Optimal Management Policies for a Server System with Web Application Firewall

Cyber attacks on the Internet have been becoming more sophisticated, complicated and diversified in recent years. In terms of this problem, a single security measure is not enough, and it is effective to combine multiple security measures. To prevent the sever from cyber attacks due to web application vulnerabilities, WAF (Web Application Firewall) has been widely used. It can detect attacks where IDS (Intrusion Detection System) can not detect them. This paper formulates five stochastic models for a server system which has the function of IDS and WAF considering multiple attacks, non-linear parameter and random checking. Cyber attacks due to unauthorized access are detected by IDS, and cyber attacks due to web application vulnerabilities are detected by WAF. The total expected costs until cyber attacks are detected are derived and optimal policies which minimize them are discussed. Finally, numerical examples are given.