GMSA: Gathering Multiple Signatures Approach to Defend Against Code Injection Attacks

Abstract

Code injection attacks (CIAs) exploit security vulnerabilities and computer bugs that are caused by processing invalid codes. CIA is a problem which hackers attempt to introduce to any new method, their objective being to bypass the protection system. In this paper, we present a tool called GMSA, developed to detect a variety of CIAs, for example, cross-site scripting (XSS) attack, SQL injection attack, shell injection attack (command injection attack), and file inclusion attack. The latter consists of local file inclusion and remote file inclusion. Our empirical analysis reveals that compared with existing research, gathering multiple signatures approach (GMSA) executes a precision performance (accuracy of the proposed algorithm is 99.45%). The false positive rate (FPR) of GMSA is 0.59%, which is low compared with what other research has reported. The low FPR is the most important factor. Ideally, the defense algorithm should balance between the FPR and true positive rate (TPR) because with existing methodologies, security experts can defend against a broad range of CIAs with uncomplicated security software. Typical protection methods yield a high FPR. Our method results in high TPR while minimizing the resources needed to address the false positive. GMSA can detect four types of CIA. This is more comprehensive than other research techniques that are restricted to only two major types of CIA, namely, SQL injection and XSS attacks.