Web Application Defender's Cookbook

Recipe 1-5: Using Bayesian Attack Payload Detection

This recipe shows you how to integrate Bayesian analysis of HTTP parameter payloads to identify malicious data.

Ingredients

• ModSecurity Reference Manual7
  • Lua API
• OWASP ModSecurity CRS Lua scripts8
  • modsecurity_crs_48_bayes_analysis.conf
  • bayes_train_spam.lua
  • bayes_train_ham.lua
  • bayes_check_spam.lua
• OSBF-Lua: Bayesian text classifier9
• Moonfilter: Lua wrapper for OSBF-Lua10
• Moonrunner: Command-line interface to Moonfilter11

Using Bayesian Analysis to Detect Web Attacks

Bayesian text classifiers have long been used to detect spam e-mails. Why not use the same type of analysis for web traffic to identify malicious requests? The general concept is directly applicable, from e-mail analysis to HTTP request parameter inspection. But there are a few nuances to be aware of:

• Ham versus spam. In our implementation, ham is considered nonmalicious traffic, and spam is considered an attack payload.
• Input source. Bayesian classifiers normally inspect operating system (OS) text files (e-mail messages) with many different lines of text. With this proof-of-concept implementation in ModSecurity, we must bypass feeding the Bayesian classifier data from OS text files, because this would incur too much latency. We instead must pass the data directly from the request to the Bayesian classifier using the Lua API and store the text in temporary variables.
• Data format. E-mail messages have a certain format and construction, with MIME headers ...