WSF: An HTTP-Level Firewall for Hardening Web Servers

Due to both complexity of administration, insufficient checks on input data in many web applications, as well as lack of a single place to enforce security policy, web servers remain prone to external tampering. This paper proposes WSF (web server firewall) to protect web systems with three new mechanisms. First, WSF provides a language for specifying fine grained access control policy and enforcing it at the perimeter of a web server. Second, to prevent abuse of web application with malicious parameters, WSF allows web application developers to specify the restriction on application running parameters, rather than requiring them to enumerating all possible invalid input patterns, which substantially simplify input validation. Finally, WSF collects web user behavior statistics, which helps administrators to detect abnormal activities and adjust the access control policy heuristically. KEYWORD: Firewall, Attack Signature