive error correction rules are output.

[0149] The output rules enter the rule distribution module (responsible for distributing the generated rules to the connected WAF platform) to distribute policies to multi-source heterogeneous WAFs on various platforms, thereby eliminating the risk of false blocking.

[0150] The problem of WAF false blocking is one that traditional WAF products cannot solve, and this risk exists in any WAF product. This solution introduces an innovative automatic analysis method for WAF false blocking, and can adaptively generate a release policy for WAF false blocking rules based on the analysis results to quickly and automatically repair the false blocking problem. This can effectively ensure the safe operation of the business while ensuring the stability and continuity of the business.

[0151] It should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0152] It should be noted that any content not described in detail in this specification is common knowledge to those skilled in the art.

[0153] According to an embodiment of the present invention, a device for proactively identifying and automatically generating allowance rules for WAF false interception includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the method for proactively identifying and automatically generating allowance rules for WAF false interception as described above.

[0154] According to an embodiment of the present invention, a computer-readable storage medium stores an information transmission implementation program, which, when executed by a processor, implements the steps of the method for proactively identifying and automatically generating release rules for WAF false interception as described above.

[0155] It should be noted that, in the description of this specification, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Any reference signs enclosed in parentheses should not be construed as limiting the claims.

Claims

1. A method for WAF false interception active identification and automatic release rule generation, characterized in that, The method comprises the following steps: correlating and analyzing the WAF alarm and interception log and the user information related data to determine the relationship between the WAF alarm and interception log and the user, and generating enriched WAF alarm and interception log containing user information; grouping the enriched WAF alarm and interception log based on the user, and determining whether the corresponding user is a threat user according to each group of logs based on a threat judgment strategy, which comprises: for each group of logs, calculating the threat score based on the scoring points combined with the scoring point weighting strategy; the scoring points include: the number of matched interception rule de-duplication, the number of matched alarm rule de-duplication, the number of alarm or interception rule trigger de-duplication and the scoring according to the weighting strategy, the number of alarm or interception rule trigger de-duplication interface, and user-defined scoring points; based on the threat score and the threat score threshold, it is determined whether the user is a threat user; filtering enriched WAF interception log from the enriched WAF alarm and interception log, and grouping the enriched WAF interception log based on the interception rule; based on the misinterception judgment strategy, it is determined whether the corresponding rule of each group of interception logs has misinterception, which comprises: for each group of interception logs, calculating the misinterception score based on the bonus points combined with the bonus point weighting strategy, the bonus points include: the total number of de-duplicated users excluding threat users, the creation time of matched interception rules, and user-defined bonus points; based on the misinterception score and the misinterception score threshold, it is determined whether the rule has misinterception; adaptive release processing is performed on the rules that have misinterception.

2. The method of claim 1, wherein, The method comprises the following steps: correlating and analyzing the WAF alarm and interception log and the WAF access log and user session data to generate enriched WAF alarm and interception log containing user name information; for the remaining WAF alarm and interception log which cannot be enriched to generate enriched WAF alarm and interception log containing user name information, grouping and randomly generating user ID according to the preset standard to generate enriched WAF alarm and interception log containing random user ID.

3. The method of claim 1, wherein, The method comprises the following steps: grouping the enriched WAF alarm and interception log based on the application and the user.

4. The method of claim 1, wherein, The adaptive release processing of the rules that have misinterception comprises: combining the misinterception score corresponding to the misinterception rule and the preset blacklist to determine whether the misinterception rule meets the adaptive repair condition; for the misinterception rule that meets the adaptive repair condition, release processing is performed on it according to the release rule selected by the user.

5. The method of claim 4, wherein, The adaptive release processing of the rules that have misinterception comprises: when the misinterception score corresponding to the misinterception rule is less than the preset repair score, and the misinterception rule is in the preset blacklist, it is determined that the misinterception rule meets the adaptive repair condition.

6. The method of claim 4, wherein, The release rule comprises: releasing the entire interception rule after meeting the first condition; Release the matched interception rule of the application list intercepted by the mis-interception rule after satisfying the second condition; Release the matched interception rule of the related application interface of the application list intercepted by the mis-interception rule after satisfying the third condition; User-defined rule.

7. A device for active identification and automatic release rule generation of WAF false interception, characterized in that, Comprise: A memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method for active identification and automatic generation of release rules of WAF mis-interception according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores an implementation program of information transmission, and the program, when executed by the processor, implements the steps of the method for active identification and automatic generation of release rules of WAF mis-interception according to any one of claims 1 to 6.

Images