Understanding the Feature Space and Decision Boundaries of Commercial WAFs Using Maximum Entropy in the Mean

Area of Science:

• Network Security
• Probability Theory
• Data Analysis

Background:

• Network security necessitates accurate identification and characterization of attacks targeting network ports.
• Monitoring user access requests is crucial for understanding network traffic patterns.

Purpose of the Study:

• To determine the joint probability distribution of connection frequency and type from their marginals.
• To address the challenge of inferring joint probabilities in the presence of measurement errors.
• To develop a flexible, model-free method for network attack characterization.

Main Methods:

• Analysis of connection frequency and connection type to a network.
• Mathematical formulation as an ill-posed linear problem with convex constraints.
• Application of the method of maximum entropy in the mean to solve the problem.

Main Results:

• Successfully determined the joint probability distribution from marginals.
• The maximum entropy method naturally accommodates data errors.
• The procedure is model-free, eliminating the need for parameter fitting.

Conclusions:

• The maximum entropy in the mean method provides a robust solution for determining joint probability distributions in network security.
• This model-free approach enhances the ability to characterize network attacks accurately, even with imperfect data.
• The technique offers flexibility and avoids the complexities of parameter estimation in network security analysis.