Web Application Firewall(WAF)

Most security breaches happen on the web.
To defend against web attacks, a dedicated web firewall system is required.
AIWAF strongly defends various web attacks.
Web security is no longer optional. It's essential.

Now, protect web applications with AIWAF.
The web is vulnerable. Because the HTTP/HTTPS ports must always be open to show the Web to clients, various attacks can be introduced through them. MONITORAPP's web application firewall, AIWAF is specialized for traffic-based detection of hacking attempts using vulnerabilities in the Web and for controlling access to servers. Web attacks are evolving every day, causing malicious traffic or falsifying request information. Only WAF that does not stop ongoing development to respond to new types of web attacks can do the right thing. The answer is AIWAF in MONITORAPP.
How WAF works
Defends fully any attack through the web.
The AIWAF of MONITORAPP can defend against any attack through the web, from DDoS attacks to OWASP 10 vulnerabilities, to NIS 8 vulnerabilities SQL injection / XSS attacks, to web shell attacks. Because MONITORAPP has the best technologies for protecting web applications. Adaptive profiling technology is a self-learning provisioning technology that enables the creation and application of automated WEB security policies. Self-learning profiling implements profile DB based on the normal request/response of the web server and blocks abnormal requests from sources to minimize false or false information. So here's one of the threat intelligence platform based on machine learning, AICC (application insight cloud center) dictionary by sharing real-time threat intelligence collection, analysis server has to work with.: This allows you to detect threats in advance and preemptively defend the unknown Attack. Enhanced security with bot detection, CAPTCHA authentication and blacklist DB, bypass access IP detection, multi-encoded attack detection, DBMS error detection, and HTTPS traffic handling.
How WAF works
Typical web attacks being defended by AIWAF
- Malware Infection Detection
- SQL Injection
- Vulnerable Page Access
- Buffer-Overflow
- Malicious File Access
- Scanner/Proxy/Spambot Detection
- Encoding
- Upload Malicious File Access
- Command Injection
- Cookies falsified
- Header Vulnerability
- File system Access
- Web Server/Application Vulnerability
- Worm/Virus
- Directory Access
AIWAF description
Enjoy the best performance without slowing down your web services
AIWAF's transparent proxy technology is implemented as a proxy type without changing the existing network configuration. High-performance packet processing and load balancing algorithms maximize the performance of high-capacity traffic. It has SSL traffic handling, but it automatically scans non HTTP traffic, bypasses, and accelerates through Web caching to ensure maximum performance without sacrificing speed. Fail-open and fail-over features for non-disruptive delivery of Web services, and automatic by-pass function ensure web service availability in the event of a web service failure due to performance limits.
coding screen on a laptop ▲ AIWAF function process flow
Provides intuitive UI and detailed dashboards.
AIWAF UI is designed to be intuitive and easy to manage for security personnel. User satisfaction is maximized with a convenient interface, intuitive controls, visible reports of attacks and traffic, and monitoring of web server service health.
More convenient.
Multi-domain management allows multiple security officers to create independent and different security policies for their assigned domains. Setting security policies and contents related to system operation, such as dashboards and reports, are also provided independently.
Over 14 years focusing on WAF
AIWAF has already been recognized for its performance as it has been supplied to more than 4,000 public institutions and financial institutions at home and abroad. BMT has proven performance that surpasses domestic and foreign competitors, and it is being supplied to the first financial group, the virtual currency exchange, and large public institutions to expand its global customer base.
picture of a glass skyscraper
AIWAF Brochure
Blocking Vulnerability Attacks
+ Attack defense Against major security vulnerabilities such as OWASP TOP 10
- SQL injection
- Cookie forgery
- Malicious file upload / access
- Command injection
- Directory access
- Default page access
- System file access
- Web server / Application vulnerability
+ Block through analysis of request queries and payloads
- Header / vulnerability
- Scanner / Proxy / Spambot
Applied IP/Server and exception IP/Server URL setting
Block page for each detailed policy
Abnormal Request/Response based blocking
Abnormal request and response based blocking
+ Logging of response data for efficient log analysis
- HTTP abnormal request
- HTTP method restrictions
- Characters set limit
- Buffer overflow
- Unverified redirect
- URL extension access control
- Hidden filed tempering
- HoneyPot URL
Apply response based automatic learning and automatic policy
Server/Data Protection
+ Key security policies for server data protection
- Personal information inflow/ outflow
- Page forgery
- Header clocking
- Error page clocking (DBMS error detection)
- Directory Listing
User-defined Detection
Additional security settings for users
+ In addition to the existing security policies, additional pattern and access control settings
- URL access rules
- Keyword filtering rules
- User defined apttern rules
Verify for duplicates with registered policies
Provides Self Inspection on which policies of the currently set security rules are detected for test target request/response traffic
Configure IP White List, IP Black List
DoS Blocking
Detect and block TCP Session limit, Slow DoS attack
Threshold-based security policy
Forced browsing, HTTP request flooding, click fraud, login fraud, attacker IP auto-detection attempts inflow more than threshold, the source IP will be added to blacklist and detect or block within configured time
Intuitive Monitoring/Auditing/Reporting
+ Critical system health monitoring
- System monitoring
- Web server status
- Detection log
- Attacker IP, country, number of detections
- CPS / TPS traffic monitoring
+ Analysis and views on key policy violation logs
- Log storage period, simple log search by detection type
- Lookup by Detection Type, Client, IP, URL
- View detailed log
+ Various reports on attack and traffic
- Web application firewalls, web traffic, system information
- Apply various conditions such as detection type, IP, country
- Reporting
Security audit logging function for system management and event status
Scroll Up