PaperlayerView exact revision on arXiv

Source-linked AI summary

WAPP: Safe Learning of Positive Security WAF Policies from Live Traffic

Heba Osama, Zeyad Ahmed, Mohamed Amgad, Ahmed Saafan, Jana Elfeky, Mariam Abdelati, Haitham Ghalwash

arXiv:2609.06840v1cs.CRcs.AIcs.NI

TL;DR

WAPP addresses the risk that live-traffic learning can admit malicious observations into positive-security policies. It combines trust filtering, deterministic synthesis, confidence scoring, and validation before enforcement, improving poisoning resilience on the tested dataset while exposing precision limits for free text.

  • Problem

    Existing WAF learning approaches provide limited evidence for safely learning enforceable positive-security policies from live traffic when attackers can influence training observations.

  • Method

    WAPP uses seven trust signals, deterministic rule synthesis, confidence scoring, and live validation to transform traffic into enforceable positive-security WAF policies.

  • Results

    WAPP reaches 90.00% measured poisoning resilience effectiveness with all seven signals, compared with 62.31% for the Kruegel–Vigna baseline, while deterministic synthesis matches the tested LLM’s attack blocking without inference cost.

  • Takeaways & Limitations

    Learned positive-security rules block confirmed CRS bypasses on constrained fields, but confidence scoring still requires representative validation and free-text policies remain a precision challenge.

  • Takeaways & Limitations

    The results are limited to the tested applications, traffic, WAF configuration, attacker profiles, and one LLM setup.

Abstract

from arXiv · show

Web Application Firewalls (WAFs) mainly rely on signatures to detect known attacks, which can leave gaps against modified or previously unseen payloads. Positive security provides a complementary approach by learning legitimate traffic and blocking inputs that fall outside the learned profile. However, learning directly from live traffic can be unsafe when malicious requests contaminate the training data. This paper presents the Whitelisting Autonomous Policy Producer (WAPP), a framework that combines trust filtering, deterministic rule synthesis, confidence scoring, and validation before enforcement. WAPP is evaluated on three controlled applications using a live Coraza and OWASP Core Rule Set (CRS) stack. Results show that, on the tested DVWA username field, unfiltered learning becomes Degraded at 0.2\% poisoned traffic and Broken at 0.5%, while the evaluated free text field can admit malicious inputs even without poisoning. On the frozen poisoning dataset, the ablation configuration with all seven candidate signals improves the measured poisoning resilience from 53% to 90%, compared with 62% for the Kruegel--Vigna baseline. The deterministic synthesizer provides attack blocking comparable to the tested language model without model inference cost. WAPP blocks confirmed CRS bypasses on constrained fields, while free text inputs remain a precision challenge that requires character level operator control.

1 Introduction

WAPP addresses the risks of learning positive-security policies from live traffic, where malicious observations can poison training. It combines trust filtering, rule synthesis, confidence scoring, and validation before enforcement.

  • Traditional signature-based WAFs may miss modified, encoded, or previously unseen attack variants.
  • Positive security profiles legitimate request behavior and rejects values outside the learned field shape.
  • Learning from live traffic is unsafe when attackers can influence observations used to construct enforceable policies.
  • WAPP transforms live traffic into policies through traffic profiling, trust filtering, deterministic synthesis, confidence scoring, and pre-enforcement validation.
  • 0.2% poisoned traffic makes the tested DVWA username learner Degraded, while 0.5% makes it Broken; the evaluated free-text field admits attacks without poisoning.
  • 90% measured poisoning resilience is achieved by all seven trust signals, versus 62% for the Kruegel–Vigna baseline and 53% without the full configuration.
  • Deterministic synthesis matches the tested language model’s attack blocking without inference cost, while confidence scores require representative validation before enforcement.
  • Learned rules block confirmed CRS bypasses on constrained fields, but rich free-text inputs remain limited by false positives and require character-level operator control.

2 Related Work

Related work spans signature-based WAFs, application learning, machine learning, poisoning defenses, language-model policy generation, and evasion. WAPP differs by learning inspectable positive constraints from trusted traffic and validating them in a live WAF.

  • Signature-based WAFs detect known malicious patterns, whereas positive security defines acceptable input and rejects values outside expected profiles.
  • Adaptive WAFs reduce maintenance by changing protection levels, while WAPP learns endpoint-specific constraints and validates them before enforcement.
  • Kruegel–Vigna parameter profiling provides WAPP’s external baseline for learning field-level properties such as length, character distribution, and token structure.
  • Prior application-learning systems use response success, observation counts, source diversity, or temporal spread to decide when behavior is trustworthy.
  • Poisoning defenses are difficult to apply at startup because early policy learning may lack a trusted clean seed or reliable poisoned-fraction assumption.
  • WAPP evaluates self-sanitizing trust signals from WAF traffic and compares deterministic synthesis with an LLM under identical trusted inputs.
  • The evaluation treats signature bypasses as test cases for whether learned positive constraints block attacks admitted by the configured CRS.

3 Methodology

WAPP separates traffic learning from policy enforcement through a staged pipeline. The study combines controlled poisoning and ablation experiments with live replay of generated rules against legitimate and adversarial traffic.

  • WAPP uses seven stages across traffic learning and trust, policy generation, validation and decision, and enforcement and feedback.
  • Trusted traffic generates candidate rules, which are scored, validated, and replayed through the WAF before enforcement.
  • The experimental design combines controlled traffic generation, poisoning simulation, component ablation, statistical comparison, and live WAF replay.
  • Controlled analysis compares components under identical conditions, while live validation replays rules and holdouts through the Coraza reverse proxy.
  • Results are limited to the evaluated controlled and purpose-built applications, traffic populations, and WAF configurations rather than production traffic.

3.3 Metrics and Decision Criteria

The evaluation measures adversarial admission, rule contamination, legitimate-traffic blocking, and combined poisoning failure. Enforcement requires acceptable poisoning resilience, FPR, and representative validation across the tested applications and datasets.

  • The four metrics are PER, WCR, FPR, and PFS, covering adversarial admission, rule contamination, legitimate blocking, and poisoning failure.
  • PER measures the fraction of adversarial requests admitted by the learned policy, with lower values indicating better security.
  • WCR measures the fraction of synthesized rules accepting at least one adversarial request, with lower values preferred.
  • FPR measures legitimate requests blocked by the policy and is evaluated separately as an operational safety measure.
  • PFS is the harmonic mean of PER and WCR, with higher values indicating greater poisoning failure; effectiveness is 1 − PFS.
  • Policies qualify for enforcement only when poisoning resilience, FPR, and representative pre-enforcement validation all satisfy their criteria.
  • Three applications support the evaluation: Juice Shop, DVWA, and Airport, with research-question-specific datasets and holdouts.

3.5 Threat Model and Attacker Simulator

The threat model spans six operational dimensions, while a deterministic simulator generates reproducible poisoned traffic for selected research questions and separates attack datasets across evaluations.

  • Threat dimensions: The attacker model covers goals, source volume, timing, payload skill, knowledge, and adaptation.
  • Threat dimensions: Attackers may pursue poisoning, service disruption, data theft, or system probing.
  • Threat dimensions: The simulator supports single-source, coordinated, burst, steady, slow, randomized, mimicry, boundary, and browser-realistic attack scenarios.
  • Threat dimensions: Attacker knowledge ranges from none to full across FAIL dimensions, and behavior may be static, reactive, or continuously adaptive.
  • Simulator: Deterministic generation enables replay with the same seed and configuration, while separate paths prevent assuming one dataset serves every research question.
  • Simulator: For RQ1, poisoned records are successful unflagged observations, excluding requests already blocked by the WAF.

3.6 Trust Filtering

WAPP filters live training traffic using seven configurable trust signals without requiring a clean seed or historical tenant baseline, then evaluates signal combinations on frozen data.

  • Signal design: WAPP evaluates seven trust signals before rule synthesis using only the current training window.The signals include WAF attack flags, successful status, source diversity, observation count, temporal spread, per-IP volume, and value frequency.
  • Ablation: 128 signal combinations are tested on the same frozen dataset, including the empty filter, individual signals, pairs, and all seven signals.
  • Evaluation: Ground-truth labels are reserved for evaluation rather than supplied to the trust filter or rule synthesizer.

3.7 Trust Filter Action Levels

Trust signals act at record, endpoint, and character levels, so poisoning resilience can improve even when individual malicious records remain; synthesis then converts filtered profiles into endpoint policies.

  • Action levels: The seven signals operate through record filtering, endpoint gating, and character-level hardening rather than a single filter-level metric.
  • Record level: Record-level filtering removes observations using attack flags, HTTP status, temporal spread, or an optional per-IP volume cap.
  • Endpoint level: Endpoint-level gating can prevent synthesis when distinct-IP or observation-count evidence is insufficient.
  • Character level: Character-level hardening uses the value frequency floor to restrict characters admitted by generated rules without removing records.
  • Cross-level effects: A signal can have record-level FNR 1.00 yet reduce contamination because endpoint gates block unsafe rules and character controls constrain generated policies.
  • Rule synthesis: Synthesis groups traffic by endpoint and method, normalizes dynamic paths, parses multiple body formats, and derives per-field constraints.
  • Rule synthesis: The deterministic engine uses typed patterns when recognized and otherwise applies the default 0.90 value frequency floor.
  • Synthesis comparison: With identical trusted profiles, deterministic synthesis matches the tested language model's attack blocking without inference cost and closes parameter sets in six of seven rules.

3.9 Validation, Scoring, and Enforcement

WAPP scores candidate rules using evidence and validates them in shadow mode against disjoint legitimate holdouts and fixed attacks before enforcement, while the evaluation tests CRS bypasses on constrained fields.

  • Scoring and enforcement: Candidate rules receive evidence scores from source diversity, observation volume, active hours, field thinness, and minimum-evidence requirements.
  • Scoring and enforcement: Each candidate is compiled in shadow mode and replayed against disjoint legitimate holdout data and a fixed attack suite, with errors reducing its score.
  • Validation: Calibration uses 108 synthetic legitimate values and 13 genuine attack vectors per endpoint, plus a wider 17-item suite with boundary and mimicry probes.
  • Validation: The DVWA login rule also uses separator-containing representative holdout data before enforcement conclusions because the synthetic holdout has limited character coverage.
  • Signature bypass evaluation: The signature-bypass experiment confirms CRS blocking at threshold 5 before replaying eleven candidates from SQL injection, XSS, and path traversal classes.
  • Signature bypass evaluation: The learned positive-security policy is isolated by replaying confirmed bypasses at threshold 100, where the signature layer does not block them.
  • Signature bypass evaluation: Five confirmed bypasses are replayed against two constrained fields at thresholds 100 and 5, with two shape-benign values serving as negative controls.

4 Results

The results show that poisoning resistance, false-positive control, synthesis choice, confidence scoring, and validation jointly determine whether learned positive-security policies are usable. WAPP improves resilience and blocks attacks on constrained fields, but punctuation-rich free text remains a precision challenge.

  • Open-population learning: 0.2% poisoning makes the tested DVWA username learner Degraded, while 0.5% makes it Broken; the Airport free-text field is already Broken without poisoning.The Airport field has PER 0.30 and PFS 0.462 because legitimate and malicious inputs share punctuation.
  • Operational usability: Recovered poisoning resilience can still violate the operational false-positive guardrail, with FPR reaching 1.00 for Airport free text and 0.80 for the DVWA holdout.Both cells remain Resilient by PFS while exceeding the 0.05 FPR threshold.
  • Trust filtering: 90.00% effectiveness with all seven signals improves on 52.88% without filtering and exceeds the Kruegel–Vigna baseline’s 62.31%.On the frozen dataset, WCR falls to 0.1111 and PER to 0.0909 with all seven signals.
  • Trust filtering: The value frequency floor has the largest Shapley contribution at 0.1494, while the per-IP cap contributes 0 across tested attacker profiles.Removing the floor reduces effectiveness from 0.9000 to 0.7740; enabling it, rather than its exact cutoff, drives the measured benefit.
  • Synthesis engine: Statistical synthesis blocks all ten Airport comment attacks but has higher FPR than the language model, which admits two attacks; it is nevertheless selected for grounded rules and zero inference cost.The paired attack-blocking difference shows no clear advantage, while the statistical engine provides closed-set enforcement and zero model inference cost.
  • Confidence and validation: A score of 0.5873 is used only as an advisory calibration cutoff because it was identified on the same data; representative validation remains necessary.Lowering the floor to 0.10 eliminates FPR while blocking all 13 genuine attacks, but admits two boundary probes and triggers score reduction to 0.5709.

5 Discussion

WAPP separates policy learning from enforcement by combining trust filtering, confidence scoring, validation, and deterministic synthesis. The discussion favors statistical synthesis by default while treating free text and low-confidence rules cautiously.

  • Trusted training evidence and constrainable field shapes are the two conditions identified for effective learned positive security.
  • Rules below the advisory cutoff should remain under monitoring or review because confidence measures evidence support rather than guaranteeing safety.
  • Constrained fields with sufficient evidence and successful representative validation are better enforcement candidates, whereas free text requires broader holdouts and character controls.
  • The statistical synthesizer is selected because it is deterministic, has no model inference cost, and showed no observed attack-blocking disadvantage against the tested LLM.

6 Conclusion and Future Work

WAPP improves poisoning resilience through trust filtering and supports validated positive-security enforcement on constrained fields. Its conclusions remain bounded by the tested applications, configurations, attacker profiles, traffic, and single LLM setup.

  • 52.88% to 90.00%: all seven candidate signals increased measured poisoning resilience effectiveness, compared with 62.31% for the Kruegel–Vigna baseline.
  • 45.45% (5 of 11) of tested CRS bypass candidates were confirmed, and learned constraints blocked all 10 resulting bypass requests across two constrained fields.
  • The results are limited to the tested applications, traffic, WAF configuration, attacker profiles, and one LLM setup.
Loading 2609.06840v1…