Patent Application
20220038423
The present disclosure relates generally to application firewalls, and more specifically to learning and enforcement of application firewall policies.
One of the main challenges in cloud native environments is to evaluate firewall policies based on entity identifiers rather than information which is not entity-specific such as Internet Protocol (IP) addresses. Thus, techniques for accurately and efficiently evaluating application firewall policies are desirable.
Some application firewall solutions attempt to utilize machine learning to learn identities of entities in order to enable application firewall policy enforcement. To this end, some existing solutions attempt to associate incoming web request with specific application runtime behaviors such as queries, process spawning, and the like. For example, existing solutions may learn that a specific route leads to a specific process being spawned, that a specific route causes a particular database query pattern (e.g., requesting that all users for the route follow a query of a specific table of a database), that a specific route causes a file modification on a disk (e.g., uploading images), and the like.
Existing solutions face challenges in correlating and associating application web events with unrelated runtime events on a live-system. This is particularly challenging in web servers with high traffic load. As a result, existing solutions do not have runtime components and cannot flexibly adapt to changes in associations at runtime.
It would therefore be advantageous to provide a solution that would overcome the challenges noted above.
A summary of several example embodiments of the disclosure follows. This summary is provided for the convenience of the reader to provide a basic understanding of such embodiments and does not wholly define the breadth of the disclosure. This summary is not an extensive overview of all contemplated embodiments, and is intended to neither identify key or critical elements of all embodiments nor to delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more embodiments in a simplified form as a prelude to the more detailed description that is presented later. For convenience, the term “some embodiments” or “certain embodiments” may be used herein to refer to a single embodiment or multiple embodiments of the disclosure.
Certain embodiments disclosed herein include a method for learning behavioral activity correlations using traffic shaping. The method comprises: intercepting a plurality of requests, wherein each of the plurality of requests is directed to a respective destination entity of a plurality of destination entities; creating a request queue by queueing the plurality of requests; inspecting contents of the plurality of requests; separately forwarding each intercepted request to its respective destination entity based on the request queue; monitoring runtime output of each of the plurality of destination entities, wherein the runtime output includes behavioral activities of the plurality of destination entities; and training a machine learning model based on the contents of the plurality of requests the runtime output of each of the plurality of destination entities, wherein the machine learning model is trained to output request-output correlations between groups of requests and subsequent behavioral activities.
Certain embodiments disclosed herein also include a non-transitory computer readable medium having stored thereon causing a processing circuitry to execute a process, the process comprising: intercepting a plurality of requests, wherein each of the plurality of requests is directed to a respective destination entity of a plurality of destination entities; creating a request queue by queueing the plurality of requests; inspecting contents of the plurality of requests; separately forwarding each intercepted request to its respective destination entity based on the request queue; monitoring runtime output of each of the plurality of destination entities, wherein the runtime output includes behavioral activities of the plurality of destination entities; and training a machine learning model based on the contents of the plurality of requests the runtime output of each of the plurality of destination entities, wherein the machine learning model is trained to output request-output correlations between groups of requests and subsequent behavioral activities.
Certain embodiments disclosed herein also include a system for learning behavioral activity correlations using traffic shaping. The system comprises: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: intercept a plurality of requests, wherein each of the plurality of requests is directed to a respective destination entity of a plurality of destination entities; create a request queue by queueing the plurality of requests; inspect contents of the plurality of requests; separately forward each intercepted request to its respective destination entity based on the request queue; monitor runtime output of each of the plurality of destination entities, wherein the runtime output includes behavioral activities of the plurality of destination entities; and train a machine learning model based on the contents of the plurality of requests the runtime output of each of the plurality of destination entities, wherein the machine learning model is trained to output request-output correlations between groups of requests and subsequent behavioral activities.
Certain embodiments disclosed herein also include a method for runtime application protection using tournament learning. The method comprises: grouping a plurality of requests directed to a protected entity, wherein each request calls for a respective process, wherein the plurality of requests is grouped based on the process called by each request; monitoring runtime output of the protected entity with respect to each called process, wherein the runtime output includes behavioral activities of the protected entity; and training a machine learning model based on the contents of the plurality of requests and the runtime output of the protected entity, wherein the machine learning model is trained to output correlations between requests and subsequent behavioral activities.
Certain embodiments disclosed herein also include a non-transitory computer readable medium having stored thereon causing a processing circuitry to execute a process, the process comprising: grouping a plurality of requests directed to a protected entity, wherein each request calls for a respective process, wherein the plurality of requests is grouped based on the process called by each request; monitoring runtime output of the protected entity with respect to each called process, wherein the runtime output includes behavioral activities of the protected entity; and training a machine learning model based on the contents of the plurality of requests and the runtime output of the protected entity, wherein the machine learning model is trained to output correlations between requests and subsequent behavioral activities.
Certain embodiments disclosed herein also include a system for runtime application protection using tournament learning. The system comprises: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: group a plurality of requests directed to a protected entity, wherein each request calls for a respective process, wherein the plurality of requests is grouped based on the process called by each request; monitor runtime output of the protected entity with respect to each called process, wherein the runtime output includes behavioral activities of the protected entity; and train a machine learning model based on the contents of the plurality of requests and the runtime output of the protected entity, wherein the machine learning model is trained to output correlations between requests and subsequent behavioral activities.
The subject matter disclosed herein is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the disclosed embodiments will be apparent from the following detailed description taken in conjunction with the accompanying drawings.
It is important to note that the embodiments disclosed herein are only examples of the many advantageous uses of the innovative teachings herein. In general, statements made in the specification of the present application do not necessarily limit any of the various claimed embodiments. Moreover, some statements may apply to some inventive features but not to others. In general, unless otherwise indicated, singular elements may be in plural and vice versa with no loss of generality. In the drawings, like numerals refer to like parts through several views.
It has been identified that, in order to allow for correlating events in a live system, techniques for correlating multiple concurrent requests with runtime behavior are needed. Additionally, once a machine learning model trained for entity identification is trained, techniques for efficiently enforcing firewall policies by applying such a model in real-time in order to identify entities.
To this end, the disclosed embodiments include techniques for application traffic and runtime behavior learning and enforcement. Specifically, the disclosed embodiments provide techniques for traffic shaping which enable learning correlating certain web events with unrelated runtime events during specific periods of operation and for specific application programming interfaces (APIs). Additionally, the disclosed embodiments include techniques for tournament learning which enables learning request-response patterns without requiring traffic shaping.
The various disclosed embodiments include a method and system for traffic shaping in a web application firewall (WAF) deployment. During a learning phase for a machine learning model, incoming requests to a destination are intercepted and queued. The requests are inspected to identify content thereof. Each request is forwarded to the destination in series based on the order of the queue. Runtime output of the destination is monitored. The runtime output includes behavioral activities of an entity to be protected such as an application. It is determined whether each behavioral activity is permitted in accordance with an applicable firewall policy.
The content of each request, the behavioral activities, and the determinations of permissions are input to a machine learning algorithm as part of a learning process. The result is a machine learning model trained to identify permissible and impermissible correlations between requests and runtime outputs. Based on the machine learning, a firewall enforcement model is created. The firewall enforcement model includes, but is not limited to, lists of allowed and forbidden correlated request-output data.
When the firewall enforcement model has been created, a set of behavioral activities to be detected is determined. The behavioral activities to be detected may be behavioral activities included in forbidden correlated request-output data.
During an application phase for the machine learning model, runtime behavior of the protected entity is monitored for these behavioral activities. When any of these behavioral activities is detected, requests received within a sliding time window preceding the behavioral activities are collected and grouped. The behavioral activity data and preceding requests are input to the machine learning model to determine correlations therein. Based on the determined correlations and the firewall enforcement model, it is determined whether to continue allowing the behavioral activities to occur or to perform mitigation actions for preventing the behavioral activities from occurring.
The learning may occur periodically to update the firewall enforcement model to improve precision of correlation identification. In an embodiment, decisions on whether to engage in new learning processes occur dynamically during runtime. To this end, the when to continue learning may be dynamically determined based on data such as, but not limited to, route, query parameters, route verbs, and traffic load.
The traffic shaping embodiments allow for effectively learning correlations between requests and behavioral activities at runtime. More specifically, by intercepting and queuing all incoming requests, the requests may be effectively separated from each other to allow for more accurate correlation between requests and subsequent behavioral activities. Further, new learning occurs selectively at runtime, thereby allowing for adjusting correlation identification during operation while reducing interference with operation of the protected entity.
The various disclosed embodiments also include a method and system for runtime application protection. During a learning phase for a machine learning model, request metadata of each incoming request is stored and utilized to linearize the responses to requests. More specifically, requests for calls to the same process are synchronized and grouped together into batches. The requests of each batch are inspected to identify content thereof.
Runtime output of the destination is monitored. The runtime output includes behavioral activities of an entity to be protected such as an application and may further include runtime characteristics of the protected entity. It is determined whether each behavioral activity is permitted in accordance with an applicable firewall policy. The contents of the requests of each batch, the runtime output, and the determinations of permissions are input to a machine learning algorithm as part of a learning process. Based on the learning process, a firewall enforcement model is created. The firewall enforcement model includes, but is not limited to, lists of allowed and forbidden correlated request-output data.
The firewall enforcement model may further include a list of forbidden parameters, a list of forbidden queries, routing procedures for specific behaviors (e.g., routing when a parameter causes a spike in central processing unit activity), or a combination thereof. The forbidden parameters and queries may further be user-specific, i.e., certain parameters and queries are forbidden for certain users but not for others. To this end, in an embodiment, the machine learning model may be further trained to output correlations between runtime outputs and users by including user identifiers in the training data. More specifically, by identifying users in relation to requests they sent, correlations between requests and subsequent runtime output can be utilized to identify the users that caused such runtime output, thereby correlating between the runtime output and those users.
When the firewall enforcement model has been created, a set of behavioral activities to be detected is determined. The behavioral activities to be detected may be behavioral activities included in forbidden correlated request-output data.
During an application phase for the machine learning model, runtime behavior of the protected entity is monitored for these behavioral activities. When any of these behavioral activities is detected, a set of requests received within a sliding time window preceding the behavioral activities are collected and batched with respect to the processes they call. The behavioral activity data and batches of requests are input to the machine learning model in order to determine between behavioral activities and batches of requests. Based on the determined correlations and the firewall enforcement model, it is determined whether to continue allowing requests to each process to occur or to perform mitigation actions for preventing responses to such requests.
In addition to the various benefits described above including effectively separating requests for more accurate correlations, the tournament learning approach allows for implementing correlation and enforcement without requiring deploying a proxy or other external system. In other words, this approach can be utilized to realize RASP techniques. Further, since the enforcement can be performed locally at the system in which the protected entity is installed, the RASP may utilize data such as runtime characteristics which may not be accessible to external systems This further improves the precision of correlations. Moreover, these techniques allow for combining WAF, runtime policies, and behavioral learning technologies in a deterministic manner, i.e., such that similar batches of requests are reliably correlated to the same runtime behavior.
The protected system 120 may be, but is not limited to, a server, a personal computer, a laptop, a tablet computer, a smartphone, a wearable computing device, or any other system on which an entity 125 to be protected is run. The protected entity (PE) 125 is configured to perform one or more functions as part of a service delivered to the requesting systems 140. To this end, the protected entity 125 may be, but is not limited to, an application, a software container, a virtual machine, and the like. In this regard, the protected system 120 may act as a server providing such services to clients including the requesting systems 140.
The firewall policy enforcer 130 is configured to perform at least a portion of the disclosed embodiments. More specifically, in an embodiment, the firewall policy enforcer 130 is configured to intercept requests from the requesting systems 140 to the protected entity 125, to learn allowed and forbidden request-output correlations using machine learning, and to enforce a firewall policy by identifying new correlations. An example method performed by the firewall policy enforcer 130 of
At S210, an enforcement plan is created based on training data. In an embodiment, creating the enforcement plan includes training a machine learning model to identify allowable and forbidden correlations between request contents and behavioral activities, creating a firewall enforcement model, and determining behavioral activities to monitor for at runtime. An example method for creating an enforcement plan is now described with respect to
At S310, requests directed at a protected entity are intercepted.
At S320, the intercepted requests are queued based on their respective times of interception. If requests are received at the same time, a priority may be determined (e.g., arbitrarily based on metadata or randomly) and the requests may be queued accordingly.
At S330, the contents of each request are inspected.
At S340, the requests are forwarded to their destination, i.e., the protected entity. In an embodiment, the requests are sent separately based on the order of the queue.
In this regard, it has been identified that, when multiple requests are received at a system simultaneously, effectively identifying which requests correspond to which subsequent behavior of the system becomes more challenging and, as a result, identification of such correlations typically becomes less accurate. To this end, intercepting and queueing requests allows for better separating requests and the responses to those requests. As a result, this sequencing improves accuracy of correlation detection as compared to solutions where multiple requests that could have caused a subsequent behavior are received at the same time and it is therefore not practical to identify the request which correlates to the subsequent behavior.
At S350, runtime output of the protected entity is monitored, and runtime output data is collected. Portions of runtime output to be monitored for may include, but are not limited to, filesystem events, process events, network events, queries to specific databases, and the like. The collected data includes at least behavioral activities of the protected entity. Each of these behavioral activities is the result of a preceding request and can therefore be correlated to a preceding request to isolate the cause of the behavior. This, in turn, may be used to determine whether the behavior represents a cyber-attack which requires mitigation.
At S360, the request contents and runtime output data are input to a machine learning model to train the machine learning model to identify correlations between requests and behavioral activities. Further, the inputs to the machine learning model include indicators of whether each request-output correlation is allowed or forbidden such that the machine learning model is further configured to output an indication of whether each identified correlation is allowed or forbidden.
At S370, a firewall enforcement model is created based on the trained machine learning model. In an embodiment, the firewall enforcement model includes a list of allowed request-output correlations, a list of forbidden request-output correlations, or both.
At S380, behavioral activities to monitor for are determined based on the firewall enforcement model. More specifically, the behavioral activities to monitor for include any behavioral activities included in a forbidden request-output correlation such that occurrence of that behavioral activity may indicate forbidden activity.
Returning to
At S230, for each runtime behavior detected at S220, requests in a period of time preceding occurrence of the behavioral activity are collected and grouped. In an embodiment, each time period is a sliding window occurring before the time of the respective behavioral activity.
At S240, the collected requests and their respective behavioral activities are input to a machine learning model trained as described further above with respect to
At S250, based on the output of the machine learning model, appropriate actions for responding to the potentially forbidden activities are determined. In an embodiment, S250 includes performing mitigation actions for any request-output correlations that were identified as forbidden. The mitigation actions may include, but are not limited to, preventing requests, generating an alert, and the like.
At S410, an enforcement plan is created based on training data. In an embodiment, creating the enforcement plan includes training a machine learning model to identify allowable and forbidden correlations between request contents and behavioral activities. An example method for creating an enforcement plan is now described with respect to
At S510, metadata of incoming requests is stored. The request metadata may include but is not limited to, requested processes, identifiers of intended recipients, identifiers of requesting users, combinations thereof, and the like.
At S520, the metadata of the respective requests are synchronized and grouped with respect to requested processes. More specifically, metadata of requests for the same process are grouped together.
As noted above, it has been identified that, when multiple requests are received at a system simultaneously, effectively identifying which requests correspond to which subsequent behavior of the system becomes more challenging and, as a result, grouping metadata of requests allows for separating the requests from the effects they have on runtime output. More specifically, by grouping requests directed to the same process, relationships between specific requests and subsequent behavior of the entity can be isolated by comparing among request-output correlations. As a non-limiting example, consider three types of requests A, B, and C. In the data used for training the machine learning model, the following groups of requests and corresponding runtime outputs are observed:
Request A+Request B=Behavioral Activity X
Request B+Request C=Behavioral Activity X
Request A alone=no forbidden behavior
Request B alone=Behavioral Activity X
A machine learning model trained based on the above observed data will therefore be trained to identify the relationship between Request B and Behavioral Activity X. As a result, when Request B is received and Behavioral Activity X is subsequently observed, the machine learning model will output a correlation reflecting the observation of this relationship.
Further, it has been identified that grouping requests based on the processes they call allows for effectively distinguishing among requests and their effects on runtime output. As a result, this grouping improves accuracy of correlation detection as compared to solutions where multiple requests that could have caused a subsequent behavior are received at the same time and their effects on subsequent runtime output are therefore entangled.
At S530, runtime output is monitored, and runtime output data is collected. Portions of runtime output to be monitored for may include, but are not limited to, filesystem events, process events, network events, queries to specific databases, and the like. The collected data includes at least behavioral activities of the protected entity. Each of these behavioral activities is the result of a preceding request and can therefore be correlated to a preceding a request in order to isolate the cause of the behavior. This, in turn, may be used to determine whether the behavior represents a cyber-attack which requires mitigation.
At S540, the grouped request metadata and the runtime outputs are used to train a machine learning model to identify request-output correlations.
At S550, a firewall enforcement model is created based on the trained machine learning model. In an embodiment, the firewall enforcement model includes a list of allowed request-output correlations, a list of forbidden request-output correlations, or both.
At S560, behavioral activities to monitor for are determined based on the firewall enforcement model. More specifically, the behavioral activities to monitor for include any behavioral activities included in a forbidden request-output correlation such that occurrence of that behavioral activity may indicate forbidden activity.
Returning to
At S430, for each runtime behavior detected at S420, requests preceding occurrence of the behavioral activity are collected and grouped with respect to the processes they call for. The collected requests may include requests occurring in a predetermined period of time prior to the behavioral activities, and the period of time used for each behavioral activity may be different (e.g., based on a known average time between request and activity occurrence).
At S440, the collected requests and their respective behavioral activities are input to a machine learning model trained as described further above with respect to
At S450, based on the output of the machine learning model, appropriate actions for responding to the potentially forbidden activities are determined. In an embodiment, S450 includes performing mitigation actions for any behavioral activities correlated to requests that were indicated as forbidden.
The processing circuitry 610 may be realized as one or more hardware logic components and circuits. For example, and without limitation, illustrative types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), Application-specific standard products (ASSPs), system-on-a-chip systems (SOCs), graphics processing units (GPUs), tensor processing units (TPUs), general-purpose microprocessors, microcontrollers, digital signal processors (DSPs), and the like, or any other hardware logic components that can perform calculations or other manipulations of information.
The memory 620 may be volatile (e.g., random access memory, etc.), non-volatile (e.g., read only memory, flash memory, etc.), or a combination thereof.
In one configuration, software for implementing one or more embodiments disclosed herein may be stored in the storage 630. In another configuration, the memory 620 is configured to store such software. Software shall be construed broadly to mean any type of instructions, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. Instructions may include code (e.g., in source code format, binary code format, executable code format, or any other suitable format of code). The instructions, when executed by the processing circuitry 610, cause the processing circuitry 610 to perform the various processes described herein.
The storage 630 may be magnetic storage, optical storage, and the like, and may be realized, for example, as flash memory or other memory technology, compact disk-read only memory (CD-ROM), Digital Versatile Disks (DVDs), or any other medium which can be used to store the desired information.
The network interface 640 allows the firewall policy enforcer 130 to communicate with intercept and forward requests directed to a protected entity.
It should be understood that the embodiments described herein are not limited to the specific architecture illustrated in
The various embodiments disclosed herein can be implemented as hardware, firmware, software, or any combination thereof. Moreover, the software is preferably implemented as an application program tangibly embodied on a program storage unit or computer readable medium consisting of parts, or of certain devices and/or a combination of devices. The application program may be uploaded to, and executed by, a machine comprising any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units (“CPUs”), a memory, and input/output interfaces. The computer platform may also include an operating system and microinstruction code. The various processes and functions described herein may be either part of the microinstruction code or part of the application program, or any combination thereof, which may be executed by a CPU, whether or not such a computer or processor is explicitly shown. In addition, various other peripheral units may be connected to the computer platform such as an additional data storage unit and a printing unit. Furthermore, a non-transitory computer readable medium is any computer readable medium except for a transitory propagating signal.
All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the principles of the disclosed embodiment and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions. Moreover, all statements herein reciting principles, aspects, and embodiments of the disclosed embodiments, as well as specific examples thereof, are intended to encompass both structural and functional equivalents thereof. Additionally, it is intended that such equivalents include both currently known equivalents as well as equivalents developed in the future, i.e., any elements developed that perform the same function, regardless of structure.
It should be understood that any reference to an element herein using a designation such as “first,” “second,” and so forth does not generally limit the quantity or order of those elements. Rather, these designations are generally used herein as a convenient method of distinguishing between two or more elements or instances of an element. Thus, a reference to first and second elements does not mean that only two elements may be employed there or that the first element must precede the second element in some manner. Also, unless stated otherwise, a set of elements comprises one or more elements.
As used herein, the phrase “at least one of” followed by a listing of items means that any of the listed items can be utilized individually, or any combination of two or more of the listed items can be utilized. For example, if a system is described as including “at least one of A, B, and C,” the system can include A alone; B alone; C alone; 2A; 2B; 2C; 3A; A and B in combination; B and C in combination; A and C in combination; A, B, and C in combination; 2A and C in combination; A, 3B, and 2C in combination; and the like.
