Correlation analysis for reducing signature-based WAF false positives rates

Abstract

This paper addresses the problem of reducing the number of false positives of signature-based WAF. We propose an automatic method for detecting specific signatures which give high FP rates for the given web application using correlation analysis. The proposed method is based on a statistical analysis of the relationship between the total number of HTTP-transactions observed by WAF, and the number of signatures alerts. The proposed method doesn't require the learning phase, and may be used in production in continuous manner, making it more comfortable for the end user of the WAF.

Keywords

• intrusion detection
• web application security
• correlation analysis