Application-level Attacks Research Articles

Quantitative impact analysis of application-level attacks on a robotic platform

Quantitative impact analysis of application-level attacks on a robotic platform

Quantitative Impact Analysis of Application-level Attacks on a Robotic Platform

Quantitative Impact Analysis of Application-level Attacks on a Robotic Platform

Conceptual Framework to Mitigate Internet of Things-DDoS Attacks Using Fog Nodes

Internet of Things has proven to maximize workflow and data sensing capabilities. Contrarily, Distributed Denial of Service attacks that employ compromised Internet of Things devices have caused considerable damage to the Information Technology infrastructure since their advent. More specifically, Application-level attacks facilitated using affected Internet of Things devices are found to be difficult to detect and defend against. Seemingly benign traffic from infected devices exits the network edge to target a remote server. The conceptual framework described in this paper attempts to mitigate malicious Internet of Things traffic at the source network. Fog nodes at the source Autonomous System are utilized in tandem with a ratiometric that flags traffic as well as the originating device as suspicious or benign based on traffic ratios calculated in real-time. Subsequently, malicious traffic is blocked inside the Autonomous System. The burden of protecting the external network from Distributed Denial of Service attacks is transferred to Fog nodes inherent to every source network. The proposed conceptual defense framework is proactive and performs in real-time attack scenarios.

Detecting Flooding Attacks in Communication Protocol of Industrial Control Systems

Industrial Control Systems (ICS) are normally using for monitoring and controlling various process plants like Oil & Gas refineries, Nuclear reactors, Power generation and transmission, various chemical plants etc., in the world. MODBUS is the most widely used communication protocol in these ICS systems, which is using for bi-directional data transfer of sensor data between data acquisition servers and Intelligent Electronic Devices (IED) like Programmable Logic Controllers (PLC) or Remote Telemetry Unit (RTU). The security of ICS systems is a major concern in safe and secure operations of these plants. This Modbus protocol is more vulnerable to cyber security attacks because security measures were not considered in mind at the time of protocol design. Denial-of-Service (DoS) attack or flooding attack is one of the prominent attacks for MODBUS, which affects the availability of the control system. In this paper, a new method was proposed, to detect user application-level flooding or DoS attacks and triggers alarm annunciator and displays suitable alarms in Supervisory Control and Data Acquisition system (SCADA) to draw the attention of administrators or engineers to take corrective action. This method detected highest percentage of attacks with less time compared to other methods. This method also considered all types of conditions, which triggers flooding attack in MODBUS protocol.

Research on Mimic Defence Technology for Smart Unit Application Environment of Power Grid

Aiming at the problem that the new network attack cannot be effectively defended at present, this paper proposes a framework of application-level mimic defense technology for smart grid units to solve the active attack defense problem of smart terminal units in the source grid environment. In this paper, the application security mimic defense architecture and interactive instruction level heterogeneous redundancy technology for smart grid units are studied to achieve universal and self-immune active immunity against grid application-level attacks. Furthermore, the dynamic change and heterogeneous redundancy characteristics of application level are constructed by mimetic defense technology. The risk and vulnerability of terminal application security vulnerabilities are actively hidden to actively avoid attacks, so as to enhance the active defense capability of industrial control terminal side of power grid.

A Practical Approach and Mitigation Techniques on Application Layer DDoS Attack in Web Server

Denial of Service (DoS) or Distributed Denial of Service (DDoS) is a powerful attack which prevents the system from providing services to its legitimate users. Several approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the host base firewall. Filtering in application level can be computationally expensive and difficult to scale, while DDoS attacks still creating bogus positives that block legitimate users. In this paper, the authors show application layer DoS attack for HTTP web server using some open source DoS attack tools and also suggest some realistic mechanisms that can protect a web server from application-level DoS attacks especially while attacks targeting the resources including CPU, sockets, memory of the victim server. The authors propose a new DDoS defense mechanism that protects http web servers from applicationlevel DDoS attacks based on the reverse proxy. The attack flow detection mechanism detects attack flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. A popular software known as Wireshark which is a network protocol analyzer is used to capture the packets during a DoS attack from the victim server Ethernet interface to detect the attacking host IP address and analysis the types of attack. We evaluate the performance of the proposed scheme via experiment.

Study on Auto Detecting Defence Mechanisms against Application Layer Ddos Attacks in SIP Server

Denial of Service (DoS) or Distributed Denial of Service (DDoS) is a powerful attack which prevents the system from providing services to its legitimate users. Several approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the firewall. Filtering at application level can be computationally expensive and difficult to scale, while still creating bogus positives that block legitimate users. In this paper, authors show application layer DoS attack for SIP server using some open source DoS attack tools and also suggest a mechanism that can protect a given SIP server from application-level DoS attacks especially the attacks targeting the resources including CPU, sockets, memory of the victim server. In this paper author’s attempt to illustrate application layer distributed denial of Service (DDoS) attack on SIP Server such as SIP flooding attack, real time transport (RTP) flooding attack using open source DDoS attack tools. We propose a new DDoS defence mechanism that protects SIP servers from application-level DDoS attacks based on the two methodologies: IPtables and fail2ban detection. The attack flow detection mechanism detects attach flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. A popular software known as Wireshark which is a network protocol analyzer is used to capture the packets during DoS attack from the victim server Ethernet interface to detect the attacking host IP address and analysis the types of attack. We evaluate the performance of the proposed scheme via experiment

Prediction and Classification of Web Application Attacks using Vulnerability Ontology

Web application security is the major security concern for ebusiness and information sharing communities. Research showed that more than 75% attacks are being deployed at application layer and almost 90% applications are vulnerable to the attacks. This is due to the avoidance of security requirements during implementation by the developer because they are not trained on solving security issues and often need to depend on security experts. In this paper, an approach for effective defenses against the application level attacks is proposed. The proposed system is an ontology based system that can predict and classify web application attacks. The system effectively stores threat, vulnerability and attack information. The attacks can be predicted by analyzing vulnerability and threats. The attacks are classified based on severity level of the attacks on security goals. Moreover, the system also provides suggestion for prevention and countermeasure to the predicted attacks, thereby assisting the developers in developing secure web applications. The results were promising when compared to the conventional method of knowledge base. General Terms Information Security, Web Application Security, Ontology, Information Retrieval

Secure Top- $k$ Query Processing in Unattended Tiered Sensor Networks

Many future large-scale unattended sensor networks (USNs) are expected to follow a two-tier architecture with resource-poor sensor nodes at the lower tier and fewer resource-rich master nodes at the upper tier. Master nodes collect data from sensor nodes and then answer the queries from the net- work owner on their behalf. In hostile environments, master and sensor nodes may be compromised by the adversary and return incorrect data in response to data queries. Such application-level attacks are more harmful and difficult to detect than blind denial-of-service attacks on network communications, particu- larly when the query results are the basis for critical decision making. This paper presents a suite of novel schemes to enable verifiable top-k query processing in USNs, which is the first work of its kind. The proposed schemes are built upon symmetric cryp- tographic primitives and enable the network owner to detect any incorrect top-k query results. Detailed theoretical and simulation results confirm the high efficacy and efficiency of the proposed schemes.

Mitigating DoS Attacks Using Performance Model-Driven Adaptive Algorithms

Denial of Service (DoS) attacks overwhelm online services, preventing legitimate users from accessing a service, often with impact on revenue or consumer trust. Approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the firewall. Filtering at this level can be computationally expensive and difficult to scale, while still producing false positives that block legitimate users. This article presents a model-based adaptive architecture and algorithm for detecting DoS attacks at the web application level and mitigating them. Using a performance model to predict the impact of arriving requests, a decision engine adaptively generates rules for filtering traffic and sending suspicious traffic for further review, where the end user is given the opportunity to demonstrate they are a legitimate user. If no legitimate user responds to the challenge, the request is dropped. Experiments performed on a scalable implementation demonstrate effective mitigation of attacks launched using a real-world DoS attack tool.

Vulnerability Assessment of IPv6 Websites to SQL Injection and Other Application Level Attacks

Given the proliferation of internet connected devices, IPv6 has been proposed to replace IPv4. Aside from providing a larger address space which can be assigned to internet enabled devices, it has been suggested that the IPv6 protocol offers increased security due to the fact that with the large number of addresses available, standard IP scanning attacks will no longer become feasible. However, given the interest in attacking organizations rather than individual devices, most initial points of entry onto an organization's network and their attendant devices are visible and reachable through web crawling techniques, and, therefore, attacks on the visible application layer may offer ways to compromise the overall network. In this evaluation, we provide a straightforward implementation of a web crawler in conjunction with a benign black box penetration testing system and analyze the ease at which SQL injection attacks can be carried out.

Perturbation-based user-input-validation testing of web applications

User-input-validation (UIV) is the first barricade that protects web applications from application-level attacks. Most UIV test tools cannot detect semantics-related vulnerabilities in validators, such as filling a five-digit number to a field that accepts a year. To address this issue, we propose a new approach to generate test inputs for UIV based on the analysis of client-side information. In particular, we use input-field information to generate valid inputs, and then perturb valid inputs to generate invalid test inputs. We conducted an empirical study to evaluate our approach. The empirical result shows that, in comparison to existing vulnerability scanners, our approach is more effective than existing vulnerability scanners in finding semantics-related vulnerabilities of UIV for web applications.

A potential HTTP-based application-level attack against Tor

Tor has become one of the most popular overlay networks for anonymizing TCP traffic, however, the anonymity of Tor clients is threatened by various attacks exploiting traffic analysis or Tor’s design features. Although considerable effort has been made to secure and improve Tor networks, little attention has been paid to various application-level attacks against Tor. In this paper, we present a potential HTTP-based application-level attack against Tor, which exploits both Tor’s design features and HTTP’s vulnerability to man-in-the-middle attacks. Such an application-level attack can efficiently and effectively compromise the anonymity of clients without using invasive plugins like Java or any other active content systems in a web browser, posing a serious threat to Tor. Our analytical and empirical results validate the feasibility and effectiveness of the attack. Based on our analysis of the potential attack mechanism, we propose corresponding countermeasures to thwart such potential application-level attacks against Tor, thereby effectively securing and improving Tor networks. Since the fundamental vulnerability exposed by this paper is not specific to web browsing via Tor but rather to the problem of other low-latency applications based on TCP streams, our study is critical for securing and improving low-latency anonymous communication systems.

Employing Encryption to Secure Consumer Data

Businesses have learned that perimeter security is no longer enough to protect critical data, and many are now touting the benefits of encrypting the data held in storage and backup systems. Driven largely by the awareness of security breaches, lawmakers, credit card issuers, and consumers themselves are holding organizations accountable for the protection of personal data. Today, businesses that suffer a security breach in which customer data is lost or stolen face widespread negative publicity, lost business, lawsuits, and fines that can threaten their viability. Although it's easy to immediately think that the storage or backup systems were compromised, it's important to note that, in an analysis of 45 of the reported incidents of data theft that occurred in the first half of 2005, only a small percentage were due to theft or loss of backup tapes. Far more prevalent were incidents in which insiders or outside attackers gained access to sensitive information through application-level attacks — attacks storage-level encryption wouldn't have prevented. This is why it is important for businesses to encrypt data at the Web, application, or database layer. Encrypting data as it enters the business, rather than having it stay in a readable state while it is used in various applications throughout the network, protects that data from both internal and external threats.

Design and Implementation of the Web Application Intrusion Prevention System

Web application portal with the single sign on (SSO) feature provides an integrated E-Business solution such that web application becomes an essential building block for business operations. Gartner Group report indicates that 75% of malicious attacks targeting the application layer and three out of four business Web sites are vulnerable to application-level attacks. Therefore, the traditional security devices (such as firewall and intrusion detection system) are not able to protect web-based applications any more. Implementing a solid web application security protection shield is top-of-mind of security researchers. Extending the finite state machine theory and coupling with stateful session inspection, we propose Web Intrusion Prevention System (WIPS) to solve web application security issues listed in the OWASP Top Ten project. WIPS works as the last defense line to separate web browsers and web servers by examining network traffic, maintaining every session's state information and allowing only specific web behaviors defined by web finite state machine to pass through. With embedded Snort capability, WIPS also provides negative security models to resist the lower layer attacks. A WIPS prototype has been implemented on Intel Network Processor (IXP425) running with MontaVista Linux. In our study, the functionality and performance has been assessed to show WIPS providing a key answer for advancing the state-of-the-art in web application security in a realistic environment.

Un système de détection d'intrusions distribué pour réseaux ad hoc

In this paper we propose a distributed and modular architecture for an intrusion detection system (IDS) dedicated to mobile ad hoc networks (MANET). Our proposition relies on the use of local IDSs on each node of the MANET and on an agent based intra-IDS communication framework. It has been validated by a proof-of-concept prototype. which is presented in this paper. The article describes in detail, several network and application level attacks and how they can be detected. These attacks have been implemented und were used to validate our approach. Experiments exhibit fairly good results and the attacks are well and rapidly detected by our system. We conclude the paper by demonstrating that existing IDSs, such as SNORT, can be integrated as data sources for our architecture and by evaluating the benefits of mobile agents in the ad hoc context.

Developing secure Web applications

The Secure Web Applications Project (SWAP) is an interdisciplinary research initiative between the Laboratory for Communications Engineering and the Computer Laboratory of the University of Cambridge that seeks to address the problem of application-level Web security at a higher level. The project reduces application development time and protects against a large class of application-level attacks more effectively than existing Web development methodologies.