Web Application Firewall Using Machine

2024 International Conference on Advances in Computing, Communication and Applied Informatics (ACCAI) | 979-8-3503-8944-9/24/$31.00 ©2024 IEEE | DOI: 10.1109/ACCAI61061.2024.10602105

Learning
Rohith1, Ridhwan Athief1, Naveen Kishore1 and Dr. R Nithya Paranthaman2
1
Dept of Networking & Communication, School of Computing, Faculty of Engineering and Technology, SRM Institute of Science and
Technology, Kattankulathur, India
2
Assistant Professor, Dept of Networking & Communication, School of Computing, Faculty of Engineering and Technology, SRM
Institute of Science and Technology, Kattankulathur, India

E-mail : rv3801@[Link], ra4056@[Link], nk3963@[Link], nithyar2@[Link]

Abstract- In today's digital landscape, web applications play limitations and improve the effectiveness of WAFs, there
a crucial role in various aspects of daily life, from online is growing interest in integrating machine learning (ML)
shopping to social networking. However, their widespread techniques into their architecture. Machine learning
use also makes them attractive targets for cyber-attacks. algorithms offer the potential to enhance WAFs' ability to
Web Application Firewalls (WAFs) act as a frontline defense
mechanism, monitoring and filtering incoming HTTP traffic
detect and respond to threats by analyzing vast amounts
to detect and block malicious requests. Traditional rule- of data, identifying patterns, and making real-time
based WAFs, while effective in many cases, may struggle to decisions.
keep pace with evolving attack techniques and can produce
false positives, leading to unnecessary disruptions for In this paper, we propose a novel approach to augmenting
legitimate users. To address these challenges, this paper web application security through the integration of ML
proposes an innovative approach to enhance WAFs using algorithms, specifically Multinomial Naive Bayes and
machine learning techniques. By integrating Multinomial Random Forest classifiers, into the WAF framework.
Naive Bayes and Random Forest classifiers into the WAF Multinomial Naive Bayes is well-suited for modeling the
architecture, we aim to improve detection accuracy and
reduce false alarms. Our experimental results on synthetic
probabilities of different features in HTTP requests, while
HTTP request data demonstrate promising outcomes, Random Forest leverages ensemble learning to improve
showing the potential of machine learning in bolstering web classification accuracy and robustness. We conducted a
application security. series of experiments using synthetic HTTP request data
to evaluate the performance of our proposed approach.
Keywords-- Web Application Firewall, Machine Learning, Our results demonstrate that integrating ML techniques
Multinomial Naive Bayes, Random Forest, Cybersecurity. into WAFs can significantly enhance their ability to detect
and mitigate cyber threats while minimizing false
I. INTRODUCTION positives.

In today's interconnected world, web applications have By leveraging the power of machine learning, our
become ubiquitous tools that facilitate a myriad of online approach represents a significant step forward in
activities, ranging from e-commerce transactions to social strengthening the security posture of web
media interactions and beyond. With this widespread applications.[12] As cyber threats continue to evolve, it is
adoption, however, comes an increased risk of cyber imperative that cybersecurity solutions evolve in tandem.
threats targeting these web-based platforms. Cyber We believe that our research contributes to this ongoing
attackers continually devise new and sophisticated effort by providing a practical and effective means of
methods to exploit vulnerabilities in web applications, enhancing web application security in the face of
posing significant challenges to cybersecurity emerging threats.
professionals. Web Application Firewalls (WAFs) serve
as a critical line of defense against these threats by [Link] WORKS
monitoring and filtering HTTP traffic to web applications.
Ahmad and Bukhari's survey on machine learning
Traditionally, WAFs have relied on static rule-based applications in web application security, published in
approaches to detect and mitigate attacks. While effective 2019, provides a comprehensive overview of the
in some scenarios, these rule sets often struggle to keep utilization of machine learning techniques in enhancing
pace with the rapidly evolving landscape of cyber threats. the security of web applications. The paper outlines the
As a result, WAFs may generate false positives, fundamental concepts of machine learning and explores
incorrectly flagging legitimate traffic as malicious, or its various applications in web security, including
miss genuine threats altogether. To address these intrusion detection, anomaly detection, malware

Authorized licensed use limited to: SRM Institute of Science and Technology. Downloaded on August 02,2024 at 09:59:32 UTC from IEEE Xplore. Restrictions apply.
 detection, and bot detection. modeling. Published by Springer in New York, this book
offers practical insights and methodologies for building
A study conducted in 2020 by Jerbi, Zemmari, and predictive models across various domains. Through clear
Ajlani's survey, offers a concise yet thorough examination explanations and illustrative examples, the authors guide
of the role of machine learning in fortifying web readers through the process of data preprocessing, feature
application security. The paper provides insights into selection, model training, evaluation, and interpretation.
various machine learning techniques and their
applications, including intrusion detection, anomaly Rasheed, Shafiq, and Alenezi (2021) present a machine
detection, malware detection, and bot detection. By learning approach for detecting and mitigating HTTP
addressing challenges and suggesting future research flood attacks in their paper published in IEEE Access.
directions, this survey serves as a valuable resource for This research proposes a novel methodology to identify
researchers and practitioners aiming to enhance the and counteract HTTP flood attacks, a common form of
security of web applications through machine learning Distributed Denial of Service (DDoS) attack targeting
methodologies. web servers. By leveraging machine learning techniques,
the authors aim to enhance the resilience of web
Tavallaee, Bagheri, Lu, and Ghorbani (2009) present a applications against such malicious activities.
detailed analysis of the KDD CUP 99 dataset in their
paper published in the Proceedings of the Second IEEE Sood and Enbody (2013) investigate the detection of SQL
Symposium on Computational Intelligence for Security injection and cross-site scripting (XSS) attacks using
and Defense Applications. The study provides machine learning techniques in their paper presented at
comprehensive insights into the KDD CUP 99 dataset, the 2013 IEEE 14th International Conference on
which is widely used in the field of intrusion detection Information Reuse & Integration (IRI). This study
and network security. By analyzing various aspects of the explores innovative methods for identifying and
dataset, including its characteristics, features, and mitigating two prevalent security threats to web
limitations, the authors offer valuable information to applications: SQL injection and XSS attacks.
researchers and practitioners working in the domain of
cybersecurity. This analysis serves as a foundational Maurya and Gupta (2020) propose a novel approach for
resource for developing and evaluating intrusion detection detecting and preventing XML injection attacks using
systems and other security applications. machine learning techniques in their paper published in
the Journal of King Saud University-Computer and
Ristic (2014) authored "Bulletproof SSL and TLS: Information Sciences. This research introduces innovative
Understanding and Deploying SSL/TLS and PKI to methodologies to identify and mitigate XML injection
Secure Servers and Web Applications," a comprehensive attacks, a prevalent security threat targeting web
guide to SSL/TLS protocols and Public Key Infrastructure applications that process XML data. By leveraging
(PKI). This resource, published by Feisty Duck in machine learning algorithms, the authors aim to enhance
Rockland, provides essential insights into the secure the resilience of web applications against such malicious
deployment of SSL/TLS protocols for safeguarding activities.
servers and web applications. Through detailed
explanations and practical examples, the book equips Moustafa and Slay (2016) introduce the UNSW-NB15
readers with the knowledge needed to effectively dataset, a comprehensive resource designed for network
implement SSL/TLS and PKI solutions, ensuring robust intrusion detection systems (NIDS), in their paper
security measures for online communications and data presented at the Military Communications and
protection. Information Systems Conference (MilCIS). This dataset,
known as UNSW-NB15, provides a wide range of
"ModSecurity: Open-Source Web Application Firewall" network traffic data captured in a realistic environment,
is a valuable resource for enhancing web application making it suitable for evaluating and benchmarking the
security. This open-source tool provides comprehensive performance of intrusion detection systems.
protection against various cyber threats, including SQL
injection, cross-site scripting (XSS), and other common [Link] SYSTEM
vulnerabilities. With its customizable rulesets and real-
time monitoring capabilities, ModSecurity empowers In the realm of web application security, existing systems
organizations to strengthen their defenses and safeguard predominantly rely on signature-based approaches and
web applications from malicious attacks. Accessible and rule sets to detect and mitigate common attacks such as
adaptable, this solution is a go-to option for enhancing the SQL injection, cross-site scripting (XSS), and HTTP
security posture of web servers and applications. flood attacks. These systems often employ predefined
patterns or signatures to identify malicious payloads or
Applied Predictive Modeling" by Kuhn and Johnson suspicious behavior within incoming web traffic. While
(2019) is a foundational text in the field of predictive effective to some extent, signature-based systems are

Authorized licensed use limited to: SRM Institute of Science and Technology. Downloaded on August 02,2024 at 09:59:32 UTC from IEEE Xplore. Restrictions apply.
 limited in their ability to detect novel or polymorphic Machine learning-based solutions offer the potential to
attacks that evade known signatures. address these shortcomings by providing a more nuanced
understanding of web application behavior and user
Additionally, traditional web application firewalls interactions. By analyzing large datasets and identifying
(WAFs) typically lack the sophistication and adaptability subtle patterns indicative of malicious intent, machine
required to effectively combat evolving cyber threats. learning algorithms can effectively detect anomalies and
These systems may struggle to keep pace with the zero-day attacks that evade traditional detection methods.
dynamic nature of modern web applications and the
increasingly sophisticated tactics employed by attackers. [Link] ARCHITECTURE
In the domain of web application security, the prevailing
paradigm revolves around signature-based detection
methods and rule sets employed by traditional web
application firewalls (WAFs) and intrusion
detection/prevention systems (IDPS). These systems
operate by matching incoming traffic against predefined
patterns or signatures of known attacks, allowing them to
identify and block malicious payloads or suspicious
behavior. While effective in many cases, signature-based
approaches are inherently limited by their reliance on
static patterns and their inability to detect novel or
polymorphic attacks that deviate from known signatures.

Moreover, traditional WAFs and IDPS solutions often

face challenges related to false positives, where legitimate
traffic is erroneously flagged as malicious, leading to
unnecessary blockages and disruptions in service. These
false positives can undermine the effectiveness of security
measures and impact user experience, highlighting the
need for more accurate and adaptive detection
mechanisms.

In response to these challenges, there is a growing interest

in leveraging machine learning techniques for web
application security. Machine learning offers the promise
of proactive threat detection and adaptive defense
mechanisms that can evolve with the rapidly changing
threat landscape. By analyzing large volumes of data and
identifying patterns indicative of malicious behavior,
machine learning algorithms can detect anomalies and
Fig. 1. System Architecture
suspicious activities that may evade traditional signature-
based systems.
[Link]
Furthermore, machine learning-based approaches have the
potential to reduce false positives and improve overall Data Ingestion
detection accuracy by learning from historical data and The purpose of Module 1 is the data ingestion phase
adapting to new attack patterns in real-time. This serves as the cornerstone of the methodology, initiating
adaptability is particularly valuable in dynamic the process of acquiring raw data from diverse sources
environments where web applications undergo frequent relevant to web application security. This stage involves
updates and changes. The integration of machine learning the systematic collection and importation of data from
into web application security holds great promise for various channels, including network logs, server records,
enhancing the effectiveness and efficiency of intrusion and application databases. Employing a variety of
detection and prevention efforts. By complementing mechanisms such as APIs, log collectors, database
existing security measures with advanced analytics and connectors, or file transfers, data ingestion ensures the
intelligent algorithms, organizations can better defend comprehensive retrieval of relevant data sets crucial for
against a wide range of cyber threats while minimizing subsequent analysis and processing. The primary
false alarms and ensuring uninterrupted service delivery. objective of this phase is to establish a robust foundation
of data inputs that will drive the subsequent stages of the
methodology.

Authorized licensed use limited to: SRM Institute of Science and Technology. Downloaded on August 02,2024 at 09:59:32 UTC from IEEE Xplore. Restrictions apply.
 Data Preprocessing the machine learning models, organizations can
In Module 2, Following data ingestion, the raw data proactively identify and mitigate security risks,
undergoes a meticulous preprocessing stage aimed at safeguarding their web applications against a wide range
refining its quality and structure to prepare it for analysis. of cyber threats.
This critical phase involves a series of tasks, including
data cleaning, transformation, and formatting. Common [Link] AND DISCUSSION
preprocessing techniques include removing duplicate
entries, handling missing values, standardizing data The experiments conducted in this study aimed to assess
formats, and encoding categorical variables. By the effectiveness of employing machine learning
addressing inconsistencies and anomalies within the data, algorithms for enhancing web application security.
preprocessing ensures that subsequent analytical Specifically, two primary algorithms, Multinomial Naive
processes are based on reliable and standardized data sets, Bayes (MNB) and Random Forest (RF), were evaluated
laying the groundwork for accurate and insightful model using a synthetic dataset generated to simulate HTTP
training. request data.

Model Training Results revealed that the Multinomial Naive Bayes

With the preprocessed data at hand, the methodology (MNB) classifier achieved an accuracy rate of XX% on
proceeds to the model training phase, where machine the test dataset. In comparison, the Random Forest (RF)
learning algorithms are trained to discern patterns and classifier demonstrated a slightly higher accuracy rate of
make predictions based on the input data. Central to this XX%.
stage is the selection of an appropriate algorithm that
aligns with the objectives of the web application security Upon discussion, it was noted that the MNB classifier
analysis. The data is typically divided into training and exhibited robust performance in classifying HTTP
validation sets, with the chosen algorithm trained on the requests despite its assumption of feature independence.
training data and its performance evaluated against the Its simplicity and computational efficiency make it
validation set. Hyperparameter tuning techniques are suitable for processing large volumes of textual data
employed to optimize the model's performance, ensuring commonly found in HTTP requests. However, it may
that it achieves the desired level of accuracy and struggle to capture complex relationships between
generalization across different data samples. features, limiting its ability to discern nuanced patterns in
web application traffic.
Model Evaluation & Comparison
In this module, Once the model has been trained, it On the other hand, the Random Forest (RF) classifier
undergoes a rigorous evaluation process to assess its outperformed MNB by leveraging an ensemble of
performance and effectiveness in addressing the target decision trees to improve classification accuracy. This
security challenges. Model evaluation involves testing the approach enabled RF to capture complex feature
trained model on independent data sets and calculating interactions and nonlinear relationships present in the
various performance metrics, including accuracy, data. Despite its superior accuracy, RF may be
precision, recall, F1-score, and receiver operating computationally expensive, particularly with large
characteristic (ROC) curves. Additionally, models may be datasets or high-dimensional feature spaces. Additionally,
compared against baseline models or alternative RF models may be more prone to overfitting,
algorithms to determine their relative efficacy in necessitating careful parameter tuning and regularization
addressing specific security threats. This comparative techniques.
analysis enables stakeholders to make informed decisions
regarding the selection and deployment of the most In summary, the comparative analysis between MNB and
suitable machine learning models for web application RF underscored the trade-offs between simplicity,
security. interpretability, and accuracy in machine learning models
for web application security. While MNB offers
Output simplicity and computational efficiency, RF provides
The final stage of the methodology focuses on generating higher accuracy and the ability to capture complex feature
actionable insights and outputs based on the trained interactions. Organizations must consider these trade-offs
machine learning models. These outputs may include when selecting an appropriate algorithm based on their
predictions, classifications, or anomaly detections that specific requirements, resource constraints, and the
provide valuable insights into potential security threats complexity of the web application environment.
and vulnerabilities within web applications. The outputs
of the analysis serve as a crucial resource for decision- These findings highlight the potential of machine learning
makers and security professionals, informing strategic algorithms in bolstering web application security by
initiatives aimed at strengthening the security posture of automating the detection and classification of HTTP
web applications. By leveraging the insights gleaned from requests. Further research could explore advanced

Authorized licensed use limited to: SRM Institute of Science and Technology. Downloaded on August 02,2024 at 09:59:32 UTC from IEEE Xplore. Restrictions apply.
 techniques or hybrid approaches to improve classification
accuracy and robustness against evolving cyber threats.
Real-world deployment and evaluation of these models in
production environments would provide valuable insights
into their practical utility and effectiveness in mitigating
security risks.

[Link] AND RESULT ANALYSIS

Fig. 4. PCA Visualization of HTTP Req. Data.

Fig. 2. Display Dataset Fig. 5. Classification Report for Both Classifiers

Fig. 6. Confusion Matrix for Multinomial Naive Bayes

Fig. 3. ROC Curve of Model

Authorized licensed use limited to: SRM Institute of Science and Technology. Downloaded on August 02,2024 at 09:59:32 UTC from IEEE Xplore. Restrictions apply.
 intricate feature interactions. These results underline the
significance of carefully weighing the trade-offs between
simplicity, interpretability, and accuracy when selecting a
machine learning algorithm for web application security.
Organizations must meticulously evaluate their specific
needs, resource constraints, and the intricacies of their
web application environment to discern the most fitting
approach.

[Link] WORK
Future development on the Web Application Firewall:
Moving forward, several avenues for future research
Fig. 7. Confusion Matrix for Random Forest Classifier emerge from this study's findings and limitations. Firstly,
exploring advanced machine learning techniques, such as
deep learning models, could enhance the accuracy and
robustness of web application security systems. Deep
learning algorithms, with their ability to automatically
learn intricate patterns from raw data, may offer superior
performance in detecting sophisticated cyber threats.
Furthermore, integrating anomaly detection methods
alongside traditional classification algorithms could
improve the detection of novel and previously unseen
attacks. Anomaly detection techniques, including
autoencoders and isolation forests, can complement
supervised learning approaches by identifying deviations
from normal behavior in web application traffic.

Fig. 8. Accuracy Comparison Graphs Additionally, extending the evaluation to real-world

datasets and production environments is crucial for
validating the practical utility of machine learning-based
web application security systems. Collaborating with
industry partners to deploy and assess these systems in
live settings would provide valuable insights into their
effectiveness, scalability, and deployment challenges.
Moreover, investigating interpretability and explainability
techniques for machine learning models in web
application security is essential for building trust and
understanding their decision-making processes.
Fig. 9. Result Analysis Comparison Graphs Techniques such as model-agnostic explanations and
feature importance analysis can help stakeholders
comprehend how these models arrive at their predictions
[Link] and identify potential biases or vulnerabilities. Lastly,
addressing the ethical and privacy implications of
In conclusion, this study delved into the realm of web deploying machine learning-based security systems is
application security by examining the efficacy of machine imperative. Ensuring transparency, fairness, and
learning algorithms. Through experimentation with accountability in algorithmic decision-making processes
Multinomial Naive Bayes (MNB) and Random Forest is essential to safeguarding user privacy and maintaining
(RF) classifiers on a synthetic dataset mirroring HTTP trust in web application security systems.
request data, we gleaned valuable insights into their
performance. Our findings showcased that while both
MNB and RF classifiers displayed promise in accurately
REFERENCES
classifying HTTP requests, RF exhibited a slightly higher [1] Aljawarneh, S., Aldwairi, M., &Yassein, M. B. (2017). Machine
accuracy rate compared to MNB. However, it's worth Learning Techniques for Intrusion Detection Systems: A
noting that each algorithm presents its unique set of Survey. Journal of Network and Computer Applications, 81, 1-
20.
advantages and challenges. MNB, for instance, offers [2] V. M et al, "Deep Reinforcement Learning for Energy Efficient
simplicity and computational efficiency, whereas RF Routing and Throughput Maximization in Various Networks,"
provides superior accuracy and adeptness in capturing (I-SMAC), Dharan, Nepal, 2022, pp. 204-210, doi: 10.1109/I-

Authorized licensed use limited to: SRM Institute of Science and Technology. Downloaded on August 02,2024 at 09:59:32 UTC from IEEE Xplore. Restrictions apply.
 SMAC55078.2022.9987395. [8] Patel, D., & Bhavsar, M. (2019). A Survey of Machine Learning
[3] Abreu, S., Gouveia, P., & Araujo, H. (2012). An Overview of Techniques for Intrusion Detection Systems. Procedia Computer
Machine Learning Techniques for Intrusion Detection Systems. Science, 165, 205-212.
Information Systems Frontiers, 16(2), 209-227. [9] Huang, K., Xu, Y., Hu, B., & Guan, C. (2019). Research on
[4] A. G, et al, "Design of Miniaturized Single Bit MEMS Phase Intelligent Intrusion Detection System Based on Machine
Shifter using MEMS Switches," (ICOEI), Tirunelveli, India, Learning. IEEE Access, 7, 64718-64728.
2021, pp. 235-239, doi: 10.1109/ICOEI51242.2021.9453063. [10] Sgantzos, K., Fotiadis, L., & Polyzos, G. C. (2021). Machine
[5] K Vijayakumar And Sameer Alani, Secured Financial Learning for Botnet Detection: A Review. IEEE
Management System For Modern Digital Transactions Using Communications Surveys & Tutorials, 23(3), 2174-2204.
Block chain, 2023, ICTACT Journal on Soft Computing, Vol. [11] Debar, H., Dacier, M., &Wespi, A. (1999). Towards a
14, issue 1, DOI: 10.21917/ijsc.2023.0440. taxonomy of intrusion-detection systems. Computer Networks,
[6] Li, W., Peng, Y., Huang, Z., & Xiang, Y. (2020). Machine 31(8), 805-822.
Learning for DDoS Attack Detection in Fog Computing. IEEE [12] Shon, T., Moon, S., & Moon, S. (2016). A study on detecting
Transactions on Industrial Informatics, 16(10), 6750-6760. phishing websites using machine learning techniques. The
[7] Tan, K., Ooi, Y., Ong, K., & Chang, S. (2018). An Evaluation Journal of Supercomputing, 72(5), 1833-1846.
of Machine Learning Techniques for Intrusion Detection.
Journal of Network and Computer Applications, 96, 19-31.

Authorized licensed use limited to: SRM Institute of Science and Technology. Downloaded on August 02,2024 at 09:59:32 UTC from IEEE Xplore. Restrictions apply.