WAPP: Safe Learning of Positive Security WAF Policies from Live Traffic
Heba Osama, Zeyad Ahmed, Mohamed Amgad, Ahmed Saafan, Jana Elfeky, Mariam Abdelati, Haitham Ghalwash
cs.CR · cs.AI · cs.NI
Quick verdict
Claims poisoning-safe allowlist WAF learning via 7-signal trust filter; honest, well-scoped study, but evidence rests on 3 small apps and synthetic data.
Summary
The paper presents WAPP, a framework that learns positive-security (allowlist) WAF policies from live traffic while guarding against training-data poisoning. A staged pipeline combines seven trust signals (WAF attack flags, HTTP status, source-IP cardinality, observation count, temporal spread, optional per-IP cap, and a per-parameter value-frequency floor), a deterministic rule synthesizer, an evidence score, and shadow-mode validation in a live Coraza + OWASP CRS stack before enforcement. Across five research questions on three controlled applications (DVWA, Juice Shop, and a custom Flask app), the authors show unfiltered learning on a DVWA username field degrades at 0.2% poisoned traffic (mean PER 0.167) and breaks at 0.5%; on a frozen synthetic dataset, all-seven-signal filtering raises effectiveness from 0.529 (empty filter) to 0.900 versus 0.623 for a Kruegel–Vigna baseline, with Shapley attribution crediting the value-frequency floor most. Deterministic synthesis matches a qwen3.5-27b LLM on attack blocking at zero inference cost, while learned constraints block all ten confirmed CRS bypass requests on two constrained fields. Main limitations: evidence rests on small synthetic/seeded populations and three lab applications with no production traffic; text fields show high false-positive rates (up to 0.76–0.78 on username/comment fields); the composed defense violates the paper's own 0.05 FPR guardrail; statistical support is thin (three seeds, an exploratory Fisher test with a data-derived cutoff); and code is only available on request.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Learning allowlist policies from unfiltered live traffic becomes unsafe at very low poisoning rates: on the tested DVWA username field, Degraded at 0.2% poison (mean PER 0.1667) and Broken at 0.5% (PER 0.50).
- On the frozen RQ2 dataset, trust filtering with all seven signals raises poisoning effectiveness from 0.5288 (empty filter) to 0.9000, versus 0.6231 for the Kruegel–Vigna baseline, without any clean training seed.
- Deterministic statistical synthesis matches the tested qwen3.5-27b LLM on attack blocking at zero inference cost and uniquely produces closed parameter sets (6 of 7 rules vs 0 of 15 LLM runs).
- Evidence scores measure supporting evidence rather than policy safety, so representative live validation is required before enforcement.
- Learned positive-security constraints block all 10 confirmed CRS bypass requests on two constrained fields while admitting in-shape negative controls.
Strengths
Unusually candid, well-scoped reporting
Failure modes are reported as prominently as wins: the composed defense recovers PER to 0 but violates the authors' own 0.05 FPR guardrail (FPR 1.00 on Airport comment, 0.80 on DVWA, §4.1); the free-text field is Broken at 0% poison (PER 0.30, PFS 0.462) with a deconfounding-holdout FPR of 0.26; Juice Shop shows 12 attack admissions at integer-ID path endpoints (§4.3). Abstract and conclusions restate claims with dataset qualifiers intact.
Exhaustive, principled signal ablation
Section 4.2 enumerates all 2^7 = 128 trust-signal coalitions on a frozen dataset and applies exact Shapley attribution (floor 0.1494, WAF flags and HTTP status 0.0968 each, per-IP cap 0.0000), plus a sensitivity grid showing the floor benefit is threshold-invariant from 0.70–0.95 (Table 6).
Adaptive attacker evaluation beyond naive poisoning
Live end-to-end validation with controls
Weaknesses
Lab-scale evidence base
Thin statistical support for headline numbers
Free-text handling remains effectively unsolved
Reproducibility depends on goodwill
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
WAPP: Structured Preliminary Review
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is WAPP?
WAPP (Whitelisting Autonomous Policy Producer) is a framework that automatically learns positive-security (allowlist) WAF rules from live web traffic. It filters training data with seven trust signals to resist poisoning, synthesizes deterministic per-endpoint rules, scores them for evidence support, and validates them in a live Coraza WAF (with OWASP CRS) before enforcement.
What does 'positive security' mean for a WAF?
Instead of signatures that recognize known attacks (negative security), positive security defines what legitimate input looks like for each field (allowed types, ranges, character sets, parameter sets) and blocks anything outside that learned profile. It can stop unseen attacks but risks blocking legitimate traffic if the profile is too strict.
How much poisoned traffic breaks allowlist learning in this paper?
In the paper's experiments on a DVWA login username field, without trust filtering, just 0.2% poisoned traffic already degraded the learned policy (mean payload evasion rate 0.167) and 0.5% broke it (evasion 0.50) — malicious requests that pass the existing WAF silently reshape what the allowlist learns to accept.
Does WAPP replace OWASP CRS or commercial WAF learning?
No. WAPP complements signature rules like OWASP CRS: in the paper's test, learned constraints blocked 5 confirmed CRS bypasses on constrained fields, but free-text fields still suffered high false positives. Its trust signals (source diversity, observation counts, time spread, successful responses) are grounded in commercial WAF learning features from Imperva, F5, FortiWeb, and Broadcom.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1–3 are present only as captions in the extracted text; their plotted values are not recoverable, though the key numbers they summarize are stated in the prose and tables (e.g., §4.3 application-level PER/FPR values are given in text).
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.