Method and system for reducing false positives in web application firewalls

A computer system for analyzing electronic and/or data traffic comprising:

• a non-transitory storage medium for storing computer components;
• and,
• a computerized processor for executing the computer components comprising:
• a module for obtaining at least one feature from normalized data associated with the traffic;
• a module for determining whether the at least one feature has been whitelisted;
• a module for determining whether the normalized data was from a trusted source;
• a module for determining that if the at least one feature was not included on a white list, and the normalized data, from which the at least one feature was obtained, was from a trusted source, determining whether the at least one feature was obtained from a predetermined amount of trusted sources, and similar normalized data;
• and,
• a module for determining that when the predetermined number of trusted sources has been met:
• 1) updating the whitelist to include the features which have met the predetermined number of trusted sources, and 2) indicating that the traffic, including the features from a subsequent and similar normalized data, is allowed to pass to the destination associated with the normalized data.

A computer usable non-transitory storage medium having a computer program embodied thereon for causing a suitably programmed system to analyze electronic and/or data traffic, by performing the following steps when such program is executed on the system, the steps comprising:

• obtaining at least one feature from normalized data associated with the traffic;
• determining whether the at least one feature has been whitelisted;
• determining whether the normalized data was from a trusted source;
• if the at least one feature was not included on a white list, and the normalized data, from which the at least one feature was obtained, was from a trusted source:
• determining whether the at least one feature was obtained from a predetermined amount of trusted sources, and similar normalized data;
• and,
• if the predetermined number of trusted sources has been met:
• 1) updating the whitelist to include the features which have met the predetermined number of trusted sources, and 2) indicating that the traffic, including the features from a subsequent and similar normalized data, is allowed to pass to the destination associated with the normalized data.