WAFBooster: Automatic Boosting of WAF Security Against Mutated Malicious Payloads

Web application firewall (WAF) examines malicious traffic to and from a web application via a set of security rules. It plays a significant role in securing Web applications against web attacks. However, as web attacks grow in sophistication, it is becoming increasingly difficult for WAFs to block the mutated malicious payloads designed to bypass their defenses. In response to this critical security issue, we have developed a novel learning-based framework called WAFBooster, designed to unveil potential bypasses in WAF detections and suggest rules to fortify their security. Using a combination of shadow models and payload generation techniques, we can identify malicious payloads and remove or modify them as needed. WAFBooster generates signatures for these malicious payloads using advanced clustering and regular expression matching techniques to repair any security gaps we uncover. In our comprehensive evaluation of eight real-world WAFs, WAFBooster improved the true rejection rate of mutated malicious payloads from 21% to 96%, with no false rejections. WAFBooster achieves a false acceptance rate 3× lower than State-of-the-Art methods for generating malicious payloads. With WAFBooster, we have taken a step forward in securing web applications against the ever-evolving threats.