Method and system for protecting web applications against web attacks

1. A system for protecting a web application against a web attack, the system comprising:

an in-application agent comprising a separate module which includes an in-application library for storing rules and a rules processor for applying rules for protecting the web application in which the in-application agent is embedded and for generating reports of suspicious activity, wherein the web application with the in-application agent embedded therein runs on a remote server comprising a computing device having a processor coupled to a memory and to a data communication port;

a cloud service running on a set of remote servers for providing rules, receiving the reports and generating new rules in response to the reports received without user intervention in the in-application agent; and

an agent manager in communication with the cloud service for receiving the rules from the cloud service and passing the rules received to the in-application agent and for receiving the reports from the in-application agent and passing the reports received to the cloud service,

wherein the cloud service is configured to enhance a generic detection rule over time using a number of server faults generated over a first time period and a number of web requests in a second time period and push the enhanced rule to the in-application library in real time.

2. The system of claim 1 , wherein the rules are called by hooks around interfaces between the web application and a runtime environment.

3. The system of claim 2 , wherein code implementing the rules called by the hooks is modified at runtime without user intervention.

4. The system of claim 1 , wherein the cloud service dynamically updates the rules based upon new threat information received from an external source.

5. The system of claim 1 , wherein the in-application agent includes a link manager for communications with the agent manager.

6. The system of claim 1 wherein the cloud service generates and updates rules in response to both application-level and external data sources.

7. The system of claim 1 wherein, upon receiving the new rules, the in-application agent updates a web protection configuration to use the new rules.

8. The system of claim 1 wherein the in-application agent processes the rules locally to detect and respond to a threat.

9. A method of protecting a web application against a web attack, the method comprising:

embedding an in-application agent comprising a separate module into the web application to be protected, wherein the web application with the in-application agent embedded therein runs on a remote server comprising a computing device having a processor coupled to a memory and to a data communication port;

generating rules in a cloud service running on a set of remote servers;

providing, by an agent manager, the rules generated by the cloud service to the in-application agent;

storing, by an in-application library of the in-application agent, the rules received from the agent manager;

applying, by the in-application agent, the rules to protect the web application in which the in-application agent is embedded; and

enhancing a generic detection rule over time by the cloud service using a number of server faults generated over a first time period and a number of web requests in a second time period; and

pushing the enhanced rule by the cloud service to the in-application library in real time.

10. The method of claim 9 further comprising:

calling the rules by hooks around interfaces between the web application and a runtime environment.

11. The method of claim 10 , wherein code implementing the rules called by the hooks is modified at runtime without user intervention.

12. The method of claim 9 further comprising:

detecting suspicious activity by the in-application agent;

generating a report;

sending the report from the in-application agent to the agent manager; and

sending the report from the agent manager to the cloud service.

13. The method of claim 12 further comprising, upon receiving the report at the cloud service:

generating a new rule; and

sending the new rule to the in-application agent via the agent manager.

14. The method of claim 9 further comprising:

receiving new threat information at the cloud service from an external source;

generating new rules; and

sending the new rules to the in-application agent via the agent manager; and

the in-application agent using the new rules to protect against a new threat.

15. A non-transitory computer readable medium comprising instructions in code which when stored in a memory of a computing device and executed by a processor of the computing device cause the computing device to:

execute an in-application agent comprising a separate module embedded in a web application, the in-application agent including:

an in-application library for storing rules;

a rules processor for applying the rules and for generating one or more reports; and

a link manager for receiving new rules from a cloud service generated in response to the one or more reports,

wherein the rules are called by one or more hooks around interfaces between the web application and a runtime environment,

wherein code implementing the rules is modified at runtime without user intervention, and

wherein the cloud service is configured to enhance a generic detection rule over time using a number of server faults generated over a first time period and a number of web requests in a second time period and push the enhanced rule to the in-application library in real time.

16. The computer readable medium of claim 15 , wherein the link manager communicates with the cloud service by communicating via an encrypted link with an agent manager.

17. The computer readable medium of claim 15 , wherein the rules processor disables input/output operations to sandbox the new rules injected into the web application.