Analysis of False Positives in an OWASP-Based Web Application Firewall and their Impact on the Performance and Availability of Open Journal Systems (OJS)

Riki Agus Prastyo (Universitas Nahdlatul Ulama Sidoarjo)
Awang Andhyka (Universitas Nahdlatul Ulama Sidoarjo)
Achmad Mufliq (Universitas Nahdlatul Ulama Sidoarjo)

Jurnal Informatika dan Rekayasa Perangkat Lunak
Vol. 8 No. 1 (2026): Maret

The implementation of a Web Application Firewall (WAF) based on the OWASP Core Rule Set (CRS) aims to enhance web application security; however, improper configuration may lead to false positives that adversely affect system performance and service availability. This study analyzes the impact of WAF false positives on Open Journal Systems (OJS) services deployed in a cloud environment using a server log analysis approach. The data were collected from web server error logs and ModSecurity audit logs that recorded the blocking of legitimate requests during the manuscript submission process due to inbound anomaly scores exceeding predefined security thresholds. The results indicate that WAF false positives caused service failures characterized by HTTP 403 responses, increased submission errors, and a measurable reduction in OJS service availability during the observation period. These findings demonstrate that anomaly-based detection mechanisms in OWASP CRS may misclassify normal application behavior as malicious activity. This study provides empirical evidence based on server logs regarding the impact of WAF false positives on cloud service reliability and offers insights for WAF policy tuning to achieve a balance between security and service availability.