Practical Approach to Detecting and Preventing Web Application Attacks over HTTP/2

HTTP/2 is a newly ratified protocol that builds upon current web communications to increase efficiency and overcome shortfalls of the HTTP/1 protocol. This new protocol is intended to be used only over TLS connections and as such is the only method supported by the top web browser applications. Because this protocol is relatively new, there is a lack of tools capable of inspecting the protocol to detect or prevent attacks against web applications. The protocol's use of Perfect Forward Secrecy TLS cipher suites further complicates matters by preventing inspecting technologies from capturing the keying material required to decrypt traffic for inspection. This paper provides a little background on the HTTP/2 protocol and TLS connections in conjunction with an evaluation of web browser support. Several architectures will be evaluated as a method to detect and prevent web application attacks over HTTP/2 using currently available tools.