Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique that can identify the unintended violation in the workflow of web application

share|improve this question
1  
Your question is very vague. Can you provide any example of the idea you have in mind? –  Jeff Ferland Sep 5 '12 at 4:24
    
"Swaddler: An approach for the anomaly-based detection of state violations in web applications"i found most relevant to my question can be found at [1]: groups.csail.mit.edu/pag/daikon/pubs/CovaBFV2007-abstract.html –  Ali Ahmad Sep 5 '12 at 4:33
    
That's a very long article, and you've got a very short question. You'll need to summarize it some here. –  Jeff Ferland Sep 5 '12 at 5:09
add comment

1 Answer

up vote 5 down vote accepted

Here are some research papers that tackle this sort of problem and might interest you:

The Ripley paper runs a replica of the client-side code on the server, to verify that the sequence of requests from the client could have arisen from a legal interaction with the system.

The WWW 2009 paper derives a finite-state automaton that captures all possible legal sequences of requests that could arise (while interacting with the web application through its intended interface), and then uses this to build a runtime monitor that can detect attacks by detecting deviations from this finite-state automaton. Several other works also take a similar approach of attempting to somehow obtain a finite-state automaton that characterizes all legal sequences of requests, and then enforcing the requirement that requests must be consistent with this finite-state automaton.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.