Big Data Intelligence
summary
Akamai describes a platform that collects petabytes of WAF data (about 260 TB compressed logs per day, stores 2 PB for 45 days) and analyzes it with Akamai CSI and the SARA UI to drill down in six clicks; an AWT testing framework uses Alexa top 100 crawls plus real attack feeds (roughly 95% valid 5% attack test set) to measure precision recall and MCC, maps rules into risk groups, isolates HTTP-violation noise (rule 960015 dominated triggers from Android/news apps), and disables redundant rules to cut false positives.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:20Topics to Cover
- 1:58Akamai & OWASP CRS
- 3:58Akamai Intelligent Platform
- 5:21CSI Platform Statistics
- 6:08CSI High Level Architecture
- 6:52Yoda (Distributed Query Engine)
- 9:55Sample Data App - SARA
- 11:36WAF Accuracy Lingo
- 13:03Things You Need to Know
- 21:03Akamai WAF Testing (AWT) Framework
- 23:49AWT Built-In Test Cases
- 26:25AWT Reports - False Positives Analysis
- 27:23Risk Groups
- 29:37Multiple Thresholds
- 30:56CRS Issue #2
- 31:36HTTP Violations
- 33:39960015 - Research into 3 hours of triggers
- 35:58Cookies
- 37:29Score Spreading Across Selectors
- 39:49Rule Inefficiency
- 42:52Summary
related talks
43mMaking WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)
49mApisecure, 14 & 15 March 2023 - Sudhir Chepeni, Director Products and Technology at Akamai.
27mSecuring Applications and Managing WAFs at a large scale
53mHow AWS threat intelligence becomes managed firewall rules
39mBarbarians at the Gate(way)
33mSpotlight On Latest Web Application and API Attack Data
15mLevel up security: Advanced AWS WAF rules & bot detection techniques
51mCyber threat intelligence sharing on AWS