Patent ID: 8566919

Claim:
A method for protecting web applications, the method comprising: at a first web application firewall (WAF): receiving a first HTTP request from over a network, the first HTTP request being destined for a first web server that is associated with a first web application that is running on the first web server, the first web application being categorized in a first class; analyzing the first HTTP request based on at least one rule applied by a handler; generating a second rule based on the analyzing, wherein said generating involves: in response to determining that a referrer URL included in the first HTTP request is not present in a whitelist or a blacklist, incrementing a count corresponding to the referrer URL, wherein the count keeps track of HTTP requests that were received within a given time window that included the referrer URL, and in response to determining that the count corresponding to the referrer URL is above a threshold, generating the second rule, wherein the second rule redirects HTTP requests that include the referrer URL to a gray list URL; and transmitting the second rule, over the network, to a global server unit; and at a second web application firewall (WAF): receiving the second rule from over the network from the global server unit; receiving a second HTTP request from over a network, the second HTTP request being destined for a second web server that is associated with a second application that is running on the second web server and categorized in the first class; and analyzing the second HTTP request based on the second rule, the second rule being communicated from the global server unit to the second WAF responsive to the global server unit identifying the first web application and the second web application as being members of the first class and the second web application running on the second web server.