Web Application Firewall Filtering via Learned API Metadata
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web application filtering methods face challenges with high false positive and false negative rates due to complex and difficult-to-manage rule sets, whether using blacklist or whitelist approaches, and require specialized knowledge to configure effectively.
Innovation Solution
A method that generates WAF filtering rules based on metadata of HTTP message arguments, creating an API description and combining it with positive and negative filtering, allowing administrators to customize rules without disclosing sensitive data, and optimizing rule application for efficient filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If negative filtering rules (blacklist) are used to protect against known threats, then security coverage improves, but false positive rate increases and rule management complexity increases
Solution Approach 1:
The patent inverts the traditional blacklist approach by implementing a whitelist mechanism that learns legitimate application behavior patterns. Instead of maintaining a list of known bad patterns, the system proactively identifies and allows only legitimate traffic patterns, automatically inverting the problem from blocking known threats to allowing known good behavior.
Solution Approach 2:
The system implements self-service by automatically learning application behavior patterns from observed traffic without requiring manual rule creation or updates. The WAF autonomously generates filtering rules based on learned patterns, eliminating the need for continuous manual maintenance of complex rule sets while adapting to application changes.
2Measurement precision
If manual rule generation is performed to customize filtering, then filtering precision improves, but time consumption and expertise requirements increase
Solution Approach 1:
The system performs preliminary action by pre-learning application behavior patterns during a learning phase before actual filtering begins. This preliminary learning phase captures legitimate traffic patterns and generates filtering rules in advance, so that when filtering starts, precise rules are already available without requiring manual configuration during operation.
Solution Approach 2:
The patent replaces the mechanical manual rule creation process with an automated learning system. Instead of requiring administrators to manually analyze and create rules, the system uses automated pattern recognition and machine learning to generate filtering rules, substituting human manual work with computational automation.
3Ease of operation
If automated rule generation is used to reduce configuration burden, then ease of operation improves, but rule set size increases leading to more false positives
Solution Approach 1:
The system extracts only the essential and distinctive behavior patterns from observed traffic during the learning phase. Instead of generating rules for every possible traffic variation, it identifies and extracts the core legitimate patterns, creating a concise rule set that captures the essence of application behavior without unnecessary complexity.
Solution Approach 2:
The patent changes parameters by learning and adapting to application-specific behavior patterns rather than using fixed, generic rules. The system dynamically adjusts filtering parameters based on learned patterns, transforming static rule sets into adaptive ones that maintain precision without increasing overall complexity.
4Reliability
If strict positive filtering rules are applied to ensure security, then false negative rate decreases, but legitimate requests may be denied increasing false positive rate
Solution Approach 1:
The system implements dynamics by making filtering rules adaptive rather than static. The learned behavior patterns allow the system to dynamically adjust what constitutes legitimate traffic based on actual application usage, enabling strict security checks that adapt to legitimate variations in traffic patterns without falsely blocking authorized requests.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a method for filtering HTTP messages comprising arguments characterized by an argument name and an argument value, sent to or from a web application to protect against attacks said web application, performed by a Web Application Firewall electronic device comprising a memory storing negative filtering rules to be applied to at least one collection of arguments names or arguments values and comprising: • during a learning phase: determining, from the received HTTP messages, a set of metadata comprising, for arguments of the received messages, each argument's name and, associated therewith, metadata of the argument, without disclosing the value of the argument; generating from said metadata set an API description of the web application, comprising all arguments names of the metadata set and, for each argument name, allowed values for the metadata associated therewith, • during a positive filtering rules generation phase: generating WAF positive filtering rules by automatically transforming arguments' metadata allowed values of the API description into WAF positive filtering rules, • at runtime: generating from a received HTTP message, a first collection comprising names of the arguments of said HTTP message and a second collection comprising values of the arguments of said HTTP message; applying said generated WAF positive filtering rules to said first and second collections; generating updated first and second collections by, for each argument fulfilling a WAF positive filtering rule, removing said argument's name from the first collection and said argument's value from the second collection; applying said negative filtering rules to said updated first and second collections.