Chunk-scanning of web application layer requests to reduce delays

A method by a web application layer attack detector implemented by one or more electronic devices, wherein the web application layer attack detector is communicatively coupled to a plurality of web application clients and one or more web application servers, the method comprising:

• determining, at the web application layer attack detector, to form a first chunk out of a first received part of a first web application layer request that is being sent from a first of the plurality of the web application clients and that has an end which has not yet been received, wherein the determining means that the web application layer attack detector considers the first web application layer request to be large, wherein the first chunk is formed to start at an end of a previous chunk and to end immediately after a closing tag that indicates an end of a complete element in the first web application layer request that when included in the first chunk allows the first chunk to be sized less than a preconfigured maximum chunk size;
• storing, at the web application layer attack detector, contextual information for the first web application layer request, wherein the contextual information for the first web application layer request includes a partial element that includes a portion of the first web application layer request starting immediately after the closing tag that was received at the web application layer attack detector but not included in the first chunk;
• receiving, at the web application layer attack detector, a second web application layer request that is smaller than the first web application layer request, that is being sent from a second of the plurality of the web application clients and that has an end which has been received;
• scanning, at the web application layer attack detector, the first chunk and the second web application layer request for attacks without waiting to receive and store the end of the first web application layer request so that the second web application layer request that is smaller than the first web application layer request is not held in the web application layer attack detector behind the first web application layer request that is considered large;
• forwarding, by the web application layer attack detector, the first chunk and the second web application layer request to one of the one or more web application servers, wherein the first chunk is forwarded without waiting for other chunks of the first web application layer request to be scanned;
• determining, at the web application layer attack detector, to form a second chunk out of another received part of the first web application layer request;
• and
• scanning, at the web application layer attack detector, the second chunk for attacks after the scanning of the second web application layer request.

A set of one or more non-transitory machine-readable storage media storing instructions which, when executed by one or more processors of one or more electronic devices, cause the one or more electronic devices to perform operations of a web application layer attack detector, wherein the web application layer attack detector is communicatively coupled between a plurality of web application clients and one or more web application servers, the operations comprising:

• receiving, at the web application layer attack detector, one or more data streams each carrying one or more web application layer requests, wherein each of the one or more web application layer requests is generated by one of the plurality of web application clients and intended for one of the one or more web application servers;
• forming chunks from each of the one or more web application layer requests as it is being received at the web application layer attack detector, wherein each of the chunks is sized to be less than a preconfigured maximum chunk size, wherein forming the chunks includes forming a chunk from a web application layer request carried by a data stream of the one or more data streams responsive to a determination that a sufficient amount of data of the data stream has been received at the web application layer attack detector to form the chunk, wherein the chunk is formed to start at an end of a previous chunk and to end immediately after a closing tag that indicates an end of a complete element in the web application layer request but not an end of the web application layer request that when included in the chunk allows the chunk to be sized less than the preconfigured maximum chunk size;
• storing, at the web application layer attack detector, contextual information for the web application layer request, wherein the contextual information for the web application layer request includes a partial element that includes a portion of the web application layer request starting immediately after the closing tag that was received at the web application layer attack detector but not included in the chunk
• scanning the chunks for attacks as each of the chunks is formed without waiting to receive and store complete web application layer requests from which the chunks are formed;
• and
• sending each of one or more of the chunks that were determined, based on a result of the scanning, not to include an attack to the web application server for which the web application layer request from which that chunk was formed is intended as that chunk is scanned without waiting for other chunks of the web application layer request to be scanned.

An electronic device configured to implement a web application layer attack detector, wherein the web application layer attack detector is communicatively coupled between a plurality of web application clients and one or more web application servers, the electronic device comprising:

• one or more processors;
• and
• a non-transitory machine-readable storage medium having instructions stored therein,
• which when executed by the one or more processors, cause the electronic device to:
• receive, at the web application layer attack detector, one or more data streams each carrying one or more web application layer requests, wherein each of the one or more web application layer requests is generated by one of the plurality of web application clients and intended for one of the one or more web application servers,
• form chunks from each of the one or more web application layer requests as it is being received at the web application layer attack detector, wherein each of the chunks is sized to be less than a preconfigured maximum chunk size, wherein forming the chunks includes forming a chunk from a web application layer request carried by a data stream of the one or more data streams responsive to a determination that a sufficient amount of data of the data stream has been received at the web application layer attack detector to form the chunk, wherein the chunk is formed to start at an end of a previous chunk and to end immediately after a closing tag that indicates an end of a complete element in the web application layer request but not an end of the web application layer request that when included in the chunk allows the chunk to be sized less than the preconfigured maximum chunk size,
• store, at the web application layer attack detector, contextual information for the web application layer request, wherein the contextual information for the web application layer request includes a partial element that includes a portion of the web application layer request starting immediately after the closing tag that was received at the web application layer attack detector but not included in the chunk,
• scan the chunks for attacks as each of the chunks is formed without waiting to receive and store complete web application layer requests from which the chunks are formed, and
• send each of one or more of the chunks that were determined, based on a result of the scanning, not to include an attack to the web application server for which the web application layer request from which that chunk was formed is intended as that chunk is scanned without waiting for other chunks of the web application layer request to be scanned.