Beyond Signatures and IP Blocking: A Critical Survey of WAF Evaluation under Source-Path Diversity, Payload Mutation, and Parser Discrepancy

Abstract

Web application firewall research is often organized by the signal available to a decision or enforcement layer: request content, client identity, browser behavior, or traffic history. That organization is useful for isolated experiments, but it leaves open how a WAF should be evaluated when these pressures occur together. A malicious request may arrive through a changing or shared source path, use a different surface form, and pass through parsers that do not agree on its meaning. This survey reviews signature and rule filtering, transport and client fingerprinting, challenge-based enforcement, surface-form machine learning, intent-oriented language models, behavioral linkage, and protocol normalization. It separates direct WAF measurements from adjacent evidence on proxy identification, encrypted-traffic classification, and general intrusion detection, and treats parser discrepancy as a distinct failure mode rather than another payload mutation. The reviewed corpus shows clear one-axis evidence: payload mutation and parser-level differences can change WAF outcomes, while source-path studies show that identity and transport signals can rotate, overlap, or be manipulated. We did not identify a direct focal-WAF experiment that varies source-path conditions and payload realization together while verifying the intended application-level effect. The survey therefore proposes composition-oriented evaluation: vary source-path conditions, payload realization, protocol representation, and request history in a controlled factorial design, and report WAF action separately from application-level effect. This framing makes claims about “intelligent WAFs” testable rather than purely architectural.