Intelligent dynamic security profiles for web application firewalls

1 . A method comprising steps of:

receiving raw data related to operation of a plurality of Web Application Firewall (WAF) agents, wherein the plurality of WAF agents are distributed across multiple tenants globally over the Internet;

normalizing and sanitizing the raw data;

analyzing the normalized and sanitized data with a machine learning algorithm to determine prioritization of rules in a given WAF agent based on the raw data and an objective; and

providing a security profile to the given WAF agent where the security profile includes a selection of the rules based on the prioritization and the objective,

wherein the raw data includes specific rule hits over a time period, additional latency and compute power for application of a given rule, geographic location of specific rule hits over the time period, number of recent threats block or detected by a given rule, and quantification of threat impact of each rule.

2 . The method of claim 1 , wherein the objective is to maximize threat detection and minimize latency and compute resources.

3 . The method of claim 1 , wherein the prioritization is based on a geographic location of the given WAF agent.

4 . The method of claim 1 , wherein the machine learning algorithm is trained to perform the prioritization based on the objective.

5 . The method of claim 1 , wherein the machine learning algorithm uses one of a Random Forest, Gradient Boosting Machines, K-Means Clustering, Reinforcement Learning, and Neural Networks.

6 . The method of claim 1 , wherein the objective includes one or more of location, latency, and usage.

7 . The method of claim 1 , wherein the plurality of WAF agents include a set having statically configured security profiles for generating corresponding raw WAF data for use in the analyzing.

8 . The method of claim 1 , wherein the plurality of WAF agents include a set having security profiles for allowing all traffic for generating corresponding raw WAF data for use in evaluating effectiveness of various rules.

9 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:

receiving raw data related to operation of a plurality of Web Application Firewall (WAF) agents, wherein the plurality of WAF agents are distributed across multiple tenants globally over the Internet;

normalizing and sanitizing the raw data;

analyzing the normalized and sanitized data with a machine learning algorithm to determine prioritization of rules in a given WAF agent based on the raw data and an objective; and

providing a security profile to the given WAF agent where the security profile includes a selection of the rules based on the prioritization and the objective,

wherein the raw data includes specific rule hits over a time period, additional latency and compute power for application of a given rule, geographic location of specific rule hits over the time period, number of recent threats block or detected by a given rule, and quantification of threat impact of each rule.

10 . The non-transitory computer-readable medium of claim 9 , wherein the objective is to maximize threat detection and minimize latency and compute resources.

11 . The non-transitory computer-readable medium of claim 9 , wherein the prioritization is based on a geographic location of the given WAF agent.

12 . The non-transitory computer-readable medium of claim 9 , wherein the machine learning algorithm is trained to perform the prioritization based on the objective.

13 . The non-transitory computer-readable medium of claim 9 , wherein the machine learning algorithm uses one of a Random Forest, Gradient Boosting Machines, K-Means Clustering, Reinforcement Learning, and Neural Networks.

14 . The non-transitory computer-readable medium of claim 9 , wherein the objective includes one or more of location, latency, and usage.

15 . The non-transitory computer-readable medium of claim 9 , wherein the plurality of WAF agents include a set having statically configured security profiles for generating corresponding raw WAF data for use in the analyzing.

16 . The non-transitory computer-readable medium of claim 9 , wherein the plurality of WAF agents include a set having security profiles for allowing all traffic for generating corresponding raw WAF data for use in evaluating effectiveness of various rules.

17 . A Web Application Firewall (WAF) security profile generation system comprising circuitry configured to:

receive raw data related to operation of a plurality of WAF agents, wherein the plurality of WAF agents are distributed across multiple tenants globally over the Internet;

normalize and sanitize the raw data;

analyze the normalized and sanitized data with a machine learning algorithm to determine prioritization of rules in a given WAF agent based on the raw data and an objective; and

provide a security profile to the given WAF agent where the security profile includes a selection of the rules based on the prioritization and the objective,

wherein the raw data includes specific rule hits over a time period, additional latency and compute power for application of a given rule, geographic location of specific rule hits over the time period, number of recent threats block or detected by a given rule, and quantification of threat impact of each rule.