Automatically Repairing Web Application Firewalls Based on Successful SQL Injection Attacks

Dennis Appelt, Annibale Panichella, Lionel Briand

Research output: Chapter in Book/Conference proceedings/Edited volumeEntry for encyclopedia/dictionaryScientificpeer-review

19 Citations (Scopus)

Abstract

Testing and fixing Web Application Firewalls (WAFs) are two relevant and complementary challenges for security analysts. Automated testing helps to cost-effectively detect vulnerabilities in a WAF by generating effective test cases, i.e., attacks. Once vulnerabilities have been identified, the WAF needs to be fixed by augmenting its rule set to filter attacks without blocking legitimate requests. However, existing research suggests that rule sets are very difficult to understand and too complex to be manually fixed. In this paper, we formalise the problem of fixing vulnerable WAFs as a combinatorial optimisation problem. To solve it, we propose an automated approach that combines machine learning with multi-objective genetic algorithms. Given a set of legitimate requests and bypassing SQL injection attacks, our approach automatically infers regular expressions that, when added to the WAF's rule set, prevent many attacks while letting legitimate requests go through. Our empirical evaluation based on both open-source and proprietary WAFs shows that the generated filter rules are effective at blocking previously identified and successful SQL injection attacks (recall between 54.6% and 98.3%), while triggering in most cases no or few false positives (false positive rate between 0% and 2%).
Original languageEnglish
Title of host publication2017 IEEE 28th International Symposium on Software Reliability Engineering (ISSRE)
Place of PublicationPiscataway, NJ
PublisherIEEE
Pages1-12
Number of pages12
ISBN (Electronic)978-1-5386-0941-5
DOIs
Publication statusPublished - 16 Nov 2017
Externally publishedYes
EventIEEE 28th International Symposium on Software Reliability Engineering: ISSRE - Toulouse, France
Duration: 23 Oct 201726 Oct 2017
http://2017.issre.net/

Conference

ConferenceIEEE 28th International Symposium on Software Reliability Engineering
Country/TerritoryFrance
CityToulouse
Period23/10/1726/10/17
Internet address

Keywords

  • Web Application Firewalls
  • Regular Expression Inference
  • Web Security

Fingerprint

Dive into the research topics of 'Automatically Repairing Web Application Firewalls Based on Successful SQL Injection Attacks'. Together they form a unique fingerprint.

Cite this