  Web applications are permanently being exposed to attacks that exploit their
vulnerabilities. In this work we investigate the application of machine
learning techniques to leverage Web Application Firewall (WAF), a technology
that is used to detect and prevent attacks. We propose a combined approach of
machine learning models, based on one-class classification and n-gram analysis,
to enhance the detection and accuracy capabilities of MODSECURITY, an open
source and widely used WAF. The results are promising and outperform
MODSECURITY when configured with the OWASP Core Rule Set, the baseline
configuration setting of a widely deployed, rule-based WAF technology. The
proposed solution, combining both approaches, allow us to deploy a WAF when no
training data for the application is available (using one-class
classification), and an improved one using n-grams when training data is
available.
