Original language | English |
---|---|
Title of host publication | 2017 IEEE 28th International Symposium on Software Reliability Engineering (ISSRE) |
Place of Publication | Piscataway, NJ |
Publisher | IEEE |
Pages | 1-12 |
Number of pages | 12 |
ISBN (Electronic) | 978-1-5386-0941-5 |
DOIs | |
Publication status | Published - 16 Nov 2017 |
Externally published | Yes |
Event | IEEE 28th International Symposium on Software Reliability Engineering: ISSRE - Toulouse, France Duration: 23 Oct 2017 → 26 Oct 2017 http://2017.issre.net/ |
Abstract
Testing and fixing Web Application Firewalls (WAFs) are two relevant and complementary challenges for security analysts. Automated testing helps to cost-effectively detect vulnerabilities in a WAF by generating effective test cases, i.e., attacks. Once vulnerabilities have been identified, the WAF needs to be fixed by augmenting its rule set to filter attacks without blocking legitimate requests. However, existing research suggests that rule sets are very difficult to understand and too complex to be manually fixed. In this paper, we formalise the problem of fixing vulnerable WAFs as a combinatorial optimisation problem. To solve it, we propose an automated approach that combines machine learning with multi-objective genetic algorithms. Given a set of legitimate requests and bypassing SQL injection attacks, our approach automatically infers regular expressions that, when added to the WAF's rule set, prevent many attacks while letting legitimate requests go through. Our empirical evaluation based on both open-source and proprietary WAFs shows that the generated filter rules are effective at blocking previously identified and successful SQL injection attacks (recall between 54.6% and 98.3%), while triggering in most cases no or few false positives (false positive rate between 0% and 2%).
Conference
Conference | IEEE 28th International Symposium on Software Reliability Engineering |
---|---|
Country/Territory | France |
City | Toulouse |
Period | 23/10/17 → 26/10/17 |
Internet address |
Keywords
- Web Application Firewalls
- Regular Expression Inference
- Web Security