Characterization of illegitimate web transactions

1. A method for configuring a web application firewall (WAF) based on characterization of web attacks, comprising:

receiving a plurality of hypertext transfer protocol transactions (HTTP) entities;

tokenizing the received plurality of HTTP entities based on at least one delimiter;

analyzing statistical distribution of each of the at least one delimiter in the tokenized HTTP entities;

training a model based on an analysis of the tokenized HTTP entities, when a sufficient number of HTTP entities have been analyzed; and

configuring, based on the trained model, the WAF with at least one detection rule to detect at least malicious HTTP transactions.

2. The method of claim 1 , wherein the trained model is a supervised model, and wherein the method further comprising:

training the model to identify at least one of: legitimate hypertext transfer protocol transactions (HTTP) and illegitimate HTTP transactions.

3. The method of claim 1 , wherein an illegitimate HTTP entity is indicative of an attempted web attack.

4. The method of claim 1 , wherein each HTTP entity of the plurality of HTTP entities includes at least one of: a request path, a header, a request body, a reply path, and a query argument.

5. The method of claim 1 , wherein each HTTP entity of the plurality of HTTP entities is a user defined HTTP entity.

6. The method of claim 1 , wherein a delimiter is defined in an RFC 3986.

7. The method of claim 1 , wherein a delimiter is a user defined delimiter.

8. The method of claim 1 , wherein tokenizing the HTTP entities further comprises:

determining at least a frequency of at least a delimiter.

9. The method of claim 1 , wherein tokenizing the HTTP entities further comprises:

determining at least a distribution of at least a delimiter.

10. The method of claim 1 , wherein tokenizing the HTTP entities further comprises:

determining at least one of a frequency and a statistical distribution of at least one of: the at least one delimiter and at least one tokenized HTTP entity.

11. The method of claim 1 , wherein the trained model is an unsupervised model, and wherein the method further comprises:

analyzing statistical distribution of at least two delimiters in the tokenized HTTP entities.

12. The method of claim 1 , wherein detecting at least malicious HTTP transactions further comprises:

receiving an HTTP entity after the training of the model;

tokenizing the after-the-training-of-the-model-received HTTP entity to determine a HTTP entity profile; and

providing the HTTP entity profile to the at least a model to determine after the training of the model whether the HTTP entity is an illegitimate HTTP entity, wherein an illegitimate HTTP entity is indicative that a malicious HTTP transaction is detected.

13. The method of claim 12 , further comprising:

performing at least a mitigation action when a malicious HTTP transaction is detected.

14. The method of claim 13 , wherein an HTTP entity profile is provided by at least one of: frequency of at least a delimiter, distribution of at least a delimiter, frequency of at least a term, distribution of at least a term.

15. The method of claim 1 , wherein the WAF provides web application and application programming interface (API) protection.

16. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a process for configuring a web application firewall (WAF) based on characterization of web attacks, comprising:

receiving a plurality of hypertext transfer protocol transactions (HTTP) entities;

tokenizing the received plurality of HTTP entities based on at least one delimiter;

analyzing statistical distribution of each of the at least one delimiter in the tokenized HTTP entities;

training a model based on an analysis of the tokenized HTTP entities, when a sufficient number of HTTP entities have been analyzed; and

configuring, based on the trained model, the WAF with at least one detection rule to detect at least malicious HTTP transactions.

17. A device for configuring a web application firewall (WAF) based on characterization of web attacks, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the device for:

receiving a plurality of hypertext transfer protocol transactions (HTTP) entities;

tokenizing the received plurality of HTTP entities based on at least one delimiter;

analyzing statistical distribution of each of the at least one delimiter in the tokenized HTTP entities;

training a model based on an analysis of the tokenized HTTP entities, when a sufficient number of HTTP entities have been analyzed; and

configuring, based on the trained model, the WAF with at least one detection rule to detect at least malicious HTTP transactions.

18. The device of claim 17 , wherein the trained model is a supervised model, and wherein the device is further configured to:

train the model to identify at least one of: legitimate hypertext transfer protocol transactions (HTTP) and illegitimate HTTP transactions.

19. The device of claim 17 , wherein an illegitimate HTTP entity is indicative of an attempted web attack.

20. The device of claim 17 , wherein each HTTP entity of the plurality of HTTP entities includes at least one of: a request path, a header, a request body, a reply path, and a query argument.

21. The device of claim 17 , wherein each HTTP entity of the plurality of HTTP entities is a user defined HTTP entity.

22. The device of claim 17 , wherein a delimiter is defined in an RFC 3986.

23. The device of claim 17 , wherein a delimiter is a user defined delimiter.

24. The device of claim 17 , wherein the device is further configured to:

determine at least a frequency of at least a delimiter.

25. The device of claim 17 , wherein the device is further configured to:

determine at least a distribution of at least a delimiter.

26. The device of claim 17 , wherein the device is further configured to:

determine at least one of a frequency and a statistical distribution of at least one of: the at least one delimiter and at least one tokenized HTTP entity.

27. The device of claim 17 , wherein the trained model is an unsupervised model, and wherein the device is further configured to:

analyze statistical distribution of at least two delimiters in the tokenized HTTP entities.

28. The device of claim 17 , wherein the device is further configured to:

receive an HTTP entity after the training of the model;

tokenize the after-the-training-of-the-model-received HTTP entity to determine a HTTP entity profile; and

provide the HTTP entity profile to the at least a model to determine whether the after the training of the model HTTP entity is an illegitimate HTTP entity, wherein an illegitimate HTTP entity is indicative that a malicious HTTP transaction is detected.

29. The device of claim 28 , wherein the device is further configured to:

performing at least a mitigation action when a malicious HTTP transaction is detected.

30. The device of claim 29 , wherein an HTTP entity profile is provided by at least one of: frequency of at least a delimiter, distribution of at least a delimiter, frequency of at least a term, distribution of at least a term.

31. The device of claim 17 , wherein the WAF provides web application and application programming interface (API) protection.