Automated web firewall policy establishment apparatus and method through profiling log analysis

摘要

The present invention relates to an apparatus and method for establishing an automated web firewall policy through profiling log analysis. The method according to the present invention provides a profile-based security policy established by learning a normal request URL profile based on normal response data during a learning period. and analyzing a request URL that does not violate the profile attribute of the profile-based security policy from the detection log detected according to the method, and generating an exception rule for the profile-based security policy based on the result of analyzing the request URL. According to the present invention, by statistically analyzing the detection log through the initial learning profile-based security policy, automatically establishing and applying exception rules by automatically classifying each detection type, or providing policy suggestions to help the administrator to apply them. It can help to establish a security policy for each URL.