Rethinking Web Application Firewalls

Laurin Brandner; Laurent Vanbever

doi:10.3929/ethz-c-000804191

ComputingSecurity & privacy

Rethinking Web Application Firewalls

Laurin Brandner, Laurent Vanbever

Preprint with a published versionReal-world use

In the authors' words

In recent years, the threat of application-layer (L7) distributed denial-of-service (DDoS) attacks is ever increasing. To defend against them, network operators deploy web application firewalls (WAFs). WAFs are stateful scoring systems which are configured with a rule set that specifies what malicious traffic looks like, and how to handle it. While effective, WAFs are expensive and can increase the request latency of realistic applications by up to $4 \times$ . This paper introduces Shimmer, a highly optimized WAF. Shimmer JIT-compiles the rule set and applies advanced optimizations to avoid unnecessary work in the scoring pipeline.

Main resultThe abstract does not state a limitation.

Read the paper PDF

Appeared: Wednesday, September 23. arXiv. Preprint with a published version.

DOI: 10.3929/ethz-c-000804191

Published version: 10.3929/ethz-c-000804191

Rethinking Web Application Firewalls

In the authors' words

More on Security & privacy that day

Quantum ROP: Using Quantum Algorithms for ROP Chain Selection in Exploit Construction

Rouxii: Exploiting Honeypots with Deception-Aware AI Pentesters

LoRango: It Takes Two LoRAs to Unlock Hidden Behaviors in Diffusion Models

SSP-Bench: A Hybrid Data Generation Framework for Safety, Security, and Privacy Evaluation

Toward Responsible AI-Augmented Cyber Defense: Pattern Recognition, Defense-in-Depth, and the Case for Human-AI Collaboration