ModSecurity is widely recognized as the standard open-source Web Application
Firewall (WAF), maintained by the OWASP Foundation. It detects malicious
requests by matching them against the Core Rule Set (CRS), identifying
well-known attack patterns. Each rule is manually assigned a weight based on
the severity of the corresponding attack, and a request is blocked if the sum
of the weights of matched rules exceeds a given threshold. However, we argue
that this strategy is largely ineffective against web attacks, as detection is
only based on heuristics and not customized on the application to protect. In
this work, we overcome this issue by proposing a machine-learning model that
uses the CRS rules as input features. Through training, ModSec-Learn is able to
tune the contribution of each CRS rule to predictions, thus adapting the
severity level to the web applications to protect. Our experiments show that
ModSec-Learn achieves a significantly better trade-off between detection and
false positive rates. Finally, we analyze how sparse regularization can reduce
the number of rules that are relevant at inference time, by discarding more
than 30% of the CRS rules. We release our open-source code and the dataset at
this https URL and
this https URL, respectively.

通过提出一个使用核心规则集作为输入特征的机器学习模型，本文克服了 ModSecurity 对网络攻击的无效性，并证明 ModSec-Learn 在检测和误报率之间取得了明显更好的平衡，同时分析了稀疏正则化如何在推断时减少相关规则的数量。

ModSec-Learn： 提升 ModSecurity 的机器学习技术

ModSec-Learn: Boosting ModSecurity with Machine Learning

ModSecurity is widely recognized as the standard open-source Web Application
Firewall (WAF), maintained by the OWASP Foundation. It detects malicious
requests by matching them against the Core Rule Set, identifying well-known
attack patterns. Each rule in the CRS is manually assigned a weight, based on
the severity of the corresponding attack, and a request is detected as
malicious if the sum of the weights of the firing rules exceeds a given
threshold. In this work, we show that this simple strategy is largely
ineffective for detecting SQL injection (SQLi) attacks, as it tends to block
many legitimate requests, while also being vulnerable to adversarial SQLi
attacks, i.e., attacks intentionally manipulated to evade detection. To
overcome these issues, we design a robust machine learning model, named
AdvModSec, which uses the CRS rules as input features, and it is trained to
detect adversarial SQLi attacks. Our experiments show that AdvModSec, being
trained on the traffic directed towards the protected web services, achieves a
better trade-off between detection and false positive rates, improving the
detection rate of the vanilla version of ModSecurity with CRS by 21%. Moreover,
our approach is able to improve its adversarial robustness against adversarial
SQLi attacks by 42%, thereby taking a step forward towards building more robust
and trustworthy WAFs.

本文介绍了 ModSecurity 作为标准开源 Web 应用防火墙（WAF）的机制，指出其在检测 SQL 注入（SQLi）攻击方面的不足，并设计了一个名为 AdvModSec 的机器学习模型，用于检测 SQLi 攻击，通过实验证明 AdvModSec 相对于原始版的 ModSecurity 在检测率上提高了 21％，在对抗 SQLi 攻击的鲁棒性上提高了 42％，从而在构建更强大可信赖的 WAF 方面迈出了一步。