论文标题
WAF-A-MOL：通过对抗机学习逃避Web应用程序防火墙
WAF-A-MoLE: Evading Web Application Firewalls through Adversarial Machine Learning
论文作者
论文摘要
Web应用程序防火墙被广泛用于生产环境中，以减轻SQL注射等安全威胁。许多工业产品依靠基于签名的技术，但是机器学习方法越来越受欢迎。对手的主要目标是制作具有语义上恶意的有效载荷，以绕过WAF执行的句法分析。在本文中，我们提出了WAF-A-MOL，该工具是建模对手的存在的工具。该工具利用一组突变操作员，这些突变操作员会改变有效载荷的语法而不会影响原始语义。我们使用公开可用的SQL查询数据集对现有WAF进行了评估该工具的性能。我们表明WAF-A-MOL绕过所有基于机器学习的WAF。
Web Application Firewalls are widely used in production environments to mitigate security threats like SQL injections. Many industrial products rely on signature-based techniques, but machine learning approaches are becoming more and more popular. The main goal of an adversary is to craft semantically malicious payloads to bypass the syntactic analysis performed by a WAF. In this paper, we present WAF-A-MoLE, a tool that models the presence of an adversary. This tool leverages on a set of mutation operators that alter the syntax of a payload without affecting the original semantics. We evaluate the performance of the tool against existing WAFs, that we trained using our publicly available SQL query dataset. We show that WAF-A-MoLE bypasses all the considered machine learning based WAFs.
