Abstract: Systems and methods of handling sessions between client devices and one or more server based on session classifications are provided. A device identifies a time series of security metrics corresponding to requests received during a session established by a client device to access a resource provided by one or more servers. The device generates security features from the time series of security metrics based on one or more time windows. The device classifies the session as one of anomalous or genuine using the security features generated from the time series of security metrics based on the one or more time windows. The device handles subsequent requests received during the session based on the classification of the session as the one of anomalous or genuine.

Abstract: A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to extract, from a website vulnerability scanner log, a uniform resource locator (URL) and a vulnerability score and vulnerability classification associated with the URL. The at least one processor is further configured to generate an application vulnerability graph comprising connected nodes that are associated with a field of the URL. The nodes are labeled to indicate the associated field of the URL and color coded based on the vulnerability score. The nodes are also associated with the vulnerability classification. The at least one processor is further configured to enable or disable security protection against a user-selected vulnerability classification of a user-selected node by generating web application firewall security rules and/or web application firewall relaxation rules.

Abstract: Described embodiments provide systems and methods for detecting autonomous programs is provided. A device, intermediary to a plurality of clients and a plurality of servers, can receive a first request from a first client of the plurality of clients to a server of the plurality of servers via a connection between the device and the first client. The device can include, into a response from the server to the first client, a uniform resource locator (URL) comprising one or more randomly generated characters within a predetermined character space. The device can determine that the first client has an autonomous program responsive to receiving a second request from the first client using the URL. The device can terminate, responsive to the determination, the connection to the first client.

Abstract: Described embodiments provide systems and methods performing header protection. A device can receive from a client, a request relating to a first resource, for a second resource. The device can determine, using an identifier for the session, whether an address of the first resource has been previously accessed by the client during the session. The device can verify, using an address of the second resource, whether the address of the second resource is mapped to the address of the first resource for the session between the client and the device. The device can determine whether to provide access to the second resource responsive to the address of the first resource being previously accessed by the client during the session and the address of the second resource being mapped to the address of the first resource for the session.

Abstract: Described embodiments provide systems and methods for generating firewall configuration profiles for firewalls. An intermediary device may modify a request from a client to access the server to include a payload provided by the device. The payload may include an action type selected from a plurality of action types used to probe the server for a corresponding security vulnerability of a plurality of security vulnerabilities. The device may transmit, to the server, the request including the payload to cause the server to provide a response to the device. The device may determine that the server is susceptible to a security vulnerability of the plurality of security vulnerabilities corresponding to the action type based at least on the response. The device may generate a configuration profile for the firewall to restrict requests of the action type to access the server from clients.

Abstract: Described embodiments provide systems and methods for selecting one or more firewall rules to apply to a server based at least on identifying a service of the server. A device intermediary to a plurality of clients and a serve may identify a pattern of a firewall to apply to a response from the server to a request from a client of the plurality of clients. The pattern may be to identify a service configured on the server. The device may determine that the response from the server matches the pattern. The device may identify, responsive to the response matching the pattern, that the service is configured on the server. The device may select, based at least on the service, one or more rules for the firewall to apply to responses from the server.

Abstract: A computer system is provided. The computer system includes a memory, a network interface, and a processor coupled to the memory and the network interface. The processor is configured to receive a response to a request to verify whether an ostensible client of a service is actually a client or a bot, the response including an indicator of whether the ostensible client is a client or a bot; receive information descriptive of interoperations between the ostensible client and the service that are indicative of whether the ostensible client is a client or a bot; and train a plurality of machine learning classifiers using the information and the indicator to generate a next generation of the plurality of machine learning classifiers.

Abstract: Systems and methods of handling sessions between client devices and one or more server based on session classifications are provided. A device identifies a time series of security metrics corresponding to requests received during a session established by a client device to access a resource provided by one or more servers. The device generates security features from the time series of security metrics based on one or more time windows. The device classifies the session as one of anomalous or genuine using the security features generated from the time series of security metrics based on the one or more time windows. The device handles subsequent requests received during the session based on the classification of the session as the one of anomalous or genuine.

Abstract: Described embodiments provide systems and methods for selecting one or more firewall rules to apply to a server based at least on identifying a service of the server. A device intermediary to a plurality of clients and a serve may identify a pattern of a firewall to apply to a response from the server to a request from a client of the plurality of clients. The pattern may be to identify a service configured on the server. The device may determine that the response from the server matches the pattern. The device may identify, responsive to the response matching the pattern, that the service is configured on the server. The device may select, based at least on the service, one or more rules for the firewall to apply to responses from the server.

Abstract: Described embodiments provide systems and methods for generating firewall configuration profiles for firewalls. An intermediary device may modify a request from a client to access the server to include a payload provided by the device. The payload may include an action type selected from a plurality of action types used to probe the server for a corresponding security vulnerability of a plurality of security vulnerabilities. The device may transmit, to the server, the request including the payload to cause the server to provide a response to the device. The device may determine that the server is susceptible to a security vulnerability of the plurality of security vulnerabilities corresponding to the action type based at least on the response. The device may generate a configuration profile for the firewall to restrict requests of the action type to access the server from clients.

Abstract: A system to identify automated submissions of web pages, such as those submitted by bots, in real time. The system comprising a processor configured to update an initial version of a requested web page with at least one hidden field, transmit the updated web page to the client, then, upon receipt parse the completed web page, and identify if a data entry is associated with the at least one hidden field. Where a data entry is associated with the at least one hidden field, the system blocks the transmission of the completed web page to the server. Where a data entry is not associated with the at least one hidden field the system removes the at least one hidden field, and transmits the final web page to the server.

Abstract: Described embodiments provide systems and methods performing header protection. A device can receive from a client, a request relating to a first resource, for a second resource. The device can determine, using an identifier for the session, whether an address of the first resource has been previously accessed by the client during the session. The device can verify, using an address of the second resource, whether the address of the second resource is mapped to the address of the first resource for the session between the client and the device. The device can determine whether to provide access to the second resource responsive to the address of the first resource being previously accessed by the client during the session and the address of the second resource being mapped to the address of the first resource for the session.

Abstract: A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to extract, from a website vulnerability scanner log, a uniform resource locator (URL) and a vulnerability score and vulnerability classification associated with the URL. The at least one processor is further configured to generate an application vulnerability graph comprising connected nodes that are associated with a field of the URL. The nodes are labeled to indicate the associated field of the URL and color coded based on the vulnerability score. The nodes are also associated with the vulnerability classification. The at least one processor is further configured to enable or disable security protection against a user-selected vulnerability classification of a user-selected node by generating web application firewall security rules and/or web application firewall relaxation rules.

Abstract: A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to extract, from a website vulnerability scanner log, a uniform resource locator (URL) and a vulnerability score and vulnerability classification associated with the URL. The at least one processor is further configured to generate an application vulnerability graph comprising connected nodes that are associated with a field of the URL. The nodes are labeled to indicate the associated field of the URL and color coded based on the vulnerability score. The nodes are also associated with the vulnerability classification. The at least one processor is further configured to enable or disable security protection against a user-selected vulnerability classification of a user-selected node by generating web application firewall security rules and/or web application firewall relaxation rules.

Abstract: Described embodiments provide systems and methods performing header protection. A device can receive from a client, a request relating to a first resource, for a second resource. The device can determine, using an identifier for the session, whether an address of the first resource has been previously accessed by the client during the session. The device can verify, using an address of the second resource, whether the address of the second resource is mapped to the address of the first resource for the session between the client and the device. The device can determine whether to provide access to the second resource responsive to the address of the first resource being previously accessed by the client during the session and the address of the second resource being mapped to the address of the first resource for the session.

Abstract: Described embodiments provide systems and methods for learning across multiple application delivery controllers and updating settings across the application delivery controllers. A profile can be generated based on selection of a set of intermediary devices managed by a device. The set of intermediary devices configured to load balance data of an application hosted in different computing environments. Activity can be identified at the intermediary devices with use of a firewall. The activity having an appearance of a malicious attack on at least one intermediary device of the set. The device can determine if the activity is permissible or a violation based on a comparison of an aggregation of data records for the identified activity and a threshold. The device can provide a notification to at least one intermediary device of the set to configure the at least one intermediary device to allow the activity or prevent the activity.

Abstract: Systems and methods for autonomous program management include a device which may transmit data to a client in response to a first request from the client. The data may include a response to the first request and a copy of data available to the device corresponding to the first request or the client. The device may receive a second request including the copy of data from the client. The device may determine that the second request is from an autonomous program rather than a user of the client based on the copy of data from the second request. The device may block at least one subsequent request from the client in response to the determination that the second request is from an autonomous program.

Abstract: Described embodiments provide systems and methods for learning across multiple application delivery controllers and updating settings across the application delivery controllers. A profile can be generated based on selection of a set of intermediary devices managed by a device. The set of intermediary devices configured to load balance data of an application hosted in different computing environments. Activity can be identified at the intermediary devices with use of a firewall. The activity having an appearance of a malicious attack on at least one intermediary device of the set. The device can determine if the activity is permissible or a violation based on a comparison of an aggregation of data records for the identified activity and a threshold. The device can provide a notification to at least one intermediary device of the set to configure the at least one intermediary device to allow the activity or prevent the activity.

Abstract: Described embodiments provide systems and methods performing header protection. A device can receive from a client, a request relating to a first resource, for a second resource. The device can determine, using an identifier for the session, whether an address of the first resource has been previously accessed by the client during the session. The device can verify, using an address of the second resource, whether the address of the second resource is mapped to the address of the first resource for the session between the client and the device. The device can determine whether to provide access to the second resource responsive to the address of the first resource being previously accessed by the client during the session and the address of the second resource being mapped to the address of the first resource for the session.

Abstract: Systems and methods for autonomous program management include a device which may transmit data to a client in response to a first request from the client. The data may include a response to the first request and a copy of data available to the device corresponding to the first request or the client. The device may receive a second request including the copy of data from the client. The device may determine that the second request is from an autonomous program rather than a user of the client based on the copy of data from the second request. The device may block at least one subsequent request from the client in response to the determination that the second request is from an autonomous program.