Web application attacks (such as SQLi and XSS) remain a major cybersecurity threat. The best countermeasures are secure software and system design, and rigorous application testing. However, this is not always feasible, especially for legacy or OT systems. Therefore, it is recommended to implement Web Application Firewalls either individually for each web application or as part of perimeter security. With advances in machine learning, new challenges emerge alongside new opportunities. On one hand, AI enables performing automatic and sophisticated attacks. On the other hand, ML can be used inside WAFs to detect attacks.
This thesis aims to analyze different WAFs against traditional and AI-assisted Web application attacks. This includes:
- Development of an experimental environment
- Selection of attack framework(s)
- Evaluation of different WAFs
- Optimization and hardening of WAFs
Please contact the supervisor for further information.