US 12,335,236 B2
Symbolic execution for web application firewall performance
Andrew Jacob Kahn, Yucca Valley, CA (US); Yannis Drougas, London (GB); and Ameya Prakash Shendarkar, Oakland, CA (US)
Assigned to Akamai Technologies, Inc., Cambridge, MA (US)
Filed by Akamai Technologies, Inc., Cambridge, MA (US)
Filed on May 12, 2021, as Appl. No. 17/317,996.
Application 17/317,996 is a continuation of application No. 15/900,313, filed on Feb. 20, 2018, granted, now 11,012,416.
Claims priority of application No. 20180100011 (GR), filed on Jan. 15, 2018.
Prior Publication US 2022/0103522 A1, Mar. 31, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/0263 (2013.01) [H04L 63/0236 (2013.01); H04L 63/0245 (2013.01); H04L 63/168 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A method, comprising:
at a first computer:
receiving a web application firewall rule;
analyzing the web application firewall rule, comprising:
generating a state machine from the web application firewall rule, and
executing one or more passes through the state machine to identify a class of inputs to the web application firewall rule that cannot trigger the web application firewall rule;
generating a test for detecting whether a given input is within the class of inputs, the test being distinct from the web application firewall rule;
exporting the test for delivery to a second computer;
at the second computer:
operating a firewall;
installing the web application firewall rule and the test in the firewall;
receiving an input message from a client device;
executing the test on one or more parts of the input message, wherein:
when the test indicates that the one or more parts of the input message cannot trigger the web application firewall rule, skipping the execution of the web application firewall rule on the one or more parts of the input message, and
when the test does not indicate that the one or more parts of the input message cannot trigger the web application firewall rule, executing the web application firewall rule on the one or more parts of the input message.