TokDoc: a self-healing web application firewall

  • Authors:

  • Tammo Krueger;Christian Gehl;Konrad Rieck;Pavel Laskov

  • Affiliations:

  • Fraunhofer Institute FIRST, Berlin, Germany;Fraunhofer Institute FIRST, Berlin, Germany;Berlin Institute of Technology, Berlin, Germany;Fraunhofer Institute FIRST, Berlin, Germany and University of Tübingen, Tübingen, Germany

  • Venue:
  • Proceedings of the 2010 ACM Symposium on Applied Computing
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

The growing amount of web-based attacks poses a severe threat to the security of web applications. Signature-based detection techniques increasingly fail to cope with the variety and complexity of novel attack instances. As a remedy, we introduce a protocol-aware reverse HTTP proxy TokDoc (the token doctor), which intercepts requests and decides on a per-token basis whether a token requires automatic "healing". In particular, we propose an intelligent mangling technique, which, based on the decision of previously trained anomaly detectors, replaces suspicious parts in requests by benign data the system has seen in the past. Evaluation of our system in terms of accuracy is performed on two real-world data sets and a large variety of recent attacks. In comparison to state-of-the-art anomaly detectors, TokDoc is not only capable of detecting most attacks, but also significantly outperforms the other methods in terms of false positives. Runtime measurements show that our implementation can be deployed as an inline intrusion prevention system.