openappsec v1.0.1 releases: machine learning security engine to prevents threats against Web Application & APIs
open-appsec (openappsec.io) builds on machine learning to provide preemptive web app & API threat protection against OWASP-Top-10 and zero-day attacks. It can be deployed as an add-on to Kubernetes Ingress, NGINX, Envoy (soon), and API Gateways.
The open-appsec engine learns how users normally interact with your web application. It then uses this information to automatically detect requests that fall outside of normal operations and conducts further analysis to decide whether the request is malicious or not.
Upon every HTTP request, all parts are decoded, JSON and XML sections are extracted, and any IP-level access control is applied.
Every request to the application goes through two phases:
Multiple variables are fed to the machine-learning engine. These variables, which are either directly extracted from the HTTP request or decoded from different parts of the payload, include attack indicators, IP addresses, user agents, fingerprints, and many other considerations. The supervised model of the machine learning engine uses these variables to compare the request with many common attack patterns found across the globe.
If the request is identified as a valid and legitimate request the request is allowed, and forwarded to your application. If, however, the request is considered suspicious or high risk, it then gets evaluated by the unsupervised model, which was trained in your specific environment. This model uses information such as the URL and the users involved to create a final confidence score that determines whether the request should be allowed or blocked.
Machine Learning models
open-appsec uses two models:
A supervised model that was trained offline based on millions of requests, both malicious and benign.
- A basic model is provided as part of this repository. It is recommended for use in Monitor-Only and Test environments.
- An advanced model which is more accurate and recommended for Production use can be downloaded from the open-appsec portal->User Menu->Download advanced ML model. This model updates from time to time and you will get an email when these updates happen.
An unsupervised model that is being built in real-time in the protected environment. This model uses traffic patterns specific to the environment.
Main features of open-appsec
Machine Learning-based Application Firewall – stop application layer attacks including OWASP Top 10 with very minimal tuning and no false positives. Pre-emptive (no software updates) protection for zero-days such as Log4Shell and Spring4Shell.
stop malicious API access and abuse
and enforce API schema (Premium Edition)
Bot Prevention – Identify and stop automated attacks before they negatively impact the bottom line or customer experience (Premium Edition)
Intrusion Prevention –
Full IPS Engine with support for custom Snort 3.0 signatures.
Protections for over 2,800 WEB CVEs, based on Check Point award-winning NSS-Certified IPS (Premium Edition)
HTTPS Traffic inspection – SSL certificate and private keys can be stored locally or in public cloud secrets storage (AWS/Azure)
Integration into modern environments and workloads (public cloud & Kubernetes) and CI/CD workflows, supporting NGINX Ingress Controller, NGINX, and Kong Gateway on Kubernetes, Linux Servers, and Containers (Docker).
Ease of ongoing management and maintenance – Enterprise Grade SaaS Web UI, GraphQL API, and Infrastructure-as-code using Terraform
- Bug fix for converting CRD and Ingress-based policies into agent-usable formats (45)
- Issue resolved with duplicated service listing in “open-appsec-ctl -s” command within Docker.
- open-appsec agent
- NGINX ingress controller with open-appsec attachment
- NGINX with open-appsec attachment
- kong gateway attachment
- Kong with open-appsec attachment
Copyright (C) 2023 openappsec