TECHNICAL FIELD

The disclosure generally relates to web application firewalls (WAFs) and particularly to configuration of WAFs.

BACKGROUND

Web applications are advantageous for a number of reasons, among them that the application can be updated easily by the author(s) from a single point, it eliminates having multiple versions of software ‘in the wild’, and in general provides the author with more control over their software. Web applications also provides users with the ability to use applications without requiring downloading special software, libraries, plugins, and so on. Web applications, however, are also vulnerable to web-based threats, and as such require security solutions.

To be protected, companies heavily invest in security solutions, such as anti-virus software and firewalls. However, as security solutions become more and more advanced so do web attacks. Web attacks may be in form of viruses, worms, Trojan horses, script-based, system intrusions, and many others. Such attacks allow the attacker to control computers, access confidential information, and destroy valuable data.

One such solution is a web application firewall (WAF). A WAF is typically deployed in-line of traffic between clients and a server hosting a protected web-applications. A WAF filters, monitors, and blocks hypertext transfer protocol (HTTP) traffic to and from a web application. This is achieved by supplying the WAF with authorization rules or security policies to determine what traffic should be filtered, blocked, or let through. The security policies are configured based on known attack patterns or vulnerable application-paths. Such policies may be defined as blocklist (what should be block) or whitelist (what should be allowed)

One solution suggests manually configuring WAF polices. However, such approach is efficient as it requires advance knowledge of known attack patterns or paths. Configuring a WAF for controlling access to an application can be a time consuming and human error-prone process. Furthermore, customer's requirements are not static and indeed fluctuate based for example on their development and business needs. This may lead to outdated, flawed and therefore even dangerous misconfigurations of WAF. Additionally, some of the required values for configuration are not obvious and this fact complicates both onboarding and re-configuration of the WAF service. This complexity affects not only the time required for configuration, but the quality of such a configuration as well.

Furthermore, as web applications are dynamically changed by programmers and the system administrator often does not have full control over all these rapidly occurring changes, many of them being reported afterwards, if at all. Thus, the policy is statically enforced, and thus the web applications remain vulnerable.

Other solution suggest crawling the web-applications to learn the structure of an application and generate policies based on the crawling. As this is solution is not a static solution, yet crawling cannot be rapidly adapted to capture changes in web applications. In today's computing environment, applications may be in changes every a few seconds (e.g., online retail sales).

It would therefore be advantageous to provide a solution that would overcome the deficiencies noted above.

SUMMARY

A summary of several example embodiments of the disclosure follows. This summary is provided for the convenience of the reader to provide a basic understanding of such embodiments and does not wholly define the breadth of the disclosure. This summary is not an extensive overview of all contemplated embodiments, and is intended to neither identify key or critical elements of all embodiments nor to delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description that is presented later. For convenience, the term “certain embodiments” may be used herein to refer to a single embodiment or multiple embodiments of the disclosure.

Certain embodiments disclosed herein include a method for configuring a web application firewall (WAF) device. The method comprising: continuously receiving events of an event log associated with a first web based application; generating for each event a signature using a local sensitive hash function; populating a Markov model based on signatures generated for the events, wherein each node in the Markov model corresponds to a generated signature; generating a first new signature for a first new received event, and a second new signature for a second new received event, wherein the second event is subsequent to the first event; determining a probability based on the Markov model that the second event is subsequent to the first event, by locating a first node corresponding to the first new signature and a second node corresponding to the second new signature; and authorizing a request associated with the second event, in response to determining that the determined probability exceeds a predefined threshold.

Certain embodiments disclosed herein also include a system for configuring a web application firewall (WAF) device. The system comprising: a network card interface to allow a network connection; a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: continuously receive events of an event log associated with a first web based application; generate for each event a signature using a local sensitive hash function; populate a Markov model based on signatures generated for the events, wherein each node in the Markov model corresponds to a generated signature; generate a first new signature for a first new received event, and a second new signature for a second new received event, wherein the second event is subsequent to the first event; determine a probability based on the Markov model that the second event is subsequent to the first event, by locating a first node corresponding to the first new signature and a second node corresponding to the second new signature; and authorize a request associated with the second event, in response to determining that the determined probability exceeds a predefined threshold.

