Design and Implementation of Automated Web Application Firewall, Rate Limiting, and Intrusion Detection System for Cyber Defense

Web applications, are often targeted daily by cyberattacks for around 30,000 attacks on global basis. Web applications security threat include SQLi, XSS, and DDoS. SQLi and XSS are web security threats that can send malicious payloads, while DDoS makes the web applications dysfunctional or inaccessible. WAF, rate limiting, and IDS were designed and implemented to overcome this. Based on the experiments, WAF obtained a security quality score of 99.6%, detection quality of 92.3%, and balance accuracy of 95.95%. From the HTTPerf experiments, without rate limiting, the average 2xx reply status was 537.8 for Client 1 and 547.8 for Client 2. Then, the average of 5xx reply status was 0 for both clients. Meanwhile, with rate limiting, the average 2xx reply status was 47.2 for Client 1 and 47.4 for Client 2. Then, the average 5xx reply status was 502.8 for Client 1 and 502.6 for Client 2. For the QoS, the average throughput without rate limiting was 13.382 Mbit/s, while with rate limiting was 8.004 Mbit/s. The average packet loss without rate limiting was 0.192%, while with rate limiting was 0.012%. The average delay without rate limiting was 0.355 ms, while with rate limiting was 0.284 ms. The average jitter without rate limiting was 0.012 ms, while with rate limiting was 0.020 ms. In IDS, Snort could send warning messages according to the type of attack that occurred with 100% accuracy. These scores showed that WAF can prevent SQLi and XSS with high accuracy, rate limiting can keep the web performance and prevent DDoS, and Snort can detect SQLi, XSS, and DDoS to provide mitigation.