Visible to the public Automatically Repairing Web Application Firewalls Based on Successful SQL Injection Attacks

TitleAutomatically Repairing Web Application Firewalls Based on Successful SQL Injection Attacks
Publication TypeConference Paper
Year of Publication2017
AuthorsAppelt, D., Panichella, A., Briand, L.
Conference Name2017 IEEE 28th International Symposium on Software Reliability Engineering (ISSRE)
KeywordsAutomated Testing, Collaboration, combinatorial mathematics, combinatorial optimisation problem, Decision trees, filter rules, firewalls, Firewalls (computing), genetic algorithms, Human Behavior, Internet, learning (artificial intelligence), legitimate requests, machine learning, multiobjective genetic algorithms, policy, policy-based governance, Policy-Governed Secure Collaboration, privacy, program testing, pubcrawl, Regular Expression Inference, Resiliency, search problems, software maintenance, SQL, SQL Injection, SQL Injection attacks, Testing, vulnerabilities detection, vulnerable WAFs, WAF rule set, web application firewalls, Web application firewalls repair, web security

Testing and fixing Web Application Firewalls (WAFs) are two relevant and complementary challenges for security analysts. Automated testing helps to cost-effectively detect vulnerabilities in a WAF by generating effective test cases, i.e., attacks. Once vulnerabilities have been identified, the WAF needs to be fixed by augmenting its rule set to filter attacks without blocking legitimate requests. However, existing research suggests that rule sets are very difficult to understand and too complex to be manually fixed. In this paper, we formalise the problem of fixing vulnerable WAFs as a combinatorial optimisation problem. To solve it, we propose an automated approach that combines machine learning with multi-objective genetic algorithms. Given a set of legitimate requests and bypassing SQL injection attacks, our approach automatically infers regular expressions that, when added to the WAF's rule set, prevent many attacks while letting legitimate requests go through. Our empirical evaluation based on both open-source and proprietary WAFs shows that the generated filter rules are effective at blocking previously identified and successful SQL injection attacks (recall between 54.6% and 98.3%), while triggering in most cases no or few false positives (false positive rate between 0% and 2%).

Citation Keyappelt_automatically_2017