Abstract:As the first defensive layer that attacks would hit, the web application firewall (WAF) plays an indispensable role in defending against malicious web attacks like SQL injection (SQLi). With the development of cloud computing, WAF-as-a-service, as one kind of Security-as-a-service, has been proposed to facilitate the deployment, configuration, and update of WAFs in the cloud. Despite its tremendous popularity, the security vulnerabilities of WAF-as-a-service are still largely unknown, which is highly concerning given its massive usage. In this paper, we propose a general and extendable attack framework, namely AdvSQLi, in which a minimal series of transformations are performed on the hierarchical tree representation of the original SQLi payload, such that the generated SQLi payloads can not only bypass WAF-as-a-service under black-box settings but also keep the same functionality and maliciousness as the original payload. With AdvSQLi, we make it feasible to inspect and understand the security vulnerabilities of WAFs automatically, helping vendors make products more secure. To evaluate the attack effectiveness and efficiency of AdvSQLi, we first employ two public datasets to generate adversarial SQLi payloads, leading to a maximum attack success rate of 100% against state-of-the-art ML-based SQLi detectors. Furthermore, to demonstrate the immediate security threats caused by AdvSQLi, we evaluate the attack effectiveness against 7 WAF-as-a-service solutions from mainstream vendors and find all of them are vulnerable to AdvSQLi. For instance, AdvSQLi achieves an attack success rate of over 79% against the F5 WAF. Through in-depth analysis of the evaluation results, we further condense out several general yet severe flaws of these vendors that cannot be easily patched.

Adaptively Detecting Malicious Queries in Web Attacks

An Improved Support Vector Machine Attack Detection Algorithm for Industry Controls System

An efficient SVM-Based method to detect malicious attacks for web servers

Design and Implementation of Adaptive Intrusion Detection System Based on Web Access Behavior Relevancy

Group Testing Based Detection of Web Service DDoS Attackers.

Detecting Malicious Domains Using Modified SVM Model

Detecting Malicious Queries from Search Engine Traffic

A Dynamic and Static Combined Android Malicious Code Detection Model Based on SVM.

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Study of Intrusion Detecton Mondels for Web Applications

An Evasion and Counter-Evasion Study in Malicious Websites Detection

Crafting and Detecting Adversarial Web Requests.

HTTPSmell: A Deep Learning Approach on Malicious HTTP Traffic Detection via Data Augmentation and Label Refactoring

Identify Selective Forwarding Attacks Using Danger Model: Promote the Detection Accuracy in Wireless Sensor Networks

Data mining methods for anomaly detection of HTTP request exploitations

TSMWD: A High-Speed Malicious Web Page Detection System Based on Two-Step Classifiers

AdvSQLi: Generating Adversarial SQL Injections against Real-world WAF-as-a-service

ModSec-AdvLearn: Countering Adversarial SQL Injections with Robust Machine Learning

Detecting Malicious Websites in Depth through Analyzing Topics and Web-pages

RESEARCH ON APPLYING DATA MINING IN DYNAMIC MALICIOUS WEB PAGE DETECTION