scholarly journals A Combined Two Step Approach for Detecting Input Validation Attacks Against Web Applications

2013 ◽  
pp. 243-249
Author(s):  
M. Kishore ◽  
B. Srinivas ◽  
Jayadev Gyani
Keyword(s):  
Web Application ◽  
Web Applications ◽  
Detection System ◽  
False Positive Rate ◽  
Malicious Code ◽  
Divide And Conquer ◽  
The Internet ◽  
Unrestricted Access ◽  
Access To Data ◽  
Input Validation

Internet becomes a part of our daily life. Almost very service by the internet will be provided with the help of web applications with these we can say that without the web application we cannot do anything over the internet but at the same time web applications are mostly targeted by the hackers. In this paper we present an efficient intrusion detection system approach for detecting input validation attacks against web application. Web application attacks gives chance to the attacker to get unrestricted access to data base and web servers. In this approach we have proposed a two step approach to detect input validation attacks against web applications. By using our approach we can prevent input validation attacks against web applications very efficiently. In the first step we have used a honey pot system to find any malicious data is present or not. In the second step we have used efficient intrusion mechanism to identify the attacks that was not identified in the first step. In this we used an efficient Hirschberg algorithm this is a divide and conquer approach to find attacks against web applications. This system analyzes malicious code and immediately generates an alert to protect web applications from the attacker. By using this technique we can reduce the analysis time and false positive rate.

scholarly journals Malware Detection Based on Code Visualization and Two-Level Classification

Information ◽  
2021 ◽  
Vol 12 (3) ◽  
pp. 118
Author(s):  
Vassilios Moussas ◽  
Antonios Andreatos
Keyword(s):  
Web Applications ◽  
Detection System ◽  
Malware Detection ◽  
Image Features ◽  
Malicious Code ◽  
Malware Analysis ◽  
Malicious Software ◽  
Antivirus Software ◽  
Malware Classification ◽  
Artificial Neural Network Ann

Malware creators generate new malicious software samples by making minor changes in previously generated code, in order to reuse malicious code, as well as to go unnoticed from signature-based antivirus software. As a result, various families of variations of the same initial code exist today. Visualization of compiled executables for malware analysis has been proposed several years ago. Visualization can greatly assist malware classification and requires neither disassembly nor code execution. Moreover, new variations of known malware families are instantly detected, in contrast to traditional signature-based antivirus software. This paper addresses the problem of identifying variations of existing malware visualized as images. A new malware detection system based on a two-level Artificial Neural Network (ANN) is proposed. The classification is based on file and image features. The proposed system is tested on the ‘Malimg’ dataset consisting of the visual representation of well-known malware families. From this set some important image features are extracted. Based on these features, the ANN is trained. Then, this ANN is used to detect and classify other samples of the dataset. Malware families creating a confusion are classified by a second level of ANNs. The proposed two-level ANN method excels in simplicity, accuracy, and speed; it is easy to implement and fast to run, thus it can be applied to antivirus software, smart firewalls, web applications, etc.

Using response action with intelligent intrusion detection and prevention system against web application malware

2014 ◽  
Vol 22 (5) ◽  
pp. 431-449 ◽  
Author(s):  
Ammar Alazab ◽  
Michael Hobbs ◽  
Jemal Abawajy ◽  
Ansam Khraisat ◽  
Mamoun Alazab
Keyword(s):  
Intrusion Detection ◽  
Intrusion Detection System ◽  
Web Application ◽  
Web Applications ◽  
Detection Efficiency ◽  
Detection System ◽  
Content Type ◽  
Novel Approach ◽  
Prevention System ◽  
Intrusion Detection And Prevention

Purpose – The purpose of this paper is to mitigate vulnerabilities in web applications, security detection and prevention are the most important mechanisms for security. However, most existing research focuses on how to prevent an attack at the web application layer, with less work dedicated to setting up a response action if a possible attack happened. Design/methodology/approach – A combination of a Signature-based Intrusion Detection System (SIDS) and an Anomaly-based Intrusion Detection System (AIDS), namely, the Intelligent Intrusion Detection and Prevention System (IIDPS). Findings – After evaluating the new system, a better result was generated in line with detection efficiency and the false alarm rate. This demonstrates the value of direct response action in an intrusion detection system. Research limitations/implications – Data limitation. Originality/value – The contributions of this paper are to first address the problem of web application vulnerabilities. Second, to propose a combination of an SIDS and an AIDS, namely, the IIDPS. Third, this paper presents a novel approach by connecting the IIDPS with a response action using fuzzy logic. Fourth, use the risk assessment to determine an appropriate response action against each attack event. Combining the system provides a better performance for the Intrusion Detection System, and makes the detection and prevention more effective.

scholarly journals An Invariant-Based Approach for Detecting Attacks Against Data in Web Applications

2014 ◽  
Vol 5 (1) ◽  
pp. 19-38
Author(s):  
Romaric Ludinard ◽  
Éric Totel ◽  
Frédéric Tronel ◽  
Vincent Nicomette ◽  
Mohamed Kaâniche ◽  
...  
Keyword(s):  
Intrusion Detection ◽  
Intrusion Detection System ◽  
Web Application ◽  
Web Applications ◽  
Detection System ◽  
Source Code ◽  
Web Attacks ◽  
Application Profile ◽  
The Web ◽  
Ruby On Rails

RRABIDS (Ruby on Rails Anomaly Based Intrusion Detection System) is an application level intrusion detection system (IDS) for applications implemented with the Ruby on Rails framework. The goal of this intrusion detection system is to detect attacks against data in the context of web applications. This anomaly based IDS focuses on the modelling of the normal application profile using invariants. These invariants are discovered during a learning phase. Then, they are used to instrument the web application at source code level, so that a deviation from the normal profile can be detected at run-time. This paper illustrates on simple examples how the approach detects well-known categories of web attacks that involve a state violation of the application, such as SQL injections. Finally, an assessment phase is performed to evaluate the accuracy of the detection provided by the proposed approach.

scholarly journals Analysis of SQL Injection Attack

2013 ◽  
pp. 260-264
Author(s):  
Jayeeta Majumder ◽  
Gargi Saha
Keyword(s):  
Web Applications ◽  
Sensitive Information ◽  
Security Model ◽  
Security Threat ◽  
Sql Injection ◽  
Stored Procedure ◽  
Injection Attacks ◽  
Unrestricted Access ◽  
Sql Injection Attacks ◽  
Input Validation

SQL injection attacks are a serious security threat to Web applications. They allow attackers to obtain unrestricted access to the databases underlying the applications and to the potentially sensitive information these database contain. Various researchers and practitioners have proposed various methods to address the SQL injection problem. To address this problem, we present an extensive review of the various types of SQL injection attacks known to date. For each type of attack, we provide descriptions and examples of how attacks of that type could be performed. We also present a methodology to prevent SQL injection attacks. It concentrates on the SQL queries and SQL stored procedure where input parameters are injected by the attacker. After a rigorous input validation with our proposed SQL security model will ensure input validation.

scholarly journals Failure Detection Algorithm for Testing Dynamic Web Applications

2017 ◽  
pp. 37-41
Author(s):  
J. Vijaya Sagar Reddy ◽  
G. Ramesh
Keyword(s):  
Web Sites ◽  
Experimental Evaluation ◽  
Web Application ◽  
Web Applications ◽  
Failure Detection ◽  
Detection Algorithm ◽  
The Internet ◽  
Test Cases ◽  
Dynamic Web ◽  
The Web

Web applications are the most widely used software in the internet. When a web application is developed and deployed in the real environment, It is very severe if any bug found by the attacker or the customer or the owner of the web application. It is the very important to do the proper pre-analysis testing before the release. It is very costly thing if the proper testing of web application is not done at the development location and any bug found at the customer location. For web application testing the existing systems such as DART, Cute and EXE are available. These tools generate test cases by executing the web application on concrete user inputs. These tools are best suitable for testing static web sites and are not suitable for dynamic web applications. The existing systems needs user inputs for generating the test cases. It is most difficult thing for the human being to provide dynamic inputs for all the possible cases. This paper presents algorithms and implementation, and an experimental evaluation that revealed HTML Failures, Execution Failures, Includes in PHP Web applications.

scholarly journals Possibilities of using ICT for increase of customer feeling of exceptionality

2011 ◽  
Vol 59 (2) ◽  
pp. 365-370
Author(s):  
Pavel Turčínek ◽  
Arnošt Motyčka
Keyword(s):  
Web Application ◽  
Web Applications ◽  
Product Line ◽  
Point Of View ◽  
The Internet ◽  
Online Information ◽  
Aggregated Data ◽  
Marketing Activities ◽  
Interaction Web

Accession of the Internet undoubtedly has contributed to the shift of marketing activities. With the increasing availability and wealth of online information customers become more knowledgeable and sophisticated. If a company wants to keep its customers in long term, it must offer something more than an “ordinary” product, which has comparable substitutes in tens of other companies.At first it is necessary to identify customers behavior and thinking. Observation of his/her preferences of a demanded product line discovers products playing the key role from his/her point of view. We use methodical tools for this purpose e.g. CRM systems, Business Intelligence etc. Over gained metrics from data in data warehouses (observation subsystem) we make evaluations according to various criteria (subsystem of evaluation). In this report we methodically open up not just e.g. data mining technologies, but also based on aggregated data we infer e.g. consumer’s trends.The goal of the article is to point out suitable instruments which enable to create interaction with customers, where they’ll be able to participate in creation products of their own. The Internet seems as a perfect communication channel for this interaction. Web application will consist of solution of an observation subsystem as a database application and of evaluation subsystem as the application of a row of methods e.g. multicriteria evaluation. Web applications feedback effect leads into knowledge of selected customer’s characteristics, which enables to offer him/her among others a special line of standard products.By creating a disposable web application it’s possible e.g. to offer customers absolutely common products with different visual angle. Thanks to gained information and knowledge we divide customers into groups and then target on them specifically.

Developing Security Enabled Applications for Web Commerce

2018 ◽  
pp. 384-396
Author(s):  
Kannan Balasubramanian
Keyword(s):  
Web Application ◽  
Web Applications ◽  
Local Area Network ◽  
Local Area ◽  
Web Security ◽  
The Internet ◽  
Area Network ◽  
Web Application Security ◽  
Public Network ◽  
Internal Networks

As more and more applications find their way to the World Wide Web, security concerns have increased. Web applications are by nature somewhat public and therefore vulnerable to attack. Today it is the norm to visit Web sites where logins and passwords are required to navigate from one section of the site to another. This is much more so required in a Web application where data is being manipulated between secure internal networks and the Internet. Web applications, no matter what their functions are, should not exchange data over the Internet unless it is encrypted or at least digitally signed. Security should be extended to the private-public network borders to provide the same authentication, access control, and accounting services that local area network (LAN) based applications employ. The most widely used method of Web application security today is Private Key Infrastructure (PKI). Various examples of PKI implementations are examined.

Addressing the Credibility of Web Applications

2008 ◽  
pp. 23-28 ◽  
Author(s):  
Pankaj Kamthan
Keyword(s):  
Web Application ◽  
Web Applications ◽  
Consumer Confidence ◽  
Future Research ◽  
The Internet ◽  
Different Types ◽  
Set Up ◽  
The Web

The Internet, particularly the Web, has opened new vistas for businesses. The ability that anyone, using (virtually) any device could be reached anytime and anywhere presents a tremendous commercial prospective. In retrospect, the fact that almost anyone can set up a Web Application claiming to offer products and services raises the question of credibility from a consumers’ viewpoint. If not addressed, there is a potential for lost consumer confidence, thus significantly reducing the advantages and opportunities the Web as a medium offers. Establishing credibility is essential for an organization’s reputation (Gibson, 2002) and for building consumers’ trust (Kamthan, 1999). The rest of the article is organized as follows. We first provide the motivational background necessary for later discussion. This is followed by the introduction of a framework within which different types of credibility in the context of Web Applications can be systematically addressed and thereby improved. Next, challenges and directions for future research are outlined. Finally, concluding remarks are given.

scholarly journals Detecting Cross-Site Scripting in Web Applications Using Fuzzy Inference System

2018 ◽  
Vol 2018 ◽  
pp. 1-10 ◽  
Author(s):  
Bakare K. Ayeni ◽  
Junaidu B. Sahalu ◽  
Kolawole R. Adeyanju
Keyword(s):  
Web Application ◽  
Web Applications ◽  
Fuzzy Inference ◽  
False Positive Rate ◽  
Data Access ◽  
Web Security ◽  
Web Application Security ◽  
Inference System ◽  
Positive Rate ◽  
Cross Site

With improvement in computing and technological advancements, web-based applications are now ubiquitous on the Internet. However, these web applications are becoming prone to vulnerabilities which have led to theft of confidential information, data loss, and denial of data access in the course of information transmission. Cross-site scripting (XSS) is a form of web security attack which involves the injection of malicious codes into web applications from untrusted sources. Interestingly, recent research studies on the web application security centre focus on attack prevention and mechanisms for secure coding; recent methods for those attacks do not only generate high false positives but also have little considerations for the users who oftentimes are the victims of malicious attacks. Motivated by this problem, this paper describes an “intelligent” tool for detecting cross-site scripting flaws in web applications. This paper describes the method implemented based on fuzzy logic to detect classic XSS weaknesses and to provide some results on experimentations. Our detection framework recorded 15% improvement in accuracy and 0.01% reduction in the false-positive rate which is considerably lower than that found in the existing work by Koli et al. Our approach also serves as a decision-making tool for the users.

Sign in / Sign up

Export Citation Format

Share Document