# US 12,224,987 B2 · Machine learning based web application firewall

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,224,987 B2
- Document ID: US12224987B2
- Status: Granted
- Kind: B2
- Application number: 18/478,191
- Filed: 2023-09-29
- Published: 2024-08-01
- Granted: 2025-02-11
- Earliest claimed: 2023-01-30
- Assignees: Cloudflare, Inc.
- Applicants: Cloudflare, Inc.
- Inventors: Vikram Grover; Petre Gabriel Gabor; Nicholas Mikhail Robert
- Web page: https://patentgrep.com/patent/US12224987B2

## CPC

- H04L 63/0263: {Rule management}
- G06F 30/27: using machine learning, e.g. artificial intelligence, neural networks, support vector machines [SVM] or training a model
- H04L 41/16: using machine learning or artificial intelligence
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A machine learning (ML) based web application firewall (WAF) is described. Transformation(s) are applied to raw data including normalizing and generating a signature over the normalized data. The signature and the normalized data are vectorized to create a first and second vector of integers respectively. The first and second vector of integers are input into an ML model, which outputs a score that indicates a probability of the raw data being of a type that is malicious. A traffic processing rule is enforced that instructs a WAF to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.

## Claims

### Claim 1

A method for a machine learning (ML) based web application firewall (WAF), comprising:
receiving raw data;
performing one or more transformations on the received raw data including:
normalizing the received raw data, and
generating a signature over the normalized data;
vectorizing the generated signature to create a first vector of integers;
vectorizing the normalized data to create a second vector of integers;
inputting the first vector of integers and the second vector of integers into a machine learning model;
processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:
a first stage that operates on the first vector of integers to identify a result, and
a second stage that operates on the result of the first stage and the second vector of integers and conditions attention on the second vector of integers on the result of the first stage;
wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious; and
enforcing a traffic processing rule for the received raw data that instructs the WAF to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.

### Claim 2 (depends on 1)

The method of claim 1, wherein the raw data is a Hypertext Transfer Protocol (HTTP) request.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
extracting a plurality of parts of the HTTP request; and
wherein the one or more transformations are performed on each of the extracted plurality of parts of the HTTP request.

### Claim 4 (depends on 3)

The method of claim 3, wherein the plurality of parts of the HTTP request include at least two of:
RequestURI;
Referer-Path;
User-Agent;
Content-Type; and
Body.

### Claim 5 (depends on 1)

The method of claim 1, wherein generating the signature over the normalized data includes replacing each contiguous sequence of non-special characters with a placeholder token.

### Claim 6 (depends on 1)

The method of claim 1, wherein the score is indicative of the raw data being of a type that is related to an SQL injection (SQLi) attack, a cross site scripting (XSS) attack, a remote code execution (RCE) attack.

### Claim 7 (depends on 1)

The method of claim 1, wherein each integer in the second vector of integers represents a token in a finite vocabulary.

### Claim 8

A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause operations to be performed comprising:
receiving raw data;
performing one or more transformations on the received raw data including:
normalizing the received raw data, and
generating a signature over the normalized data;
vectorizing the generated signature to create a first vector of integers;
vectorizing the normalized data to create a second vector of integers;
inputting the first vector of integers and the second vector of integers into a machine learning model;
processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:
a first stage that operates on the first vector of integers to identify a result, and
a second stage that operates on the result of the first stage and the second vector of integers and conditions attention on the second vector of integers on the result of the first stage;
wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious; and
enforcing a traffic processing rule for the received raw data that instructs a web application firewall (WAF) to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.

### Claim 9 (depends on 8)

The non-transitory machine-readable storage medium of claim 8, wherein the raw data is a Hypertext Transfer Protocol (HTTP) request.

### Claim 10 (depends on 9)

The non-transitory machine-readable storage medium of claim 9, wherein the operations further comprise:
extracting a plurality of parts of the HTTP request; and
wherein the one or more transformations are performed on each of the extracted plurality of parts of the HTTP request.

### Claim 11 (depends on 10)

The non-transitory machine-readable storage medium of claim 10, wherein the plurality of parts of the HTTP request include at least two of:
RequestURI;
Referer-Path;
User-Agent;
Content-Type; and
Body.

### Claim 12 (depends on 8)

The non-transitory machine-readable storage medium of claim 8, wherein generating the signature over the normalized data includes replacing each contiguous sequence of non-special characters with a placeholder token.

### Claim 13 (depends on 8)

The non-transitory machine-readable storage medium of claim 8, wherein the score is indicative of the raw data being of a type that is related to an SQL injection (SQLi) attack, a cross site scripting (XSS) attack, a remote code execution (RCE) attack.

### Claim 14 (depends on 8)

The non-transitory machine-readable storage medium of claim 8, wherein each integer in the second vector of integers represents a token in a finite vocabulary.

### Claim 15

An apparatus, comprising:
a processor; and
non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the apparatus to perform operations including:
receiving raw data;
performing one or more transformations on the received raw data including:
normalizing the received raw data, and
generating a signature over the normalized data;
vectorizing the generated signature to create a first vector of integers;
vectorizing the normalized data to create a second vector of integers;
inputting the first vector of integers and the second vector of integers into a machine learning model;
processing, at the machine learning model, the first vector of integers and the second vector of integers, wherein the machine learning model uses a multiple stage process including:
a first stage that operates on the first vector of integers to identify a result, and
a second stage that operates on the result of the first stage and the second vector of integers and conditions attention on the second vector of integers on the result of the first stage;
wherein the machine learning model outputs a score that indicates a probability of the raw data being of a type that is malicious; and
enforcing a traffic processing rule for the received raw data that instructs a web application firewall (WAF) to block traffic when the score is above a threshold that indicates the raw data is of the type that is malicious.

### Claim 16 (depends on 15)

The apparatus of claim 15, wherein the raw data is a Hypertext Transfer Protocol (HTTP) request.

### Claim 17 (depends on 16)

The apparatus of claim 16, wherein the operations further comprise:
extracting a plurality of parts of the HTTP request; and
wherein the one or more transformations are performed on each of the extracted plurality of parts of the HTTP request.

### Claim 18 (depends on 17)

The apparatus of claim 17, wherein the plurality of parts of the HTTP request include at least two of:
RequestURI;
Referer-Path;
User-Agent;
Content-Type; and
Body.

### Claim 19 (depends on 15)

The apparatus of claim 15, wherein generating the signature over the normalized data includes replacing each contiguous sequence of non-special characters with a placeholder token.

### Claim 20 (depends on 15)

The apparatus of claim 15, wherein the score is indicative of the raw data being of a type that is related to an SQL injection (SQLi) attack, a cross site scripting (XSS) attack, a remote code execution (RCE) attack.

### Claim 21 (depends on 15)

The apparatus of claim 15, wherein each integer in the second vector of integers represents a token in a finite vocabulary.