Machine learning based web application firewall

A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause operations to be performed comprising:

• receiving raw data;
• performing one or more transformations on the received raw data including:
• normalizing the received raw data, and
• generating a signature over the normalized data;
• vectorizing the generated signature to create a first vector of integers;
• vectorizing the normalized data to create a second vector of integers;
• inputting the first vector of integers and the second vector of integers into a machine learning model;
• processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:
• a first stage that operates on the first vector of integers to identify a result, and
• a second stage that operates on the result of the first stage and the second vector of integers and conditions attention on the second vector of integers on the result of the first stage;
• wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious;
• and
• enforcing a traffic processing rule for the received raw data that instructs a web application firewall (WAF) to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.

An apparatus, comprising:

• a processor;
• and
• non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the apparatus to perform operations including:
• receiving raw data;
• performing one or more transformations on the received raw data including:
• normalizing the received raw data, and
• generating a signature over the normalized data;
• vectorizing the generated signature to create a first vector of integers;
• vectorizing the normalized data to create a second vector of integers;
• inputting the first vector of integers and the second vector of integers into a machine learning model;
• processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:
• a first stage that operates on the first vector of integers to identify a result, and
• a second stage that operates on the result of the first stage and the second vector of integers and conditions attention on the second vector of integers on the result of the first stage;
• wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious;
• and
• enforcing a traffic processing rule for the received raw data that instructs a web application firewall (WAF) to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.