'The Rise And Fall' Of ModSecurity And The OWASP Core Rule Set
summary
Claims that machine learning tuned the CRS severity scores and that adversarial training improves robustness. Evaluation uses 50,000 samples (25k legit, 25k SQLi, 80/20 train/test), engines: mod_security + OWASP CRS, mutation tool: wafle adversarial mutations plus sqlmap samples. Models include linear classifiers, SVM and random forest with L1/L2 regularization. Result: adjusted severities raise detection at a fixed 1% false‑positive rate and adversarially trained models resist crafted evasions. Code and data are published.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:18Web app firewalls and rule sets
- 8:03Core Rule Set levels
- 13:40Rule set issues
- 14:00False positive reduction
- 20:48Vanilla ModSecurity performance
- 23:21Severity scores adjustment
- 25:33Rule set robustness
- 28:05Adversarial training
- 31:00Integrating machine learning into ModSecurity
- 32:28Q&A
related talks
41mPractical OWASP CRS In High Security Settings
29mFlagship Projects: ModSecurity Core Rule Set
35mNever Walk Alone: Inspirations From a Growing OWASP Project
01h 01mSecure AI: Integrating OWASP Principles in Machine Learning Model Development
32mResilient Secure Software Development Through Insights Learned from Adversarial Attack Campaigns
14mWeb Application Firewalls: A False Sense of Security?
40mWeb Application Firewalls: Analysis of Detection Logic
46mIt is rough without a WAF