Research On AC-BMP Algorithm And Its Application In WAF

Most of the traditional network firewalls work in the OSI model of the network layer and transport layer,it can not understand the HTTP application layer protocol which is closely related to the Web application,and it can not prevent the Web attacks that are disguised as normal data,resulting in a variety of protection side leakage.Therefore,it is necessary to study how to accurately identify and effectively defend the attack of Web application layer,so as to ensure the security of Web application.Through the research and analysis,such as SQL injection,XSS,CSRF and other common Web-based vulnerabilities,to extract the characteristics of all kinds of attacks and the corresponding preventive measures,thus a Web Application Firewall(WAF)is designed and implemented.The WAF prepares and evaluates the important fields in the obtained HTTP packets by extracting and analyzing the incoming HTTP datagrams.It preprocesses the related fields of the HTTP packets before the detection,and prevents encoding such as Base64 and Unicode bypass means;The AC-BMP algorithm is obtained by improving the AC-BM algorithm,and it is applied to the WAF detection engine in order to improve the WAF's matching efficiency of the feature strings and the throughput of WAF,in view of the current web page tampering problem,we designed a transparent anti-tampering mechanism for Web server to ensure that users can still get the normal web content after tampering.In order to verify the attack detection and defense ability of the WAF based on AC-BMP,deploy the WAF on the WebGoat which is designed for Web vulnerability experiment,and use AppScan to scan WebGoat before and after the WAF deployment.The scanning results show that the WAF can detect and defend the common Web attacks and their respective variants,In addition,by comparing AC-BM algorithm and AC-BMP algorithm separately,it can be seen that AC-BMP algorithm has higher matching efficiency than AC-BM algorithm.By using more efficient AC-BMP algorithm,WAF's detection efficiency and throughput will be greatly improved.