Adding more protection to AVDL?

[Ivan Ristic <ivanr@webkreator.com>]

Hi,

I've been following the work of the AVDL committee for some
time now but never had time to join in. While I won't have
much time to do any serious work for another month or so I
would like to bring to your attention some of the work I've
done for the WAS committee. WAS aims to take care of
vulnerability meta data, detection, and protection. I've
been working on the protection part without being involved
with other parts.

Here is what I have at the moment:

 WAS Protect informal description:
 http://www.modsecurity.org/download/was/wasprotect.txt

 Schema:
 http://www.modsecurity.org/download/was/wasprotect.xsd

 Example:
 http://www.modsecurity.org/download/was/example1.xml

 Proof-of-concept implementation (Java Servlet Filter):
 http://www.modsecurity.org/download/modsecurity-java-m2.zip

Basically I think extending AVDL to export protection
rules (in portable web application firewall rule format)
is a really good idea. Vulnerability scanners can be
equipped with protection rules for known vulnerabilities,
or can design a set of filters on the fly.

Has this already been discussed? (I didn't find anything
in the meeting minutes.) Is this something you want to
see in AVDL at all?

Naturally, I am prepared to put time in to make this work.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]