Knock Knock: Understanding Who is Using Your Web Applications
summary
Web apps face automated abuse constantly: carding runs of 10,000+ checks and months with ~1,000,000 validation attempts. The talk shows using mod_security signatures and GeoIP data to spot anomalies (uniform 1s request rate, no preceding GETs, mismatched User-Agent/OS), moves slow ML off‑line, stores state in Redis, and acts with rep-sheet reputation engine to block, honeypot, or challenge attackers. Overhead is ~5–10 ms and the honeypot captures full attacker behavior for analysis.
AI-written summary · about
chapters (18)
- 0:00Introduction to web defense
- 1:31The default security stack
- 4:29Behavior-based security
- 5:33Signature-based detection
- 9:18Identifying anomalies
- 11:30Understanding credit carding
- 14:32Analyzing malicious patterns
- 18:15Deviations in traffic
- 21:29GeoIP and account security
- 27:37Advanced anomalies
- 30:14Data-driven detection
- 34:16Security as data science
- 37:23Reputation management
- 39:11Action and honeypots
- 42:32RepSheet tool overview
- 45:24Implementing RepSheet
- 49:46Conclusion and summary
- 50:24Q&A session
related talks
27mCommon Application Security Mistakes that Enable Automated Attacks
01h 00mRock ‘Em Sock ‘Em Robots: Bot Swatting Like the Pros
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
40mYou have a security problem - your users
29mBecoming You: A Glimpse Into Credential Abuse
38mCaught My WebApp Cheating on Me!
49mAre you human or a damn bot?
48mSecuring the web with AI