Shimmer speeds up web firewall checks to fight online attacks
Rethinking Web Application Firewalls
Networking and Internet Architecture
Summary
Websites need protection against certain internet attacks that overwhelm them by sending too many requests at once. Usually, web application firewalls (WAFs) help by watching traffic and blocking harmful requests, but they can slow down website responses a lot. The authors created Shimmer, a faster kind of WAF that compiles its rules to run more efficiently and skips unnecessary checks. This makes it possible to keep websites safe from attacks while making them work faster than before.
What this means in practice
- •For network operators: Deploy Shimmer to defend web services from application-layer denial-of-service attacks with much less added delay.
- •For cloud service providers: Integrate Shimmer to offer customers faster and more cost-effective protection for web applications against harmful traffic.$Commercial implications: Enables selling improved WAF-based security solutions with higher throughput and lower latency for web hosting clients.
Authors
Laurin Brandner, Laurent Vanbever
Abstract
In recent years, the threat of application-layer (L7) distributed denial-of-service (DDoS) attacks is ever increasing. To defend against them, network operators deploy web application firewalls (WAFs). WAFs are stateful scoring systems which are configured with a rule set that specifies what malicious traffic looks like, and how to handle it. While effective, WAFs are expensive and can increase the request latency of realistic applications by up to $4\times$. This paper introduces Shimmer, a highly optimized WAF. Shimmer JIT-compiles the rule set and applies advanced optimizations to avoid unnecessary work in the scoring pipeline.