Detecting Malicious Inputs of Web Application Parameters Using Character Class Sequences

Abstract

Web attacks that exploit vulnerabilities of web applications are still major problems. The number of attacks that maliciously manipulate parameters of web applications such as SQL injections and command injections is increasing nowadays. Anomaly detection is effective for detecting these attacks, particularly in the case of unknown attacks. However, existing anomaly detection methods often raise false alarms with normal requests whose parameters differ slightly from those of learning data because they perform strict feature matching between characters appeared as parameter values and those of normal profiles. We propose a novel anomaly detection method using the abstract structure of parameter values as features of normal profiles in this paper. The results of experiments show that our approach reduced the false positive rate more than existing methods with a comparable detection rate. 2

An adaptive system for detecting malicious queries in web attacks

“…Garcia-Teodoro et al [22] represented the normal behaviors of a service by Markov models, aiming to generate HTTP intrusion signatures for Network Intrusion Detection Systems (NIDS). Soon, Zhong et al [23] used Markov models whose inputs are each character of parameter values in normal payloads to build the normal profile. Earlier works, such as HMM-Payl [24], made similar use of Markov models.…”

Antidefacement

“…Existen distintas técnicas, metodologías y sistemas para la detección de ataques que generan defacement en una página web; como técnicas se encuentran el análisis dinámico, estático y la utilización de la inteligencia artificial. Por otra parte, existen diversas metodologías de trabajo en donde se describen las actividades para el análisis de ataques web (Bartoli, Davanzo, & Medvet, 2010;Zhong, Asakura, Takakura, & Oshima, 2015;Roesch, 1999). Adicionalmente, se han propuesto distintas soluciones como por ejemplo: Tripwire (Kim & Spafford, 1994), contenidos de políticas de seguridad (Stamm, Sterne, & Markham, 2010), IPVmon (IPVTec, 2014), StatusCake (Barnes, 2013), Socuri (2016), y Nagios (Aman, Yamashita, Sasaki, & Kawahara, 2014), entre otras.…”

“…There are two approaches to the web applications attacks detection (Zhong et al, 2015): a technique is based on signatures in order to detect attacks from a database that contains several characteristics of the data transmitted from a malicious communication; the other is the technique of anomalies detection, which is composed of two phases: the first one is responsible to build a web page profile using different features extracted of the legimitate HTTP requests, and the second one is responsible to monitor and detect any anomaly into the requests with the profile previously created. Nevertheless, there are different techniques for the analysis on computer security , among these are: buenos resultados en el desarrollo de los axiomas con un mínimo de falsos positivos; y en la fase real PHP-Sensor se detectaron los catorce ataques controlados.…”

“…Existen dos enfoques para la detección de ataques a las aplicaciones web (Zhong et al, 2015): una técnica está basada en firmas, y su objetivo es detectar los ataques a partir de una base de datos que contiene distintas características de los datos transmitidos de una comunicación maliciosa; otras en la detección de anomalías, y está compuesta por dos fases, la primera se encarga de la construcción de un perfil de la página web a partir de distintas características extraídas de las peticiones legítimas HTTP, y la segunda de monitorear y detectar si hay alguna anomalía en las peticiones respecto del perfil creado. Por otra parte, existen distintas técnicas para el análisis en la seguridad de la computación , entre estas se encuentran:…”

“…There are several techniques, methods and systems for detecting attacks which leads for defacement on a website; such as dynamic and static analysis and the use of artificial intelligence. Furthermore, there are different work methodologies which describe the analysis of web attacks (Bartoli, Davanzo, & Medvet, 2010;Zhong, Asakura, Takakura, & Oshima, 2015;Roesch, 1999). In addition, many solutions have been proposed such as: Tripwire (Kim & Spafford, 1994), content security policy (Stamm, Sterne, & Markham, 2010), IPVmon (IPVTec, 2014), StatusCake (Barnes, 2013), Socuri (2016), and Nagios (Aman, Yamashita, Sasaki, & Kawahara, 2014), among others.…”