Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation of them.

share|improve this question
    
AFAIK, Anamoly based IPS exist , which ofcourse not populat these days . –  sashank Aug 26 '12 at 16:34
add comment

2 Answers

up vote 1 down vote accepted

Check ModSecurity - it's quite decent approach, it does include anomaly as well collective scoring system. You can have a look at Core Rules, there are anomaly entries too. You just load Core Rules to ModSecurity, and there you go, all you need is to test applications and eventually delete, add, modify some rules.

Anomaly entries protect mainly from automated bots or other suspicious clients doing very unsual requests. Without rules made for specific applications (there are rules for popular cmses), what it does prevent is eg requesting web content with non-standard set of headers.

When there are rules for specific applications, it prevents some requests which are not typical for specific application, however how this specifically works and to what level you would need to have a look at Core Rules.

These rules are not some super-specific, but they have more practical approach the way that with no big philosophy they just score anomalies based on rules, and it requires a lot of tuning and changing to get this to work with any specific app, so basically it does what is in the rules, plus what you can do yourself.

They don't protect from bad words, but that's easy to add, they also don't protect from well obfuscated and designed attacks.

Here is a list of protections from Core Rules, which are part of ModSecurity:

  • HTTP Protection - detecting violations of the HTTP protocol and a locally defined usage policy.
  • Real-time Blacklist Lookups - utilizes 3rd Party IP Reputation
  • Web-based Malware Detection - identifies malicious web content by check against the Google Safe Browsing API.
  • HTTP Denial of Service Protections - defense against HTTP Flooding and Slow HTTP DoS Attacks.
  • Common Web Attacks Protection - detecting common web application security attack.
  • Automation Detection - Detecting bots, crawlers, scanners and other surface malicious activity.
  • Integration with AV Scanning for File Uploads - detects malicious files uploaded through the web application.
  • Tracking Sensitive Data - Tracks Credit Card usage and blocks leakages.
  • Trojan Protection - Detecting access to Trojans horses.
  • Identification of Application Defects - alerts on application misconfigurations.
  • Error Detection and Hiding - Disguising error messages sent by the server.

ModSecurity is used in vast space of Internet - for example, Akamai, the biggest CDN has this installed on many servers, since they integrated it / or somewhat forked it to their own software. This is because it is cloud friendly - anomaly detection which is collective based - the information comes from several servers, hence it detects anomalies which are geographically distributed between your own servers.

share|improve this answer
add comment

Try checking Big-IP from F5... used by Facebook, BoA and other companies..

http://news.netcraft.com/archives/2009/05/29/f5_bigip_hosts_10_million_sites.html

It is the ASM (Application Security Manager) that handles the web attack protection... http://www.f5.com/products/big-ip/

share|improve this answer
    
Welcome to IT Security! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Aug 27 '12 at 18:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.