Automatically Repairing Web Application Firewalls Based on Successful SQL Injection Attacks

Abstract

Abstract-Testing and fixing Web Application Firewalls (WAFs) are two relevant and complementary challenges for security analysts. Automated testing helps to cost-effectively detect vulnerabilities in a WAF by generating effective test cases, i.e., attacks. Once vulnerabilities have been identified, the WAF needs to be fixed by augmenting its rule set to filter attacks without blocking legitimate requests. However, existing research suggests that rule sets are very difficult to understand and too complex to be manually fixed. In this paper, we formalise the problem of fixing vulnerable WAFs as a combinatorial optimisation problem. To solve it, we propose an automated approach that combines machine learning with multi-objective genetic algorithms. Given a set of legitimate requests and bypassing SQL injection attacks, our approach automatically infers regular expressions that, when added to the WAF's rule set, prevent many attacks while letting legitimate requests go through. Our empirical evaluation based on both open-source and proprietary WAFs shows that the generated filter rules are effective at blocking previously identified and successful SQL injection attacks (recall between 54.6% and 98.3%), while triggering in most cases no or few false positives (false positive rate between 0% and 2%).

A Machine-Learning-Driven Evolutionary Approach for Testing Web Application Firewalls

“…In our future work, we will investigate automated approaches to generate effective patches for the WAF under test starting from the learned attack patterns. We reported on an initial attempt to automate the repairing process in a recent paper [11], where we generated patches that block as many bypassing attacks as possible while limiting the blocking of legitimate inputs. Investigating further, more effective, repairing strategies that better exploit the attack patterns generated by ML-Driven E is part of our future agenda.…”

“…Our goal is to modify these regular expressions in such a way that the bypassing attacks found by ML-Driven do no longer bypass the WAF. We investigated a first attempt to semi-automate the WAF repairing process in our recent work [11]. In particular, we use multi-objective optimization algorithms to optimize two goals: (i) maximizing the number of blocked attacks and (ii) minimizing the number legitimate requests being blocked (false positives).…”

“…In this paper, we consider a general strategy for modifying the regular expressions as outlined in Algorithm 5. While parts of the strategy can be automated [11], regular expressions derived from attack patterns (line 8 and 9) still require manual inspection and adaptation depending on the WAF under evaluation. The required inputs for the strategy are the test outputs of ML-Driven, i.e., a set A of bypassing attacks and a set P C of path conditions learned from A, and a set R of regular expressions used by the WAF under test to match known attacks.…”

Fully Automated HTML and JavaScript Rewriting for Constructing a Self‐healing Web Proxy

“…In particular, they aim at providing accessible UIs to blind users. Appelt et al [37] do automatic repairs of firewall rules to improve the security of web application. While a firewall and a proxy are similar, the goal and the means are different: they focus on security while we focus on availability, they change firewall rules while BikiniProxy rewrites HTML and Javascript code.…”

Fully Automated HTML and Javascript Rewriting for Constructing a Self-Healing Web Proxy

“…Appelt et al. do automatic repairs of firewall rules to improve the security of web application. While a firewall and a proxy are similar, the goal and the means are different: they focus on security while we focus on availability; they change firewall rules while BikiniProxy rewrites HTML and JavaScript code.…”