Automatic generation of attribute values for rules of a web application layer attack detector
According to one embodiment, a web application layer attack detector (AD) is coupled between an HTTP client and a web application server. Responsive to receipt of a set of packets from the HTTP client carrying a web application layer message that violates a condition of a security rule, the AD transmits an alert package to an automatic attribute value generation and rule feedback module (AVGRFM). The AVGRFM uses the alert package, and optionally other alert packages from the same AD or other ADs, to automatically generate a new set of attribute values for each of a set of attribute identifiers for use, by the AD or other ADs, in a different security rule than the violated security rule. The new set of attribute values may be used in an attack specific rule to detect a previously unknown web application layer attack.
1. A method in an electronic device communicatively coupled to a set of one or more web application layer attack detectors (ADs), wherein the set of ADs are communicatively coupled between one or more Hypertext Transfer Protocol (HTTP) clients and one or more web application servers to protect the one or more web application servers against application layer attacks, and wherein the set of ADs apply rules that each comprise a condition including a set of one or attribute values corresponding to one or more attribute identifiers, the method comprising:
receiving, from an AD of the set of ADs that applies both a first rule and a second rule to a set of one or more packets collectively carrying a web application layer request message sent by a HTTP client to a web application server, an alert package comprising the web application layer request message, wherein the alert package was sent responsive to the set of packets that collectively carried the web application layer request message and that resulted in the condition of the first rule being met, wherein the first rule is for detecting remote file inclusion (RFI) attacks;
determining, based on the alert package, a set of one or more attribute values for an attribute identifier, wherein the set of attribute values comprises a set of one or more Uniform Resource Locator (URL) values;
filtering, from the set of attribute values, any attribute values that cannot be considered indicative of an attack to form a new set of attribute values for the attribute identifier; and
transmitting, for delivery to the set of ADs, the new set of attribute values for the second rule to be used in the protection of the one or more web application servers against web application layer attacks from the one or more HTTP clients, wherein prior to the transmitting the second rule is different than the first rule that caused the sending of the alert package in that the second rule comprises a condition including an attribute value that is different from any of the attribute values in the set of one or more attribute values included in the condition of the first rule, wherein the transmitting causes a condition of the second rule to be updated with the new set of attribute values.
2. The method of claim 1 , wherein the set of ADs includes a plurality of ADs.
3. The method of claim 2 , wherein the plurality of ADs are operated by different business enterprises at different geographic locations.
4. The method of claim 1 , wherein the second rule is also for detecting RFI attacks.
5. The method of claim 1 , wherein determining the set of attribute values includes:
identifying the set of URL values embedded within one or more parameters of the web application layer request message.
6. The method of claim 1 , wherein filtering any attribute values that cannot be considered indicative of an attack comprises:
downloading one or more resources corresponding to the set of URL values.
7. The method of claim 6 , wherein filtering any attribute values that cannot be considered indicative of an attack further comprises:
determining that at least one of the one or more resources matches at least one known malicious script pattern.
8. The method of claim 7 , wherein filtering any attribute values that cannot be considered indicative of an attack further comprises:
including, in the new set of attribute values, those of the set of URL values that correspond to those of the one or more resources determined to have matched at least one known malicious script pattern.
9. The method of claim 7 , wherein determining that at least one of the one or more resources matches at least one known malicious script pattern comprises:
determining that the at least one of the one or more resources includes scripting language code.
10. The method of claim 7 , wherein determining that at least one of the one or more resources matches at least one known malicious script pattern comprises:
determining that the at least one of the one or more resources includes code with one or more dangerous commands.
11. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors of an electronic device, cause the electronic device to perform operations to protect one or more web application servers against application layer attacks, wherein the electronic device is to be communicatively coupled with a set of one or more web application layer attack detectors (ADs), wherein the set of ADs are to be communicatively coupled between one or more Hypertext Transfer Protocol (HTTP) clients and the one or more web application servers, wherein the set of ADs are to apply rules that each comprise a condition including a set of one or more attribute values corresponding to one or more attribute identifiers, the operations comprising:
receiving, from an AD of the set of ADs that applies both a first rule and a second rule to a set of one or more packets collectively carrying a web application layer request message sent by a HTTP client to a web application server, an alert package comprising the web application layer request message, wherein the alert package was sent responsive to the set of packets that collectively carried the web application layer request message and that resulted in the condition of the first rule being met, wherein the first rule is for detecting remote file inclusion (RFI) attacks;
determining, based on the alert package, a set of one or more attribute values for an attribute identifier, wherein the set of attribute values comprises a set of one or more Uniform Resource Locator (URL) values;
filtering, from the set of attribute values, any attribute values that cannot be considered indicative of an attack to form a new set of attribute values for the attribute identifier; and
transmitting, for delivery to the set of ADs, the new set of attribute values for the second rule to be used in the protection of the one or more web application servers against web application layer attacks from the one or more HTTP clients, wherein prior to the transmitting the second rule is different than the first rule that caused the sending of the alert package in that the second rule comprises a condition including an attribute value that is different from any of the attribute values in the set of one or more attribute values included in the condition of the first rule, wherein the transmitting causes a condition of the second rule to be updated with the new set of attribute values.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the set of ADs includes a plurality of ADs.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the plurality of ADs are operated by different business enterprises at different geographic locations.
14. The non-transitory computer-readable storage medium of claim 11 , wherein the second rule is also for detecting RFI attacks.
15. The non-transitory computer-readable storage medium of claim 11 , wherein determining the set of attribute values includes:
identifying the set of URL values embedded within one or more parameters of the web application layer request message.
16. The non-transitory computer-readable storage medium of claim 11 , wherein filtering any attribute values that cannot be considered indicative of an attack comprises:
downloading one or more resources corresponding to the set of URL values.
17. The non-transitory computer-readable storage medium of claim 16 , wherein filtering any attribute values that cannot be considered indicative of an attack further comprises:
determining that at least one of the one or more resources matches at least one known malicious script pattern.
18. The non-transitory computer-readable storage medium of claim 17 , wherein filtering any attribute values that cannot be considered indicative of an attack further comprises:
including, in the new set of attribute values, those of the set of URL values that correspond to those of the one or more resources determined to have matched at least one known malicious script pattern.
19. The non-transitory computer-readable storage medium of claim 17 , wherein determining that at least one of the one or more resources matches at least one known malicious script pattern comprises:
determining that the at least one of the one or more resources includes scripting language code.
20. The non-transitory computer-readable storage medium of claim 17 , wherein determining that at least one of the one or more resources matches at least one known malicious script pattern comprises:
determining that the at least one of the one or more resources includes code with one or more dangerous commands.