ML-Based Web Application Firewall Vectorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional web application firewalls (WAFs) rely on rule-based systems that are ineffective in identifying novel or unusual payloads, and are prone to false positives due to their reliance on predefined signatures.
Innovation Solution
A machine learning (ML) based WAF that applies transformations to raw HTTP data, including normalization and signature generation, to create vectorized inputs for an ML model. This model uses hierarchical self-attention and multi-step candidate selection to provide a probability score for malicious requests, enabling more effective traffic filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based WAF with predefined signatures is used, then known attacks can be blocked, but novel or unusual payloads cannot be identified
Solution Approach 1:
The patent replaces the mechanical rule-based system with a machine learning model that processes vectorized representations of HTTP requests. The ML model learns patterns from historical data and can identify novel attacks without relying on predefined signatures, thus improving adaptability while maintaining detection accuracy through learned features.
Solution Approach 2:
The patent transforms the input data from raw HTTP requests to vectorized representations, changing the parameter space from text-based patterns to numerical features. This transformation enables the ML model to process and compare requests in a way that reveals subtle patterns indicative of novel attacks, resolving the contradiction between detecting known attacks and identifying new threats.
2Reliability
If positive security model with allowed list is used, then zero-day attacks can be reduced, but false positives increase
Solution Approach 1:
The patent implements a feedback mechanism where the ML model is trained on historical data including both legitimate and malicious requests. The model continuously learns from this feedback, adjusting its decision boundaries to reduce false positives while maintaining protection against zero-day attacks. The probability score output allows for configurable thresholds that balance detection sensitivity with false positive rates.
Solution Approach 2:
Instead of using a strict allowed list that blocks anything not explicitly permitted, the patent uses a probabilistic approach where the ML model outputs a score indicating the likelihood of malicious intent. This partial action approach allows legitimate traffic with unusual but benign characteristics to pass through while still blocking high-probability attacks, reducing false positives while maintaining security.
3Measurement precision
If negative security model with block list is used, then false positives are minimized, but novel attacks are not detected
Solution Approach 1:
The patent replaces the mechanical signature-matching system with a machine learning model that can generalize from known attack patterns to identify novel variations. The ML model processes vectorized request features and detects subtle patterns that indicate malicious intent, enabling detection of novel attacks while maintaining low false positive rates through learned decision boundaries.
Solution Approach 2:
The patent performs preliminary vectorization and feature extraction on HTTP requests before classification. This preliminary action transforms raw data into a standardized format that highlights relevant patterns, enabling the ML model to efficiently detect novel attacks while maintaining precision. The vectorization process prepares the data in advance for pattern recognition without requiring exact signature matches.
4Ease of manufacture
If static rules are used, then implementation is simple, but historical data cannot be utilized for improvement
Solution Approach 1:
The patent replaces static rule implementation with a machine learning pipeline that automatically learns from historical data. The system ingests historical HTTP requests, vectorizes them, and trains the ML model to identify patterns. This automated learning process eliminates the need for manual rule creation while improving adaptability, and the system can be deployed as a service that continuously improves from new data.
Solution Approach 2:
The patent implements a self-improving system where the ML model automatically learns from historical data without requiring manual intervention. The system processes historical requests, extracts features, and updates its internal representations autonomously. This self-service capability allows the WAF to continuously improve its detection accuracy while maintaining implementation simplicity through automated pipelines.
Data Source
AI summary
A machine learning (ML) based web application firewall (WAF) is described. Transformation(s) are applied to raw data including normalizing and generating a signature over the normalized data. The signature and the normalized data are vectorized to create a first and second vector of integers respectively. The first and second vector of integers are input into an ML model, which outputs a score that indicates a probability of the raw data being of a type that is malicious. A traffic processing rule is enforced that instructs a WAF to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.