Abstract

The escalating sophistication of cyber-attacks such as Distributed Denial-of-Service (DDoS) attacks and application-layer threats highlights the shortcomings of traditional, static-signature-based rule-matching systems like Web Application Firewalls (WAFs). Traditional WAF systems are often poor at identifying new attacks, generate numerous false positives, and offer little support for secure auditing and collaborative threat-intelligence sharing. This fig paper presents a cloud-native security framework called WAF-ML-BC, which combines the power of machine-learning-based attack detection with blockchain-based immutable logging. The framework utilizes a stacked ensemble architecture by integrating several machine-learning models via a meta-learning algorithm to enhance attack classification performance. Events are immutably logged using a permissioned blockchain, while federated threat intelligence helps achieve trusted knowledge sharing between different parties involved. The framework was tested on benchmark datasets of web application attack traffic and cyber-security traffic alongside logs of real web traffic. The experimental results showed that the framework achieved a high overall accuracy, precision, recall, and F1-score of 99.1%, 98.7%, 97.8%, and 98.9%, respectively, compared to individual ML models and traditional WAF rules. False positive rates were reduced from 18.3% to 3.1%, leading to more reliable detections. It meets real-time performance by handling web-traffic within the required thresholds at the median, 95th, and 99th percentile at 12, 31, and 47ms respectively. The logging subsystem handled a throughput of nearly 2,840 transactions per second without adversely impacting the traffic processing path. This paper show that by combining ensemble machine learning with blockchain-based auditing, web application security can be significantly improved.