Methods and Systems for Using Self-learning Techniques to Protect a Web Application

A system, comprising:

• a web application server;
• a honeypot component;
• a sandboxed detonator component;
• and
• a Web Application Firewall (WAF) component,
• wherein two or more of the honeypot component, the sandboxed detonator component, and the WAF component are configured to perform operations comprising:
• analyzing a usage of a web application by a client device;
• generating analysis results by analyzing the received service request message or a server response message sent by the web application server;
• using the generated analysis results to identify non-benign web application usage;
• and
• protecting the web application server from the non-benign web application usage.

A computing device, comprising:

• means for analyzing a usage of a web application by a client device;
• means for generating analysis results by analyzing the received service request message or a server response message sent by a web application server;
• means for using the generated analysis results to identify non-benign web application usage;
• and
• means for protecting the web application server from the non-benign web application usage.

A non-transitory processor-readable medium having stored thereon processor-executable instructions configured to cause a processor of a computing device to perform operations comprising:

• analyzing a usage of a web application by a client device;
• generating analysis results by analyzing the received service request message or a server response message sent by a web application server;
• using the generated analysis results to identify non-benign web application usage;
• and
• protecting the web application server from the non-benign web application usage.