Anomaly based web application Firewall

Question

How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation of them.

Answer 1

Check ModSecurity - it's quite decent approach, it does include anomaly as well collective scoring system. You can have a look at Core Rules, there are anomaly entries too. You just load Core Rules to ModSecurity, and there you go, all you need is to test applications and eventually delete, add, modify some rules.

Anomaly entries protect mainly from automated bots or other suspicious clients doing very unsual requests. Without rules made for specific applications (there are rules for popular cmses), what it does prevent is eg requesting web content with non-standard set of headers.

When there are rules for specific applications, it prevents some requests which are not typical for specific application, however how this specifically works and to what level you would need to have a look at Core Rules.

These rules are not some super-specific, but they have more practical approach the way that with no big philosophy they just score anomalies based on rules, and it requires a lot of tuning and changing to get this to work with any specific app, so basically it does what is in the rules, plus what you can do yourself.

They don't protect from bad words, but that's easy to add, they also don't protect from well obfuscated and designed attacks.

Here is a list of protections from Core Rules, which are part of ModSecurity:

• HTTP Protection - detecting violations of the HTTP protocol and a locally defined usage policy.
• Real-time Blacklist Lookups - utilizes 3rd Party IP Reputation
• Web-based Malware Detection - identifies malicious web content by check against the Google Safe Browsing API.
• HTTP Denial of Service Protections - defense against HTTP Flooding and Slow HTTP DoS Attacks.
• Common Web Attacks Protection - detecting common web application security attack.
• Automation Detection - Detecting bots, crawlers, scanners and other surface malicious activity.
• Integration with AV Scanning for File Uploads - detects malicious files uploaded through the web application.
• Tracking Sensitive Data - Tracks Credit Card usage and blocks leakages.
• Trojan Protection - Detecting access to Trojans horses.
• Identification of Application Defects - alerts on application misconfigurations.
• Error Detection and Hiding - Disguising error messages sent by the server.

ModSecurity is used in vast space of Internet - for example, Akamai, the biggest CDN has this installed on many servers, since they integrated it / or somewhat forked it to their own software. This is because it is cloud friendly - anomaly detection which is collective based - the information comes from several servers, hence it detects anomalies which are geographically distributed between your own servers.

Answer 2

Try checking Big-IP from F5... used by Facebook, BoA and other companies..

http://news.netcraft.com/archives/2009/05/29/f5_bigip_hosts_10_million_sites.html

It is the ASM (Application Security Manager) that handles the web attack protection... http://www.f5.com/products/big-ip/