A Web application firewall may actively defend a Web application by:
-
Invalidating the application session
-
Intercepting data flowing to and from a Web application
-
Running in a separate process and memory space
-
Learning about the application behavior
An actively defending WAF can take real-time protective action such as invalidating (terminating) a suspicious application session to stop an attack in progress. Simply intercepting traffic flowing to/from the application is a passive, inline monitoring/filtering capability, not itself 'active defense' against a detected threat. Running in a separate process/memory space describes architectural deployment, not a defensive action. Learning application behavior describes a passive profiling/baseline capability (as in anomaly-detection WAFs), not active defense.