RDFa Ontology-Based Architecture for String-Based Web Attacks: Testing and Evaluation

Abstract

AbstractString input is an issue for web application security. The problem is that developers often trust string input without checking for validity. Typically, a little attention is paid to it in a web development project, because overenthusiastic validation can tend to break the security upon web applications. In this chapter, security vulnerabilities such as SQL injection has been described and then the merits of a number of common data validation techniques have been discussed. From this analysis, a new data validation service (NDVS) which is based upon semantic web technologies, has been implemented to prevent the web security vulnerabilities and then to secure a web system even if the validation modules are bypassed. Such semantic architecture comprises of the following components: RDFa annotation for elements of web pages, interceptor, RDF extractor, RDF parser, and data validator. We carried out two experiments to address the security and the performance objectives. The results have shown that the developed service can provide a high coverage of detection and recovery and a low level of overhead times.KeywordsStringweb application securitydata validationsecurity vulnerabilitiesSQL injectionsemantic web technologies