TokDoc

Abstract

The growing amount of web-based attacks poses a severe threat to the security of web applications. Signature-based detection techniques increasingly fail to cope with the variety and complexity of novel attack instances. As a remedy, we introduce a protocol-aware reverse HTTP proxy TokDoc (the token doctor), which intercepts requests and decides on a per-token basis whether a token requires automatic "healing". In particular, we propose an intelligent mangling technique, which, based on the decision of previously trained anomaly detectors, replaces suspicious parts in requests by benign data the system has seen in the past. Evaluation of our system in terms of accuracy is performed on two realworld data sets and a large variety of recent attacks. In comparison to state-of-the-art anomaly detectors, TokDoc is not only capable of detecting most attacks, but also significantly outperforms the other methods in terms of false positives. Runtime measurements show that our implementation can be deployed as an inline intrusion prevention system. General TermsSecurity

Securing Web Application by Embedded Firewall

“…In order to increase the WAF performance, bandwidth, WAF developed using artificial intelligence techniques: Artificial Neural Networks [17], fuzzy logic [18]. These systems address two objectives: to set models for 'normal' traffic and to detect 'abnormal' traffic, blocks it.…”

“…It causes poor bandwidth, requires more resources, hardly adaptable to large web systems. By reducing the number of rules, in order to improve bandwidth, decreases vulnerability detection quality.In order to increase the WAF performance, bandwidth, WAF developed using artificial intelligence techniques: Artificial Neural Networks[17], fuzzy logic[18]. These systems address two objectives: to set models for 'normal' traffic and to detect 'abnormal' traffic, blocks it.…”