Implementing Machine Learning in the Context of Web Application Firewalls

This article presents methods for automating the configuration of a Web Application Firewall using machine learning. Currently, firewalls are a common means of protecting against attacks on web applications. However, most firewalls work based on simple rules and signatures. To fully protect the application, you need to configure a blacklist and a whitelist of requests. This often requires in-depth knowledge of the subject area and a lot of time for correct configuration. This article presents a method that allows you to identify incorrectly configured firewall rules and thereby reduce deployment time. The anomaly search method allows you to isolate the signature of normal requests from traffic, which makes it easier to create a whitelist. Both of these solutions require a labeled dataset, which is not always possible to obtain in a real system. Therefore, in addition to the machine learning models themselves, this article describes instructions for automatic dataset generation. The generation approach does not depend on the specific functionality of the application, so it can be reused for other security objects. At the end of the article, the results of testing models on a WordPress stand and a comparison with a classic firewall are presented.