Web-based intrusion detection integrating visibility into web app and database

Question

Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible.

It seems like one plausible approach might be to build an intrusion detection system that has observability at two points: (a) at the web server level (e.g., to observe the page being executed, the request URL, request parameters, the session cookie), and (b) at the database level (e.g., to observe the SQL query that is being executed). I can imagine many opportunities to build an anomaly detector and monitoring system that can detect many attacks. For instance, if in the past SQL queries initiated from the page foo.php have been SELECT queries, and now you see an UPDATE or DROP command, that might be suspicious. If I see a query that contains a semicolon or a nested subquery, and I've never seen that before from that page, that might be suspicious. And so on. This is the kind of thing that can only be be implemented with visibility into both the web request (e.g., at the web server or front-end level) and the database.

Has anyone looked at this kind of system before? Has anyone built it, and if so, how well does it work? Is there a standard name for this sort of system? (My understanding is that a web application firewall normally has visibility only into the web application but not into the database, so it is different.) Are there existing systems like this available commercially or as open source?

Answer 1

i do not want to advertise a commercial solution, but there exists one database firewall i know of that offers such kind of db-protection you asked for, including learning-mode, whitelisting etc.

Has anyone built it, and if so, how well does it work?

it works as well as your implementation. a good implementation is needed, since each of these products needs to be finetuned. the better you define requirements, the easier it is.

automated whitelist-generation for both the WAF and DB-Firewall might be included into your regular deployment-cycles, e.g. generated on test-systems in learning-mode and updated/transferred on(to) your live-systems during deployments.

my pov: WAFs and WAF-style protection works very well against automated attacks and the dump, while not against those smart guys who know how to hide their attacks within regular requests proof: case1, case2

Is there a standard name for this sort of system?

defense in depth :))))

Are there existing systems like this available commercially or as open source?

no all-in-one solution afaik, and it wouldnt make much sense: you would like to have your WAF in your frontend-gateway and the db-protection between your appservers and databases. http-request are afar more complex than sql-queries, and the filter-approach is quite different. weaponized with lua you can blow up your waf to a real cool toy, esp. when generating profile-based protection.

i usually suggest nginx+naxsi as a simple, pattern based waf, if possible pure whitelisting, and if you need more, a customized LuaWAF. on the db-level i go green :D

when you need more protection and want to filter not only incoming, but also outging traffic i'd suggest snort/suricata between your frontends/app-servers; i like this solution from a performance-pov; mod_security for instance, a solution we used before, is total PITA in both performance and rule-maintainance.

Answer 2

You should look into OWASP's App Sensor project; it is doing exactly the type of things you are talking about. Its more a proof of concept / example implementation, but the idea works and has a lot of merit.

The project is focused on defining detection points and potential actions; they feel that each site should setup the rules between the two. We all get that feeling some times and start paying more attention to situations and I think the project makes some really good observations that our application should do a similar thing so a potential action is to increase the logging level.

Apologizes for adding an answer vs a comment; I don't have enough reputation to just comment.