Analyze PV with Elk to build an asynchronous WAF

Introduction:

First of all, we should all know the function and principle of WAF, the market is basically using Nginx+lua to do, here is no exception. But slightly different, the logic is not in Lua.

Instead of using Elasticsearch for analysis, LUA only uses the analyzed IP address to block, greatly reducing the direct interruption caused by false positives and other failures.

The architecture diagram is as follows:

You can get the following useful data:

1.pv,uv,ip and other data

2. After the analysis of the IP, the security personnel custom-made regular expression filtering, triggering the security rules to intercept.

3.lua this block only for IP to do matching interception, reduce Web performance consumption

The specific implementation will be explained in a later post

Analyze PV with Elk to build an asynchronous WAF