Implement Web Attack Detection Engine with Snort by Using Modsecurity Core Rules

In the Web 2.0 generation, network system faced the racket “Web attack”. Traditional network security devices like Firewall and Intrusion Detection System deal can hardly confront the threat of Web attacks since Hackers often use multi-level or multi-type encoding attack to evade Intrusion Detection Systems. The Intrusion Detection System usually uses the attack signature and Regular Expression to detect web attack, but with limited efficiency. The open source Web Application Firewall “ModSecurity” could use Core Rule to detect SQL Injection, Cross Site Scripting, Insecure Direct Object Reference and Cross Site Request Forgery attacks. The purpose of this paper is provide the ability of web attack detection for Snort by implementing the web attack detection engine using the Core Rule Sets of ModSecurity.