Statistical approach for augmenting signature detection in web application firewall
In an embodiment, a statistical approach for augmenting signature detection in a Web application firewall includes receiving a new request including a parameter in a uniform resource identifier (URI), tokenizing the new request, and determining a compound probability that tokens in a value that is associated with the parameter of the URI and that is included in the new request are associated with an attack. The compound probability is determined based at least in part on component probabilities of tokens of historical values associated with the parameter of the URI.
1. A method of performing firewall operations for a network based on a dynamic categorization of parameters stored in received packets, the method comprising:
receiving a first packet comprising a uniform resource identifier (URI) that includes a parameter;
generating a plurality of tokens from the parameter; and
computing a compound probability by aggregating component probability computed for each generated token in the plurality of generated tokens, wherein the compound probability expresses whether the plurality of generated tokens is associated with an attack on the network, wherein said computing the compound probability comprises computing the compound probability from a set of one or more probabilities that were computed previously for sets of one or more prior tokens each set of which (i) is generated for a received prior packet and (ii) is similar to the plurality of generated tokens,
wherein a first component probability for a first generated token is computed from a set of one or more probabilities that were computed previously for a first set of one or more prior tokens each of which (i) is generated for a packet received prior to the first packet and (ii) is similar to the first token,
wherein a second component probability for a second generated token is computed from a set of one or more probabilities that were computed previously for a second set of one or more prior tokens each of which (i) is generated for a packet received prior to the first packet and (ii) is similar to the second token.
2. The method of claim 1 further comprising dropping the first packet in response to the compound probability being above a threshold.
3. The method of claim 1 , further comprising determining whether to drop the first packet based at least in part on a reputation of a client that sent the first packet in response to the computed probability being above a threshold.
4. The method of claim 1 , further comprising, prior to generating the token from the parameter, decoding URI encoded characters in the parameter.
5. The method of claim 1 , further comprising, prior to generating the token from the parameter, removing comments from the parameter.
6. The method of claim 1 , further comprising, prior to generating the token from the parameter, removing SQL- or HTML-style comments from the parameter.
7. The method of claim 1 , further comprising, prior to generating the token from the parameter, removing digits from the parameter.
8. The method of claim 1 , further comprising, after generating the token from the parameter, converting the token to lowercase.
9. The method of claim 2 , wherein the compound probability accounts for random error.
10. The method of claim 1 , wherein the first set of one or more prior tokens used for generating the first component probability includes similar tokens as measured by a fuzzy search.
11. The method of claim 1 , wherein the first set of one or more prior tokens used for generating the first component probability includes tokens having a similarity measure with the first generated token below a threshold.
12. A system for performing firewall operations in a network, the system comprising:
a processor configured to:
receive a first packet comprising a uniform resource identifier (URI) that includes a parameter;
generate a plurality of tokens from the parameter; and
compute a compound probability by aggregating component probability computed for each generated token in the plurality of generated tokens, wherein the compound probability expresses whether the plurality of generated tokens is associated with an attack on the network, wherein said computing the compound probability comprises computing the compound probability from a set of one or more probabilities that were computed previously for sets of one or more prior tokens each set of which (i) is generated for a received prior packet and (ii) is similar to the plurality of generated tokens
wherein a first component probability for a first generated token is computed from a set of one or more probabilities that were computed previously for a first set of one or more prior tokens each of which (i) is generated for a packet received prior to the first packet and (ii) is similar to the first token,
wherein a second component probability for a second generated token is computed from a set of one or more probabilities that were computed previously for a second set of one or more prior tokens each of which (i) is generated for a packet received prior to the first packet and (ii) is similar to the second token; and
a memory coupled to the processor and configured to provide the processor with instructions.
13. The system of claim 12 , wherein the processor is further configured to, prior to generating the token from the parameter, decode URI encoded characters in the parameter.
14. The system of claim 12 , wherein the processor is further configured to, prior to generating the token from the parameter, remove comments from the parameter.
15. The system of claim 12 , wherein the processor is further configured to, prior to generating the token from the parameter, remove SQL- or HTML-style comments from the parameter.
16. The system of claim 12 , wherein the processor is further configured to, prior to generating the token from the parameter, remove digits from the parameter.
17. A computer program product embodied in a non-transitory computer readable storage medium, the computer program for performing firewall operations for a network and comprising computer instructions for:
receiving a first packet comprising a uniform resource identifier (URI) that includes a parameter;
generating a plurality of tokens from the parameter; and
computing a compound probability by aggregating component probability computed for each generated token in the plurality of generated tokens, wherein the compound probability expresses whether the plurality of generated tokens is associated with an attack on the network, wherein said computing the compound probability comprises computing the compound probability from a set of one or more probabilities that were computed previously for sets of one or more prior tokens each set of which (i) is generated for a received prior packet and (ii) is similar to the generated plurality of tokens,
wherein a first component probability for a first generated token is computed from a set of one or more probabilities that were computed previously for a first set of one or more prior tokens each of which (i) is generated for a packet received prior to the first packet and (ii) is similar to the first token,
wherein a second component probability for a second generated token is computed from a set of one or more probabilities that were computed previously for a second set of one or more prior tokens each of which (i) is generated for a packet received prior to the first packet and (ii) is similar to the second token;
based on the compound probability, determining that the plurality of generated token is associated with an attack; and
generating a firewall policy to drop packets that are similar to the received packet.