Automatic stability determination and deployment of discrete parts of a profile representing normal behavior to provide fast protection of web applications

A non-transitory computer-readable storage medium having instructions which, when executed by one or more processors of a device, cause the device to implement a network sensor for protecting a server application by performing operations, the operations comprising:

• collecting application layer requests sent by clients to the server application;
• providing, by the network sensor, the application layer requests to a secure server;
• receiving, by the network sensor, one or more stable profile items of a plurality of different profile items of a normal behavior profile (NBP) that was generated by the secure server based at least in part on the provided application layer requests, wherein the NBP characterizes the server application and includes the plurality of different profile items, wherein the one or more stable profile items have been determined, by the secure server, as being sufficiently representative of application behavior to be able to be used for protecting the server application;
• collecting an additional application layer request;
• and
• identifying the additional application layer request as a potential attack based on comparison to the one or more stable profile items of the NBP.

A system comprising:

• a server application implemented by one or more electronic devices;
• and
• a network sensor implemented by the one or more electronic devices to protect the server application, the network sensor to:
• collect application layer requests sent by clients to the server application;
• provide the application layer requests to a secure server;
• receive one or more stable profile items of a plurality of different profile items of a normal behavior profile (NBP) that was generated by the secure server based at least in part on the provided application layer requests, wherein the NBP characterizes the server application and includes the plurality of different profile items, wherein the one or more stable profile items have been determined, by the secure server, as being sufficiently representative of application behavior to be able to be used for protecting the server application;
• collect an additional application layer request;
• and
• identify the additional application layer request as a potential attack based on comparison to the one or more stable profile items of the NBP.