| CPC H04L 63/0263 (2013.01) [G06F 30/27 (2020.01); H04L 41/16 (2013.01); H04L 63/1416 (2013.01)] | 21 Claims |
|
1. A method for a machine learning (ML) based web application firewall (WAF), comprising:
receiving raw data;
performing one or more transformations on the received raw data including:
normalizing the received raw data, and
generating a signature over the normalized data;
vectorizing the generated signature to create a first vector of integers;
vectorizing the normalized data to create a second vector of integers;
inputting the first vector of integers and the second vector of integers into a machine learning model;
processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:
a first stage that operates on the first vector of integers to identify a result, and
a second stage that operates on the result of the first stage and the second vector of integers and conditions attention on the second vector of integers on the result of the first stage;
wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious; and
enforcing a traffic processing rule for the received raw data that instructs the WAF to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.
|