Available online 20 October 2025
Date of publishing to the public. Has been revised since then, last updated 4 days later on 24 October 2025.
31 Matching Annotations
- Last 7 days
-
www.sciencedirect.com www.sciencedirect.com
-
-
While APIs enhance functionality and simplify development, they also introduce new risks where each exposed API, if misconfigured or unprotected, can act as an entry point which can provide attackers with unauthorized access (D´ıaz-Rojas et al., 2021).
In cybersecurity, there are entry points and end points. End points are mostly the devices we use to access the applications, whereas entry points are specific paths used to access the applications internally (such as the APIs). Also includes third person wording, but the article overall includes many examples of first and third person writing, making it a mix of both.
-
we discuss the studies
First person (we)
-
An empirical study on the evaluation and enhancement of OWASP CRS (Core Rule Set) in ModSecurity
Title, includes the key words and main idea of the article: A critical research study on OWASP CRS in ModSecurity.
-
Attackers use evasion techniques to evade Web Application Firewalls (WAFs) using techniques like case manipulation, URL encoding, keyword filter evasion, buffer overflow, and payload obfuscation.
Active voice (describes the attackers who use certain techniques to evade the applications being used within the research).
-
A controlled testbed environment was created utilising vulnerable online apps.
Passive voice (explains the creation of the experiment)
-
This research focuses on evaluating and improving the detection capability of OWASP CRS integrated with the ModSecurity.
Active voice example (also states the basis of this research is to criticize and improve the OWASP CRS with ModSecurity).
-
ModSecurity Web Application Firewall was installed in conjunction with the OWASP CRS.
Passive voice (and explains the "working together" of ModSecurity and OWASP CRS for the sake of the research).
-
The paranoia level specifies the amount of rules activated, where every higher level encompasses rules from its lower levels. This progressive structure allows configuring the WAF based on the security needs required (OWASP CRS Team 2025).
Paranoia levels allow CRS strictness to decrease or increase based on application risk tolerance, a necessary process for anomaly scoring and operating through the CRS altogether, as it configures the security intensity.
-
This technique greatly eliminates false positives based on the cumulative score and not a single rule, hence lowering the false positives and keeping security and usability well balanced (OWASP CRS Team 2025).
An extremely important part of CRS mechanisms is "anomaly scoring," which provides balance between accessibility and usability versus security with false positives in the system.
-
The OWASP CRS follows a negative security model, where known malicious patterns are used to identify and block potentially harmful requests.
The fundamental detection used by the OWASP CRS, providing background information for the reader to better understand the article. Perhaps the authors are members of the community, wishing to perform under the same guidelines in terms of making things easy for someone like me to understand.
-
OWASP is an open community that works towards providing guidelines and suggestions on best security practices,
Defines the discourse community of OWASP, and why I view them as a primary community I wish to be a part of.
-
Background
Background of most of the Key Words - WAF, ModSecurity, and OWASP CRS, foundations of the research prior to this section.
-
in our research we utilised the latest available CRS version - CRS 4 to identify potential gaps in the upgraded rule set.
The latest version of the CRS used for their research, providing contribution to the OWASP as well.
-
The research indicates that no WAF model is completely successful and that attackers continually adapt their strategies.
Returning to what I said earlier, despite drastically increasing the protection provided by these applications, none of the models are 100% threat-proof, which emphasizes the need for continued testing to further increase the odds, despite never reaching 100%.
-
The efficacy of Modsecurity depends on the regular upgrading of its rule sets to accommodate evolving SQLI techniques.
Ties back to the updating of the rules, and the necessity, as a basis for running these applications.
-
Our method explores paranoia levels and anomaly scores comprehensively to optimize the performance of the WAF, while this article focuses on the integration of SIEM and the implementation of WordPress plugins.
Explaining the shift from their previous research to new explanations on related, yet different gathered research.
-
Related work
Related to the main topics of the article, but somewhat off topic, as well as more complex.
-
Since these bypasses are weaknesses in the current rule set, the discovery of these evaded payloads was prioritized because they had a strong potential to exploit real-world attacks. In the analysis of bypass patterns, we implemented new security rules to counter attack patterns that bypassed default detection techniques.
Related to the updating of the CRS as stated previously.
-
The OWASP CRS may continue to be a potent defense against complex web threats by regularly analyzing the bypass attempts and enhancing the rule coverage.
Every year the OWASP CRS is updated based on these analysis, just as their OWASP Top 10 is. The community is ever-advancing to stay up to date on the latest cyber threats, making it a prime place to learn and understand how to counter-act these attacks.
-
CRS does not perform extra decoding by default, as these cases are uncommon in typical applications and the rules are designed to remain generic.
The CRS has limitations in security, meaning it does not cover extreme situations and despite the research showing it increases the protection on websites, it does not solve every single problem presented by hackers.
-
The remainder of this paper is structured as follows
Highlights the remainder of the paper, which is related work to the ModSecurity and OWASP CRS applications for the WAFs, as well as other relations to the security rules presented by the CRS, as well as results, discussions, and summaries.
-
Modsecurity’s greatest strength is that it can be integrated with the OWASP CRS
Introduction of ModSecurity and OWASP CRS (Core Rule Set), a big part of my discourse community.
-
KeywordsWeb Application Firewall (WAF)ModSecurityOWASP CRS (Core Rule Set)WAF EvaluationWAF Rule Enhancement
Important key words of the article, makes it easier to look out for these as the key components of their research.
-
This is where WAFs come into play to mitigate both types of vulnerabilities, minimizing the risk of security incidents.
Heavy emphasis on WAFs for fixing the gaps within the vulnerabilities and minimizing risks.
-
Web application firewalls (Razzaq et al., 2013) have emerged as a key component in preventing modern web attacks.
WAFs (Web Application Firewalls) are what the article has led up to as the "answer" to the growing problems of complexity within cybersecurity.
-
Anuvarshini MK, Kommuri Sai Suhitha Bala, Sri Sai Tanvi Sonti, Jevitha KP
Collaborative article.
-
Abstract
Essentially a summary of the article, and the research methods used and data gathered.
-
But with convenience comes risk; every time we use an online service, we share a piece of information such as our details, conversations, financial information, etc. If not properly protected, this information can be misused, causing security issues (A¨ımeur, 2014).
The reason cybersecurity is needed, and why I want to pursue it. I enjoy the idea of making the digital world safer in the future, and the article higlights the risks that come with transitioning to appplications.
-
The implemented custom rules, which were developed in accordance with the gaps identified during the test, improved the detection precision from 60.54% to 97.46 % with no increase in false positives within our controlled test environment, thereby incrementally strengthening the security of the rule set by detecting threats that had previously escaped notice.
Tests overall show that the CRS (Core Rule Set) implemented by OWASP increased the detection precision with the ModSecurity web application firewall by an astronomical amount, from 60% to 97%.
-
This research evaluates the effectiveness of the popular open-source OWASP CRS (Core Rule Set) with the ModSecurity web application firewall.
The central idea of the article and what I find interesting about it. My discourse community for OWASP (Open Web Application Security Project) is centralized around helping those in the community of cybersecurity, meaning they are always under criticism and analysis for truthful information.
-