Automatically Repairing Web Application Firewalls Based on Successful SQL Injection Attacks

Dennis Appelt, Annibale Panichella, Lionel Briand

Research output: Chapter in Book/Conference proceedings/Edited volumeEntry for encyclopedia/dictionaryScientificpeer-review

16 Citations (Scopus)


Testing and fixing Web Application Firewalls (WAFs) are two relevant and complementary challenges for security analysts. Automated testing helps to cost-effectively detect vulnerabilities in a WAF by generating effective test cases, i.e., attacks. Once vulnerabilities have been identified, the WAF needs to be fixed by augmenting its rule set to filter attacks without blocking legitimate requests. However, existing research suggests that rule sets are very difficult to understand and too complex to be manually fixed. In this paper, we formalise the problem of fixing vulnerable WAFs as a combinatorial optimisation problem. To solve it, we propose an automated approach that combines machine learning with multi-objective genetic algorithms. Given a set of legitimate requests and bypassing SQL injection attacks, our approach automatically infers regular expressions that, when added to the WAF's rule set, prevent many attacks while letting legitimate requests go through. Our empirical evaluation based on both open-source and proprietary WAFs shows that the generated filter rules are effective at blocking previously identified and successful SQL injection attacks (recall between 54.6% and 98.3%), while triggering in most cases no or few false positives (false positive rate between 0% and 2%).
Original languageEnglish
Title of host publication2017 IEEE 28th International Symposium on Software Reliability Engineering (ISSRE)
Place of PublicationPiscataway, NJ
Number of pages12
ISBN (Electronic)978-1-5386-0941-5
Publication statusPublished - 16 Nov 2017
Externally publishedYes
EventIEEE 28th International Symposium on Software Reliability Engineering: ISSRE - Toulouse, France
Duration: 23 Oct 201726 Oct 2017


ConferenceIEEE 28th International Symposium on Software Reliability Engineering
Internet address


  • Web Application Firewalls
  • Regular Expression Inference
  • Web Security


Dive into the research topics of 'Automatically Repairing Web Application Firewalls Based on Successful SQL Injection Attacks'. Together they form a unique fingerprint.

Cite this