Abstract: A Web Application Firewall (WAF) is an effective tool for protecting Web applications from cyberattacks. The rapid development of Web applications in recent years has made the research on WAF increasingly important. Common approaches for building a WAF include rule-based and machine learning-based methods. Rule-based WAF detects attacks using a predefined set of rules that are often complex and challenging to update dynamically or manually. Machine learning-based WAF, which primarily utilizes methods such as Support Vector Machine (SVM), classifies payloads but struggles to identify sudden malicious payloads as effectively as rule-based methods and lacks the breadth of coverage provided by rule-based approaches. To address these limitations, this study proposes a WAF enhancement method based on pre-trained language models, which strengthens rule-based WAFs. The method first fine-tunes a pre-trained language model using collected malicious and benign payloads to endow it with preliminary discriminative capabilities. Subsequently, the model undergoes iterative fine-tuning using malicious payloads intercepted by the WAF to learn the textual features of these payloads. During deployment, the pre-trained language model is positioned in front of the WAF to perform initial payloads screening. Additionally, returning deceptive responses to some requests intercepted by the pre-trained language model further enhances the effectiveness of the proposed method. Adversarial experiments are conducted on two open-source WAFs targeting Structured Query Language (SQL) injection and Cross-Site Scripting (XSS) attacks using two attack methods. The results demonstrate that the average interception rates for payloads generated by the two attack methods increased from 40.01% and 36.07% to 96.91% and 97.13%, respectively, after enhancement with the pre-trained language model while maintaining a false positive rate of 0. These findings validate the effectiveness of the proposed method.

Key words: Web Application Firewall (WAF), pre-trained language model, Structured Query Language (SQL) injection, Cross-Site Scripting (XSS), cyber security

摘要： Web应用防火墙（WAF）是保护网络应用免受网络攻击的一种有效手段，近年来网络应用的快速发展使得WAF的相关研究更加具有现实意义。常见的WAF构建方法主要有基于规则的方法和基于机器学习的方法。基于规则的WAF通过预定义的一组规则来检测攻击，这些规则通常过于复杂，难以动态或手动更新。基于机器学习的WAF主要通过支持向量机（SVM）等方法来对负载进行判别，但是很难做到像基于规则的方法那样对突发的恶意负载进行识别，并且很难达到基于规则方法的广度。对此，本文提出一种基于预训练语言模型的WAF加固方法，对基于规则的WAF使用预训练语言模型进行加固。该方法首先通过对预训练语言模型收集的恶意、良性的负载进行微调使其具有初步的判别能力，之后迭代使用被WAF拦截的恶意负载多次进行微调，学习被WAF拦截负载的文本特征。将预训练语言模型部署在WAF之前对来访负载进行初步判别。此外，对部分被预训练语言模型拦截的请求返回虚假回应，使得本文所提方法的效果得到进一步加强。在2款开源WAF上针对结构化查询语言(SQL)注入、跨站脚本(XSS)攻击2种Web攻击类型与2种攻击方法进行对抗实验，结果显示，经过预训练语言模型加固的WAF对2种攻击方法生成负载的平均拦截率分别从40.01%、36.07%提升到了 96.91%、97.13%，并且误报率维持为0，验证了所提方法的有效性。

关键词: Web应用防火墙, 预训练语言模型, 结构化查询语言注入, 跨站脚本, 网络安全

CLC Number: 

• TP391