# US 2014/0196141 A1 · Hierarchical rule development and binding for web application server firewall > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196141 A1 - Document ID: US20140196141A1 - Status: Published application - Kind: A1 - Application number: 14/147,857 - Filed: 2014-01-06 - Published: 2014-07-10 - Earliest claimed: 2011-05-24 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Peng Ji; Lin Luo; Vugranam C. Sreedhar; Shun Xiang Yang; Yu Zhang - Web page: https://patentgrep.com/patent/US20140196141A1 ## CPC - H04L 63/0263: {Rule management} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/105: {Multiple levels of security} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract At least one of an HTTP request message and an HTTP response message is intercepted. A corresponding HTTP message model includes a plurality of message model sections. A representation of the at least one of an HTTP request message and an HTTP response message is parsed into message sections in accordance with the message model sections of the HTTP message model. A plurality of security rules are bounds to the message model sections. The plurality of security rules each specify at least one action to be taken in response to a given condition, which is based, at least in part, on a corresponding given one of the message sections. The at least one of an HTTP request message and an HTTP response message is processed in accordance with the plurality of security rules. Techniques for developing rules for a web application server firewall are also provided. ## Claims ### Claim 1 (canceled) ### Claim 2 A method of configuring a web application server firewall to process HTTP request messages and HTTP response messages in according with a plurality of security rules, said method comprising the steps of: building a plurality of HTTP message models including a first HTTP message model configured to process said HTTP request messages and a second HTTP message model configured to process said HTTP response messages, each of said first and second HTTP message models comprising a plurality of message model sections; developing said plurality of security rules, each security rule specifying at least one action responsive to a given condition, said given condition being based, at least in part, on a corresponding section of a message intercepted by said web application server firewall; and binding said plurality of security rules to said message model sections. ### Claim 3 (depends on 2) The method of claim 2, wherein said building and developing steps further comprise causing at least one given one of said plurality of security rules which is written for a parent portion of at least one of said first and second HTTP message models to be inherited for a respective child portion of said at least one of said first and second HTTP message models. ### Claim 4 (depends on 3) The method of claim 3, wherein said building and developing steps further comprise chaining at least two given ones of said plurality of security rules together based on at least said given condition being common to both of said at least two given ones of said plurality of security rules. ### Claim 5 (depends on 2) The method of claim 2, wherein said building said plurality of HTTP message models is performed in a Unified Modeling Language. ### Claim 6 (depends on 2) The method of claim 2, further comprising providing a rule development tool system, wherein said rule development tool system comprises distinct software modules, each of said distinct software modules being embodied on a computer-readable storage medium, and wherein said distinct software modules comprise a message modeling module, a rule modeling module, and a message rule binding module; wherein: said building of said plurality of HTTP message models is carried out by said message modeling module executing on at least one hardware processor; said developing of said plurality of security rules is carried out by said rule modeling module executing on said at least one hardware processor; and said binding is carried out by said message rule binding module executing on said at least one hardware processor. ### Claim 7 An article of manufacture comprising a computer program product for configuring a web application server firewall to process HTTP request messages and HTTP response messages in according with a plurality of security rules, said computer program product comprising: a computer readable storage medium, storing in a non-transitory manner computer readable program code, said computer readable program code comprising: computer readable program code configured to build a plurality of HTTP message models including a first HTTP message model configured to process said HTTP request messages and a second HTTP message model configured to process said HTTP response messages, each of said first and second HTTP message models comprising a plurality of message model sections; computer readable program code configured to develop said plurality of security rules, each security rule specifying at least one action responsive to a given condition, said given condition being based, at least in part, on a corresponding section of a message intercepted by said web application server firewall; and computer readable program code configured to bind said plurality of security rules to said message model sections. ### Claim 8 (depends on 7) The article of manufacture of claim 7, wherein said computer readable program code configured to build and said computer readable program code configured to develop further comprise computer readable program code configured to cause at least one given one of said plurality of security rules which is written for a parent portion of at least one of said first and second HTTP message models to be inherited for a respective child portion of said at least one of said first and second HTTP message models ### Claim 9 (depends on 8) The article of manufacture of claim 8, wherein said computer readable program code configured to build and said computer readable program code configured to develop further comprise computer readable program code configured to chain at least two given ones of said plurality of security rules together based on at least said given condition being common to both of said at least two given ones of said plurality of security rules. ### Claim 10 (depends on 8) The article of manufacture of claim 8, wherein said computer readable program code configured to build said plurality of HTTP message models further comprises computer readable program code configured to build said plurality of HTTP message models in a Unified Modeling Language.