Real time application protection system configuration deficiency prediction

Techniques are described for improving real-time application protection (RTAP) systems (e.g., web application firewalls (WAFs), runtime application self-protection (RASP) systems). In particular, a device within a trusted network may configured to predict vulnerabilities of proposed configurations for the RTAP systems. For example, the device may train one or more machine learning models with a first plurality of configuration settings of application protection systems corresponding to a plurality of applications and a first plurality of known vulnerabilities corresponding the first plurality of configuration settings; apply the one or more machine learning models to a proposed configuration setting to predict one or more potential vulnerabilities of the proposed configuration setting; and identify one or more configuration changes to the proposed configuration setting to overcome the predicted one or more potential vulnerabilities.

TECHNICAL FIELD

This disclosure relates to computer systems and, in particular, application security for computer systems.

BACKGROUND

Web applications are client-server computer programs in which client-side operations and user interface(s) run on a web browser. The server-side operations of web applications may be implemented by a computer network including a number of servers and computing devices. For example, a web application running on a server, accessed via a web browser, may communicate, via the Internet, with a database server of a computer network to access files or other information. In some instances, one or more real-time application protection systems may be deployed to monitor network data and identify data that may be malicious based on one or more configurations. For example, a web application firewall (WAF) system may filter, monitor, and block malicious data to and from a web application based on one or more configurations of the WAF. Similarly, a runtime application self-protection (RASP) system detects and reports or blocks malicious data based on one or more configurations of the RASP and runtime information of the web application. WAF or RASP systems may be commercial off-the-shelf systems that can be interacted with via one or more application programming interfaces (APIs). Configurations for one or more real-time application protection systems may be changed over time from the baseline configurations, which may leave the web applications vulnerable to potential network attacks.

SUMMARY

In general, this disclosure describes computer systems for improving real-time application protection (RTAP) systems (e.g., web application firewalls (WAFs), runtime application self-protection (RASP) systems, and the like). RTAP systems may be commercial off-the-shelf systems that can be interacted with via one or more application programming interfaces (APIs).

In one example, a device within a trusted network may train one or more machine learning (ML) models to detect vulnerabilities within a configuration based on a plurality of configurations (e.g., the configurations for the RTAP systems and/or baseline configurations), a plurality of known vulnerabilities (e.g., from the defect data store), and/or a plurality of log files of the RTAP systems. The device may then apply the one or more ML models to a proposed configuration for an RTAP system to predict one or more potential vulnerabilities. In some examples, the device may identify one or more changes to the proposed configuration to overcome the predicated one or more potential vulnerabilities. In this way, the device may strengthen proposed configuration stings for an RTAP system before it is deployed.

In another example, this disclosure is directed to a computer-implemented method including training one or more machine learning models with a first plurality of configuration settings of application protection systems corresponding to a plurality of applications and a first plurality of known vulnerabilities corresponding the first plurality of configuration settings; applying the one or more machine learning models to a proposed configuration setting to predict one or more potential vulnerabilities of the proposed configuration setting; and identifying one or more configuration changes to the proposed configuration setting to overcome the predicted one or more potential vulnerabilities.

In another example, this disclosure is directed to a computer-readable medium storing instructions that, when executed by a computing system, cause one or more processors of the computing system to: train one or more machine learning models with a first plurality of configuration settings of application protection systems corresponding to a plurality of applications and a first plurality of known vulnerabilities corresponding the first plurality of configuration settings; apply the one or more machine learning models to a proposed configuration setting to predict one or more potential vulnerabilities of the proposed configuration setting; and identify one or more configuration changes to the proposed configuration setting to overcome the predicted one or more potential vulnerabilities.

DETAILED DESCRIPTION

FIG.1is a block diagram illustrating an example computing system100configured to predict vulnerabilities of proposed configurations for real-time application protection (RTAP) systems110A-110C (collectively, “RTAP systems110”) according to the techniques of this disclosure. RTAP systems110may include web application firewalls (WAFs), runtime application self-protection (RASP) systems, and the like). RTAP systems110may be commercial off-the-shelf systems that can by interacted with via one or more application programming interfaces (APIs). For example, RTAP systems110may be configured or deployed through one or more APIs. Additionally, information from RTAP system110may be obtained through one or more APIs. In some examples, RTAP systems110may include deployed agents that may interacted with through a centralized server using an API.

In particular, system100includes a trusted network101that hosts web applications104A-104C (collectively, “applications104”). Trusted network101may be a computer network (e.g., a wide area network (WAN), such as the Internet, a local area network (LAN), or a virtual private network (VPN)), a telephone network (e.g., the PSTN or a wireless network), or another wired or wireless communication network. Although illustrated as a single entity, trusted network101may comprise a combination of multiple networks. Trusted network101also includes RTAP systems110that monitor network data into and out of applications104to identify data that may be malicious based on one or more configurations of the RTAP systems110. In some examples, RTAP system110A may correspond (e.g., monitor) application104A, RTAP system110B may correspond application104B, and RTAP system110C may correspond application104C. For example, a computing device116operated by a user106may interact with application104A (e.g., submit and obtain data from the application) while RTAP system110A monitors the data traffic between the computing device116and application104A. While three RTAP systems110and three applications104are shown inFIG.1, system100may contain fewer or more RTAP systems110or applications104. In another example, a computing device118operated by a malicious user108may attempt to submit malicious data or obtain data for which they are not authorized from application104C (e.g., a denial of service attack, malicious HTTP POST/GET request, port scanning, a brute force attack) and RTAP system110C may identify this malicious network traffic and block, report, and/or log it.

In some examples, computing device116and/or computing device118may be any suitable communication or computing device, such as a conventional or a mobile, non-mobile, wearable, and/or non-wearable computing device capable of communicating over network18. For example, each of computing device116,118may include any one or a combination of a conventional mobile phone, a smart phone, a smart watch, a tablet computer, a personal digital or virtual assistant, a gaming system, a media player, a smart television, an Internet of Things (IoT) device, an automobile or other vehicle, a laptop or notebook computer, a desktop computer, or any other type of wearable, non-wearable, mobile, and non-mobile computing device that may perform operations in accordance with one or more aspects of the present disclosure. One or more of computing device116,118may support communication services over packet-switched networks, e.g., the public Internet, including Voice over Internet Protocol (VOIP).

In some examples, system100may store defect information in defect data store113. For example, system100may store known defects, vulnerabilities, and/or attack signatures in defect data store113. In some examples defect data store113may be a database, server, or any other computing system with storage. In some examples, one or more attack signatures stored in defect data store113may be received from third party, may correspond to a previously received attack by trusted network101, or may be associated with known defects of any of RTAP systems110.

In some examples, system100may include a vulnerability prediction device102configured to predict vulnerabilities of potential configurations for RTAP systems104. In general, vulnerability prediction device102may comprise one or more computing devices, including servers, laptop or notebook computers, desktop computers, or any other type of computing devices that may perform operations in accordance with one or more aspects of the present disclosure.

In some examples, vulnerability prediction device102may store information about one or more baseline configurations for each of RTAP systems110. For example, one or more remote devices or vulnerability prediction device102may store first baseline configuration settings for RTAP system110A, second baseline configuration settings for RTAP system110B, and third baseline configuration settings for RTAP system110C. In some examples, first, second, and third baseline configuration settings may be the same or different. Baseline configuration settings may be configuration settings that have been tested and/or approved for deployment for RTAP systems110that include protections against a plurality of known potential attacks. In some examples, vulnerability prediction device102may store baseline configurations in local memory or in remote memory (e.g., on a server, database, or another device).

In some examples, vulnerability prediction device102may train one or more machine learning (ML) models using training data sets of existing configuration files or sections of configuration files that are labeled as being vulnerable to certain defects. The existing configuration files may include the baseline configurations, current configurations of RTAP systems110, and/or any other configurations of RTAP systems, including previous configurations of RTAP systems110or other RTAP systems. The vulnerabilities identified in the training data sets used by vulnerability prediction device102to train the one or more ML models may be based on a plurality of known vulnerabilities (e.g., attack signatures from defect data store113). In other examples, the vulnerabilities identified in the training data sets used by vulnerability prediction device102to train the one or more ML models may be based on a plurality of system logs from RTAP systems110. For example, the plurality of in system logs may include data corresponding to one or more previous attacks (e.g., attack payloads, attack signatures, or any other information about previous attacks). In this way, vulnerability prediction device102may generate multiple different ML models, each ML model trained to predict whether configuration data in a specific type of configuration file or a specific section of a configuration file is vulnerable to a specific type of defect.

Vulnerability prediction device102may apply those ML models to a proposed configuration setting of RTAP systems110to predict potential vulnerabilities of the proposed configuration setting. As described above, vulnerability prediction device102may generate specific ML models correlated to specific types of defects to predict vulnerability in configuration settings. Each of the ML models may take an XML configuration file of the proposed configuration as input, and output a prediction of whether the configuration file and/or a specific section of the configuration file of the proposed configuration is affected by the corresponding particular vulnerability. By applying the one or more ML models, vulnerability prediction device102may identify one or more potential vulnerabilities of the proposed configuration setting of RTAP systems110and may identify specific sections or locations within the proposed configuration setting affected by the one or more potential vulnerabilities.

In some examples, vulnerability prediction device102may segment the proposed configuration of RTAP systems110into a plurality of sections based on the types of vulnerabilities that may occur in each of the sections. Vulnerability prediction device102may apply an ML model correlated to each section of the plurality of sections. Examples of sections of the configuration file may include signature section, policy version section, web scraping section, blocking section, whitelist section, etc. For example, the correlated ML model may take XML configuration files of a section of the proposed configuration of RTAP systems110as input and output a prediction of whether the section of the proposed configuration is affected by the corresponding vulnerabilities of the section. By applying the correlated ML model to each section of the plurality of sections, vulnerability prediction device102may identify one or more vulnerabilities of each section of the plurality of sections. Vulnerability prediction device102may further combine the one or more vulnerabilities of each section of the plurality of sections to generate a list of potential vulnerabilities of the proposed configuration setting of RTAP systems110. In some other examples, the one or more ML models may be combined into a single ML model, and vulnerability prediction device102may apply the combined ML model to the proposed configuration setting of RTAP systems110to predict potential vulnerabilities of proposed configuration setting.

If vulnerability prediction device102predicts any potential vulnerabilities of the proposed configurations, vulnerability prediction device102will generate an alert identifying the predicted potential vulnerabilities. In some examples, vulnerability prediction device102may transmit that alert to a device, such as a security monitoring device or any suitable computing device. In some examples, the alert may indicate to focus testing of the proposed configuration based on the predicted potential vulnerabilities. For example, vulnerability prediction device102may provide an alert to a user that prompts the user to run one or more tests for predicted potential vulnerabilities. In some examples, vulnerability prediction device102may automatically execute an instruction to run one or more tests for the predicted potential vulnerabilities. In some examples, vulnerability prediction device102may identify one or more configuration setting changes to the proposed configuration to overcome predicted potential vulnerabilities.

In some examples, the alert may be communicated from vulnerability prediction device102to other devices in the form of application-based alerts, email messages, text messages, or any other electronic communication. For example, an alert may be communicated in an email message, such as an emailed document or an emailed link. In some examples, the alert may be transmitted in XML format. As such, the disclosed techniques may enable a user to quickly and easily identify one or more potential vulnerabilities of the RTAP systems110.

FIG.2is a block diagram illustrating an example set of components of vulnerability prediction device202, which may be configured to perform the techniques of this disclosure. In the example ofFIG.2, vulnerability prediction device202includes processors203, interfaces205, storage units207, RTAP system monitoring application210, application information220, baseline configurations222, RTAP systems information224, and machine learning (ML) models226. RTAP system monitoring application210further includes application programming interface (API)215, machine learning (ML) training unit212, configuration determination unit214, and vulnerability prediction unit216. The components, units or modules of vulnerability prediction device202are coupled (physically, communicatively, and/or operatively) using communication channels for inter-component communications. In some examples, the communication channels may include a system bus, a network connection, an inter-process communication data structure, or any other method for communicating data.

Processors203, in one example, may comprise one or more processors that are configured to implement functionality and/or process instructions for execution within vulnerability prediction device202. For example, processors203may be capable of processing instructions stored by storage units207. Processors203may include, for example, microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate array (FPGAs), or equivalent discrete or integrated logic circuitry, or a combination of any of the foregoing devices or circuitry.

Storage units207of vulnerability prediction device202may store an operating system (not shown) executable by processors203to control the operation of components of vulnerability prediction device202. Storage units207may also be configured to store information within vulnerability prediction device202during operation. Storage units207may include a computer-readable storage medium or computer-readable storage device. In some examples, storage units207include one or more of a short-term memory or a long-term memory. Storage units207may include, for example, random access memories (RAM), dynamic random access memories (DRAM), static random access memories (SRAM), magnetic discs, optical discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable memories (EEPROM). In some examples, storage units207are used to store program instructions for execution by processors203. Storage units207may be used by software or applications running on vulnerability prediction device202(e.g., RTAP system monitoring application210) to temporarily store information during program execution.

Vulnerability prediction device202further includes RTAP system monitoring application210, which may include API215. Vulnerability prediction device202may utilize interfaces205or API215to communicate with other systems or devices via one or more networks, e.g., RTAP systems110and/or defect data store113ofFIG.1. Interfaces205may be network interfaces (such as Ethernet interfaces, optical transceivers, radio frequency (RF) transceivers, Wi-Fi or Bluetooth radios, or the like), telephony interfaces, or any other type of devices that can send and receive information. In some examples, RTAP system monitoring application210utilizes interfaces205to wirelessly communicate with RTAP systems110, applications104fromFIG.1. Although illustrated inFIG.2as including a single API215, in other examples, RTAP system monitoring application210may include a plurality of APIs to pull data from one or more remote devices and/or interact with any of the other systems within trusted network101ofFIG.1.

RTAP system monitoring application210may predict vulnerabilities of proposed configurations for RTAP systems110using one or more of machine learning (ML) models226. In general, a computing system uses a machine-learning algorithm to build a model based on a set of training data such that the model “learns” how to make predictions, inferences, or decisions to perform a specific task without being explicitly programmed to perform the specific task. Once trained, the computing system applies or executes the trained model to perform the specific task based on new data. Examples of machine-learning algorithms and/or computer frameworks for machine-learning algorithms used to build the models include a linear-regression algorithm, a logistic-regression algorithm, a decision-tree algorithm, a support vector machine (SVM) algorithm, a k-Nearest-Neighbors (kNN) algorithm, a gradient-boosting algorithm, a random-forest algorithm, or an artificial neural network (ANN), such as a convolutional neural network (CNN). For example, a gradient-boosting model may comprise a series of trees where each subsequent tree minimizes a predictive error of the preceding tree.

Returning to the example ofFIG.2, RTAP system monitoring application210includes ML training unit212, configuration determination unit214, and vulnerability prediction unit216.

Each of ML models226may include a function (e.g., a machine learning algorithm) configured to be executed by processors203. The function may include nodes, layers, and connections, and the function may be represented by equations having a plurality of variables and a plurality of known coefficients. ML training212is configured to train the machine learning algorithms of ML models226using training data and a training process to create the data-specific ML models226. In accordance with the techniques of this disclosure, ML training unit212may train one or ML models226with the baseline configurations222, current configurations of RTAP systems110, and/or any other configurations of RTAP systems and any known vulnerabilities associated with those configurations (e.g., from defect data store113forFIG.1). In some examples, ML training unit212may train the one or more ML models with a plurality of system logs from RTAP systems110. For example, the plurality of system logs may include data corresponding to one or more previous attacks (e.g., attack payloads, attack signatures, or any other information about previous attacks).

Vulnerability prediction unit216may apply the trained ML models226to proposed configuration of RTAP systems110to predict potential vulnerabilities of the proposed configuration. If vulnerability prediction device202predicts any potential vulnerabilities of the proposed configurations, RTAP system monitoring application210will generate an alert identifying the predicted potential vulnerabilities. In some examples, vulnerability prediction device202may transmit, via interfaces205or API215, that alert to a device, such as a security monitoring device or any suitable computing device. In some examples, the alert may indicate to focus testing of the proposed configuration based on the predicted potential vulnerabilities. In some examples, configuration determination unit214may identify one or more configuration setting changes to the proposed configuration to overcome predicted potential vulnerabilities. For example, configuration determination unit214may look up one or more attack signatures associated with the predicted potential vulnerabilities from defect data store113to retrieve one or more rules or configuration settings that are known to protected against the predicted potential vulnerabilities.

FIG.3is a flowchart300illustrating an example method of predicting vulnerabilities of configurations for real-time application protection systems according to the techniques of this disclosure. For purposes of example and explanation, the method ofFIG.3is explained with respect to vulnerability prediction device202ofFIG.2. However, it should be understood that other computer devices may be configured to perform this or a similar method, including any of vulnerability prediction devices102or202ofFIGS.1-2.

Vulnerability prediction device202may train one or more machine learning (ML) models with a plurality of configurations, a plurality of known vulnerabilities, and/or a plurality of log files to identify particular configuration settings with known vulnerabilities (302) For example, vulnerability prediction device202may train the one or more ML models with baseline configurations for RTAP systems, current configurations of RTAP systems (e.g., RTAP systems110), and/or any other configurations of RTAP systems, including previous configurations of RTAP systems110or other RTAP systems, and any known vulnerabilities associated with those configurations (e.g., from defect data store113). In another example, vulnerability prediction device202may train the one or more ML models with log files containing information about one or more successful attacks and the configuration settings of the RTAP system that failed to identify those successful attack. In this way, the ML models will be able to identify configuration setting patterns that are susceptible to particular vulnerabilities.

Device204may apply the ML models to proposed configuration settings of one or more RTAP systems to predict potential vulnerabilities of the proposed configuration settings (304). If vulnerability prediction device202predicts any potential vulnerabilities of the proposed configurations, vulnerability prediction device202may identify one or more configuration setting changes to the proposed configuration settings to overcome predicted potential vulnerabilities (308). In some examples, vulnerability prediction device202may generate an alert identifying the predicted potential vulnerabilities and/or the one or more configuration setting changes. In some examples, vulnerability prediction device202may transmit, via an interface or API, that alert to a device (e.g., a security monitoring device or any suitable computing device). In some examples, the alert may indicate to focus testing of the proposed configuration based on the predicted potential vulnerabilities.

The methods described above with respect toFIG.3may be performed by the same device (e.g., any of vulnerability prediction devices102,202, and/or any suitable device). Additionally, the components and functionality described above with respect to any of vulnerability prediction devices102and/or202may be combined into a single device that may implement all of the techniques of this disclosure.