Web application attack detection and forensics: A survey

Babiker, Mohammed; Karaarslan, Enis; Hoşcan, Yaşar

doi:10.1109/isdfs.2018.8355378

Cited by 21 publications

(7 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Authors in [127] presented a forensic model to investigate web activity, where the disk and live memory images are acquired to access web activity and search engine records. Later, a sort match or statistical analysis is performed to establish a correlation with a specific crime as discussed in [128], [129], [130]. These activities can critically represent human behavior.…”

Section: ) Web Forensicsmentioning

confidence: 99%

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

et al. 2022

View full text Add to dashboard Cite

With the alarmingly increasing rate of cybercrimes worldwide, there is a dire need to combat cybercrimes timely and effectively. Cyberattacks on computing machines leave certain artifacts on target device storage that can reveal the identity and behavior of cyber-criminals if processed and analyzed intelligently. Forensic agencies and law enforcement departments use several digital forensic toolkits, both commercial and open-source, to examine digital evidence. The proposed research survey focuses on identifying the current state-of-the-art digital forensics concepts in existing research, sheds light on research gaps, presents a detailed introduction of different computer forensic domains and forensic toolkits used for computer forensics in the current era. The proposed survey also presents a comparative analysis based on the tool's characteristics to facilitate investigators in tool selection during the forensics process. Finally, the proposed survey identifies and derives current challenges and future research directions in computer forensics.

show abstract

Section: ) Web Forensicsmentioning

confidence: 99%

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

et al. 2022

View full text Add to dashboard Cite

show abstract

“…Article [11] is the only one in the list found to follow a systematic review approach, it discusses the implementation of deep learning in network IDS, and does not focus on web related intrusion detection methods. Articles [12], [13], [14] are dedicated for web intrusion detection however they are neither discussing the implementation of deep learning methods, nor following a systematic approach.…”

Section: Building Interpretable and Explainable Model 1 Contributionmentioning

confidence: 99%

Deep Learning Methods in Web Intrusion Detection: A Systematic Review

Halim

Kholief

Maghraby

2022

Preprint

View full text Add to dashboard Cite

Web application and services are essential part of the internet. They automate many people activities such as purchasing goods, communica- tion, socialization, and political voting. Those applications are usually written and developed by programmers who might not be fully aware of cybersecurity aspects which leaves the applications vulnerable to web application attacks. The best way to mitigate such risks is to write secure code any add multi- ple security layers in the application architecture to ensure security in-depth, however, this comes with great cost and write perfectly secured source code is near to impossible. This is why researchers and engineers invented more exter- nal systems to help in protecting web applications and services, e.g., intrusion detection systems, firewalls, anti-fraud systems. Despite the improvements such systems add to the application security stack, however more challenges came to the surface, ignoring these challenges might risk the entire setup and leave the environment in worse state (e.g., bad implementation of intrusion detection system can cause high false positive rates resulting in blocking users from executing transactions). As the problem of intrusion detection is related to analysis of previous HTTP log to know discriminate normal traffic from malicious, machine and deep learning are playing profound role in solving many of intrusion detection problems. In this survey article we provide systematic review of the recent develop- ments of applying deep learning methods in Web Intrusion Detection Systems (WIDS). The article starts by introduction of intrusion detection in both network and web environments and the difference between Anomaly based and signature based methods. Then we highlight the contribution, review meth- ods, and search strategy are discussed in follower sections. Then the reviewing selected papers and comparing their methods are introduced. Finally, the ar- ticle conclude with discussion section highlighting the future trends of WIDS research.

show abstract

“…As for dynamic detection methods, the most representative is a type of detection technology based on honeypot. [8][9][10] They usually run on the virtual environment and perform real-time detection of web pages. But a large overhead in terms of system resources and time cost can be introduced.…”

Section: Introductionmentioning

confidence: 99%

“…But these methods have generally a shortcoming of high false detection rate. As for dynamic detection methods, the most representative is a type of detection technology based on honeypot 8‐10 . They usually run on the virtual environment and perform real‐time detection of web pages.…”

Section: Introductionmentioning

confidence: 99%

An efficient malicious webpage static detection framework based on optimized Bayesian and hybrid machine learning

Yang

Zhu

et al. 2021

Concurrency and Computation

View full text Add to dashboard Cite

Malicious webpage detection is a crucial work in both theory and practical environment. In practical applications, static detection methods are usually regarded as a priority choice, which can quickly detect unknown malicious web pages and avoid a costly in-depth analysis. However, existing solution of static detection typically has the following problems. For example, a single static detection may lead to a higher false positive rate, and the integrated detection usually has a lower detection efficiency. In this article, we propose an efficient webpage static detection framework, especially considering both the detection efficiency and the detection accuracy. Then, on the basis of the extended feature sets from URL, HTML, and JavaScript, we introduce an optimized naive Bayesian algorithm, in which a novel amplification factor strategy is proposed.Finally, a webpage threat assessment model oriented to general machine learning is presented to achieve the refined detection. Three main properties are provided: high detection efficiency, high detection accuracy, and better applicability. Furthermore, the comprehensive experimental results and comparative analysis is given to show the advantages of the proposed framework.

show abstract

Web application attack detection and forensics: A survey

Cited by 21 publications

References 50 publications

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

Deep Learning Methods in Web Intrusion Detection: A Systematic Review

An efficient malicious webpage static detection framework based on optimized Bayesian and hybrid machine learning

Contact Info

Product

Resources

About