Machine learning based web application firewall

1. A method for a machine learning (ML) based web application firewall (WAF), comprising:

receiving raw data;

performing one or more transformations on the received raw data including:

normalizing the received raw data, and

generating a signature over the normalized data;

vectorizing the generated signature to create a first vector of integers;

vectorizing the normalized data to create a second vector of integers;

inputting the first vector of integers and the second vector of integers into a machine learning model;

processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:

a first stage that operates on the first vector of integers to identify candidate signature tokens that are commonly associated with different classes of attack, and

a second stage that operates on the candidate signature tokens and the second vector of integers and conditions attention on the second vector of integers on the candidate signature tokens;

wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious; and

enforcing a traffic processing rule for the received raw data that instructs the WAF to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.

2. The method of claim 1 , wherein the raw data is a Hypertext Transfer Protocol (HTTP) request.

3. The method of claim 2 , further comprising:

extracting a plurality of parts of the HTTP request; and

wherein the one or more transformations are performed on each of the extracted plurality of parts of the HTTP request.

4. The method of claim 3 , wherein the plurality of parts of the HTTP request include at least two of:

RequestURI;

Referer-Path;

User-Agent;

Content-Type; and

Body.

5. The method of claim 1 , wherein generating the signature over the normalized data includes replacing each contiguous sequence of non-special characters with a placeholder token.

6. The method of claim 1 , wherein the score is indicative of the raw data being of a type that is related to an SQL injection (SQLi) attack, a cross site scripting (XSS) attack, a remote code execution (RCE) attack.

7. The method of claim 1 , wherein each integer in the second vector of integers represents a token in a finite vocabulary.

8. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform operations comprising:

receiving raw data;

performing one or more transformations on the received raw data including:

normalizing the received raw data, and

generating a signature over the normalized data;

vectorizing the generated signature to create a first vector of integers;

vectorizing the normalized data to create a second vector of integers;

inputting the first vector of integers and the second vector of integers into a machine learning model;

processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:

a first stage that operates on the first vector of integers to identify candidate signature tokens that are commonly associated with different classes of attack, and

a second stage that operates on the candidate signature tokens and the second vector of integers and conditions attention on the second vector of integers on the candidate signature tokens;

wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious; and

enforcing a traffic processing rule for the received raw data that instructs a web application firewall (WAF) to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.

9. The non-transitory machine-readable storage medium of claim 8 , wherein the raw data is a Hypertext Transfer Protocol (HTTP) request.

10. The non-transitory machine-readable storage medium of claim 9 , wherein the operations further comprise:

extracting a plurality of parts of the HTTP request; and

wherein the one or more transformations are performed on each of the extracted plurality of parts of the HTTP request.

11. The non-transitory machine-readable storage medium of claim 10 , wherein the plurality of parts of the HTTP request include at least two of:

RequestURI;

Referer-Path;

User-Agent;

Content-Type; and

Body.

12. The non-transitory machine-readable storage medium of claim 8 , wherein generating the signature over the normalized data includes replacing each contiguous sequence of non-special characters with a placeholder token.

13. The non-transitory machine-readable storage medium of claim 8 , wherein the score is indicative of the raw data being of a type that is related to an SQL injection (SQLi) attack, a cross site scripting (XSS) attack, a remote code execution (RCE) attack.

14. The non-transitory machine-readable storage medium of claim 8 , wherein each integer in the second vector of integers represents a token in a finite vocabulary.

15. An apparatus, comprising:

a processor; and

a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the apparatus to perform operations including:

receiving raw data;

performing one or more transformations on the received raw data including:

normalizing the received raw data, and

generating a signature over the normalized data;

vectorizing the generated signature to create a first vector of integers;

vectorizing the normalized data to create a second vector of integers;

inputting the first vector of integers and the second vector of integers into a machine learning model;

processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:

a first stage that operates on the first vector of integers to identify candidate signature tokens that are commonly associated with different classes of attack, and

a second stage that operates on the candidate signature tokens and the second vector of integers and conditions attention on the second vector of integers on the candidate signature tokens;

wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious; and

enforcing a traffic processing rule for the received raw data that instructs a web application firewall (WAF) to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.

16. The apparatus of claim 15 , wherein the raw data is a Hypertext Transfer Protocol (HTTP) request.

17. The apparatus of claim 16 , wherein the operations further comprise:

extracting a plurality of parts of the HTTP request; and

wherein the one or more transformations are performed on each of the extracted plurality of parts of the HTTP request.

18. The apparatus of claim 17 , wherein the plurality of parts of the HTTP request include at least two of:

RequestURI;

Referer-Path;

User-Agent;

Content-Type; and

Body.

19. The apparatus of claim 15 , wherein generating the signature over the normalized data includes replacing each contiguous sequence of non-special characters with a placeholder token.

20. The apparatus of claim 15 , wherein the score is indicative of the raw data being of a type that is related to an SQL injection (SQLi) attack, a cross site scripting (XSS) attack, a remote code execution (RCE) attack.

21. The apparatus of claim 15 , wherein each integer in the second vector of integers represents a token in a finite vocabulary.