Bye-Bye False Positives: Using AI to Improve Detection
summary
Claims a practical system that reduces WAF/IPS false positives by treating SQLi payloads as tokenized lexeme time-series, preprocessing with a heuristic "tandems" step and training an embedding + bidirectional LSTM with attention (max/avg pooling) in TensorFlow 1.x. Reports 96.07% on 433 libinjection false_positives samples, releases MIT-licensed code and data on GitHub, runs in production at Wallarm, and warns limits: current model targets SQLi only and needs per-application metadata to avoid legitimate payloads.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:15Goals
- 3:10Scope Limitations
- 4:48Application of Neural Networks
- 6:30Watson Payload
- 8:13Parser Mechanics
- 13:04Implementation
- 14:13Neural Networks
- 15:38Architecture
- 16:15Availability
- 17:28Tuning
- 20:03Whats next
related talks
55mApisecure, 14 & 15 March 2023 - Sagar Bhure, Security Engineer at F5.
11mAI-Powered Cybersecurity in the Age of Advanced Threats
25mOver 20 Years of SQL Injection Attacks in the Wild - Time to Refine and ...
34mlibinjection: from sqli to xss
08mAI-Powered Fraud Detection in Financial System
24mSecuring AI Integration with API's
57mAI Applications Security Puzzle
21mMachine Learning and Cyber Security - Detecting malicious URLs in the haystack