Statistical Web Application Firewall Signature Augmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Web application firewalls are ineffective against sophisticated attacks that evade detection by altering or expanding HTTP payloads, as they rely on deterministic regular expressions that cannot capture all malicious patterns, leading to false negatives in signature-based detection systems.
Innovation Solution
A statistical approach is implemented to augment signature detection by tracking historical parameter values, tokenizing requests, and calculating compound probabilities to determine the likelihood of an attack, using frequency tables and fuzzy search to identify similar tokens and account for client reputation, thereby enhancing the firewall's ability to detect evasive tactics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection using deterministic regular expressions is used, then the firewall can detect known attack patterns, but it cannot detect sophisticated attacks that evade detection by altering or expanding HTTP payloads
Solution Approach 1:
The patent transforms the detection approach from deterministic parameter matching (exact signature matches) to probabilistic parameter assessment (likelihood scores based on multiple factors). By calculating compound probabilities that combine signature match strength, historical frequency data, and contextual information, the system can adapt to varied attack patterns while maintaining reliability for known threats.
Solution Approach 2:
The detection system combines multiple detection mechanisms into a composite approach: traditional signature matching, statistical frequency analysis of tokens, contextual evaluation, and compound probability calculation. This multi-layered composite system addresses both known attack patterns and sophisticated evasion techniques that single-method systems miss.
2Reliability
If intensive computing resources are allocated to accurately prevent cyber-attacks using rule-based logic and signature-matching, then detection accuracy improves, but processing efficiency decreases
Solution Approach 1:
The system performs preliminary actions by pre-calculating and storing frequency statistics for tokens during normal operation. When a new request arrives, the system quickly retrieves pre-computed frequency data rather than analyzing entire request histories in real-time, significantly reducing processing time while maintaining accurate probabilistic assessment.
Solution Approach 2:
The patent applies partial action by selectively intensifying detection only when necessary - using full compound probability calculation primarily when signature matches are ambiguous or when contextual factors suggest potential evasion. For clear-cut cases, the system uses faster deterministic matching, allocating intensive computing resources proportionally to the detected threat level.
3Productivity
If deterministic regular expressions are used for signature matching, then the firewall can efficiently match known patterns, but it produces false negatives when attackers modify payloads to avoid traditional signature matching
Solution Approach 1:
The system incorporates feedback loops where detection results (both positive and negative) feed back into the statistical model. Frequency tables are continuously updated based on observed traffic patterns and detected attacks, allowing the system to learn from new attack variations and improve its probabilistic assessment accuracy over time while maintaining efficient signature matching.
Solution Approach 2:
The patent introduces compound probability scores as an intermediary between deterministic signature matching and final detection decisions. This intermediary layer allows the system to consider additional contextual factors and historical data without completely replacing efficient signature matching, bridging the gap between speed and precision.
Data Source
AI summary
In an embodiment, a statistical approach for augmenting signature detection in a Web application firewall includes receiving a new request including a parameter in a uniform resource identifier (URI), tokenizing the new request, and determining a compound probability that tokens in a value that is associated with the parameter of the URI and that is included in the new request are associated with an attack. The compound probability is determined based at least in part on component probabilities of tokens of historical values associated with the parameter of the URI.