Detecting Web Application DAST Attacks in Large-Scale Event Data

This chapter proposes data-centric machine learning to protect web applications from dynamic application security testing (DAST) attacks. DAST scanning consists of automated pen testing against web applications to find exploitable vulnerabilities. They are often used by malicious actors in a brute-force manner for attack reconnaissance with a view to eventual compromise. Traditionally, threshold-based methods have been used to detect such malicious events and behaviour in defensive cybersecurity systems. There are inherent challenges in thresholding, however, not least the arguably arbitrary and brittle nature of selecting and applying a threshold in a production environment. Given these drawbacks, we present a machine learning method using random forests and aggregated event data to detect DAST reconnaissance attacks, using data collected from our proprietary web application firewall. Utilising a vast dataset comprising over 40 million real-world events, it is demonstrated our method is effective in successfully detecting DAST attacks, achieving an F1 score of 0.94 with a low miss rate of 6%. This approach provides important insights into the development of accurate and reliable detection systems that minimise manual tuning, essential in safeguarding against evolving cyber threats.