Benign Users Research Articles

An implementation of real-time detection of cross-site scripting attacks on cloud-based web applications using deep learning

Cross-site scripting has caused considerable harm to the economy and individual privacy. Deep learning consists of three primary learning approaches, and it is made up of numerous strata of artificial neural networks. Triggering functions that can be used for the production of non-linear outputs are contained within each layer. This study proposes a secure framework that can be used to achieve real-time detection and prevention of cross-site scripting attacks in cloud-based web applications, using deep learning, with a high level of accuracy. This project work utilized five phases cross-site scripting payloads and Benign user inputs extraction, feature engineering, generation of datasets, deep learning modeling, and classification filter for Malicious cross-site scripting queries. A web application was then developed with the deep learning model embedded on the backend and hosted on the cloud. In this work, a model was developed to detect cross-site scripting attacks using multi-layer perceptron deep learning model, after a comparative analysis of its performance in contrast to three other deep learning models deep belief network, ensemble, and long short-term memory. A multi-layer perceptron based performance evaluation of the proposed model obtained an accuracy of 99.47%, which shows a high level of accuracy in detecting cross-site scripting attacks.

OSC-MC: Online Secure Communication Model for Cloud Environment

A malicious cloud user may exploit outsourced data involved in online communication, co-residency, and hypervisor vulnerabilities to breach and hamper sensitive information, and inject malicious traffic-based congestion, rendering services to other benign users. To address this critical and challenging the problem, this letter proposes an Online Secure Communication Model for Cloud (OSC-MC) by identifying and terminating malicious VMs and inter-VM links prior to the occurrence of security threats. The anomalous network traffic, bandwidth usage, and unauthorized inter-VM links are security breach indicators which guides secure cloud communication and resource allocation. The simulation and comparison of the proposed model with existing approaches reveal that it significantly improves authorised inter-communication links up to 34.5% with a reduction of network hogs, and power consumption by 66.46% and 39.31%, respectively.

Demystifying Cryptocurrency Mining Attacks: A Semi-supervised Learning Approach Based on Digital Forensics and Dynamic Network Characteristics

Cryptocurrencies have emerged as a new form of digital money that has not escaped the eyes of cyber-attackers. Traditionally, they have been maliciously used as a medium of exchange for proceeds of crime in the cyber dark-market by cyber-criminals. However, cyber-criminals have devised an exploitative technique of directly acquiring cryptocurrencies from benign users' CPUs without their knowledge through a process called crypto mining. The presence of crypto mining activities in a network is often an indicator of compromise of illegal usage of network resources for crypto mining purposes. Crypto mining has had a financial toll on victims such as corporate networks and individual home users. This paper addresses the detection of crypto mining attacks in a generic network environment using dynamic network characteristics. It tackles an in-depth overview of crypto mining operational details and proposes a semi-supervised machine learning approach to detection using various crypto mining features derived from complex network characteristics. The results demonstrate that the integration of semi-supervised learning with complex network theory modeling is effective at detecting crypto mining activities in a network environment. Such an approach is helpful during security mitigation by network

Serving while attacked: DDoS attack effect minimization using page separation and container allocation strategy

Distributed denial of service attacks are prominent cyber attacks for the last many years. Cloud computing environments are emerging as a common service deployment alternative. At the same time, the cloud is also emerging as an important target for DDoS attacks. DDoS attacks exhaust the resources of the target server to deny the service for benign users. Cloud platforms may also use the container as a service (CaaS) deployment model. In this work, we focus on understanding and minimizing the attack effects of the DDoS attacks in the container-based virtual environments. With the help of DDoS attack experiments, we see that when the attack is present, there is heavy resource contention between authenticated white-list requests and suspicious attack requests at the victim server. In addition, there is a large number of request failures for white-list users. In this work, we analyze the results of our attack experiments and define a set of important requirements for effective solutions. Among these requirements, serving the benign user requests is the foremost requirement for any victim server. In addition, segregation of suspicious attack requests and separation of pages are other two important requirements. Based on these solutions requirements, we propose a set of novel page separation and resource allocation strategies to achieve service availability for genuine users. Based on the attack experiments to evaluate the proposed strategies, we found that page separation with the majority of resources assigned to white-list user requests and separating suspicious user requests ascertain service availability to genuine users during the attacks. The overall service-time of genuine requests achieved a huge improvement as compared to the scenario when not using our proposed strategies.

Hybroid: A Novel Hybrid Android Malware Detection Framework

Android, the most widely-used mobile operating system, attracts the attention of malware developers as well as benign users. Despite the serious proactive actions taken by Android, the Android malware is still widespread as a result of the increasing sophistication and the diversity of malware. Android malware detection systems are generally classified into two: (1) Static analysis, and (2) dynamic analysis. In this study, a novel Android malware detection framework, namely, Hybroid, was proposed which combines both the static and dynamic analysis techniques to benefit from the advantages of both of these techniques. An up-to-date version of Android, namely, Android Oreo, was specifically employed in order to handle the problem from an up-to-date perspective as the recent versions of Android provide new security mechanisms, which are discussed with this study. Hybroid was evaluated on a large dataset that consists of 10,658 applications, and the accuracy of Hybroid was calculated as high as 99.5% when it was utilized with the J48 classification algorithm which outperforms the state-of-the-art studies. The key findings in consequence of the experimental result are discussed in order to shed light on Android malware detection.

A service governance and isolation based approach to mitigate internal collateral damages in cloud caused by DDoS attack

Distributed denial of service (DDoS) attack in cloud infrastructure has shown the new effects towards the non-targets known as “collateral damages”. The cloud-hosted services generally run inside the virtual machine (VM). These services are co-located to each other which lie on the same OS of the VM and share the resources. When the DDoS attacker targets one service, its effects can be seen on other co-located services also. These effects are called “internal collateral damages”. Therefore this work, focuses on mitigating internal collateral damages caused by the DDoS attack in the cloud environment. Here the problem is considered as an OS level resources governance and isolation problem to minimize the effects of the attack on non-targets. The methods present in the literature are not capable enough to deal the problem of internal collateral damages effectively. Therefore, a novel service containerization approach is proposed to achieve resource governance and isolation between the co-located services. Moreover, the proposed approach improves service performance for benign users. The results also shows that the proposed approach is capable to reduce the collateral effects of DDoS attack on co-located services such as SSH and disk I/O by improving the service performance.

Contra-∗: Mechanisms for countering spam attacks on blockchain's memory pools

Blockchain-based cryptocurrencies, such as Bitcoin, have seen on the rise in their popularity and value, making them a target to several forms of Denial-of-Service (DoS) attacks, and calling for a better understanding of their attack surface from both security and distributed systems standpoints. In this paper, and in the pursuit of understanding the attack surface of blockchains, we explore a new form of attack that can be carried out on the memory pools (mempools), and mainly targets blockchain-based cryptocurrencies. We study this attack on Bitcoin's mempool and explore the attack's effects on transactions fee paid by benign users. To counter this attack, this paper further proposes Contra-∗, a set of countermeasures utilizing fee, age, and size (thus, Contra-F, Contra-A, and Contra-S) as prioritization mechanisms. Contra-∗ optimize the mempool size and help in countering the effects of DoS attacks due to spam transactions. We evaluate Contra-∗ by simulations and analyze their effectiveness under various attack conditions.

Distributed frameworks for detecting distributed denial of service attacks: A comprehensive review, challenges and future directions

AbstractA distributed denial of service (DDoS) attack is a significant threat to web‐based applications and hindering legitimate traffic (denies access to benign users) by overwhelming the victim system or its infrastructure (service, bandwidth, networking devices, etc.) with a large volume of attack traffic. It leads to a delay in responses or sometimes a crash victim system. Even a few moments of pause in web‐based applications lead to a huge monetary loss and a bad reputation in the market. Several approaches available in the literature to protect websites from different types of DDoS attacks. However, incidents and volume sizes of DDoS attacks are growing quarter by quarter. Further, various challenges in the traditional framework based defense mechanisms: itself becoming a victim of attacks while analyzing a massive amount of traffic, require more time for detection process, no coordination among the modules, etc. This paper presents a comprehensive DDoS defense deployment taxonomy and critically reviewed existing distributed frameworks based DDoS attack detection systems. Further, characterized several existing distributed processing frameworks to select an appropriate one for deploying DDoS attack detection mechanisms. Finally, several evaluation metrics, open issues, discussion on available datasets including their limitations, and future directions are presented.

A request aware module using CS-IDR to reduce VM level collateral damages caused by DDoS attack in cloud environment

Distributed Denial of Service (DDoS) plays a significant role in threatening the cloud-based services. DDoS is a kind of attack which targets the CPU, bandwidth and other resources and makes them unavailable to benign users. The DDoS attack has an enormous impact on multi-tenant cloud network than the traditional network due to the cloud features like virtualization, load balancing, resource scaling and migrations. These features spread attack effects in the whole cloud network, which introduces the collateral damages to the non-target stakeholders. Some of these stakeholders are co-hosted virtual machines (VMs), host physical server, co-hosted physical server, cloud service providers and users, etc. Therefore, there is a need for a method that can reduce such collateral damages. In this work, we focus on reducing VM level collateral damages caused to the co-hosted VMs residing with the victim VM on the same host. The proposed architecture consists of: (i) a request awareness based module to reduce VM level collateral damages, (ii) to obtain the request awareness, a novel Cuckoo Search based IDentification of Request (CS-IDR) method using bivariate flight is also proposed. The CS-IDR method helps in taking the request-aware decision, which eventually reduces VM level collateral damages. The result also shows that the proposed method minimizes the CPU usage, RAM usage, power consumption, overall load, and incurred cost caused due to DDoS attack on non-target co-hosted VM, and hence reduces such collateral damages.

DeepSBD: A Deep Neural Network Model With Attention Mechanism for SocialBot Detection

Online Social Networks (OSNs) are witnessing sophisticated cyber threats, that are generally conducted using fake or compromised profiles. Automated agents ( aka socialbots), a category of sophisticated and modern threat entities, are the native of the social media platforms and responsible for various modern weaponized information-related attacks, such as astroturfing, misinformation diffusion, and spamming. Detecting socialbots is a challenging and vital task due to their deceiving character of imitating human behavior. To this end, this paper presents an attention-aware deep neural network model, DeepSBD , for detecting socialbots on OSNs. The DeepSBD models users’ behavior using profile , temporal , activity , and content information. It jointly models OSN users’ behavior using Bidirectional Long Short Term Memory (BiLSTM) and Convolutional Neural Network (CNN) architectures. It models profile , temporal , and activity information as sequences, which are fed to a two-layers stacked BiLSTM, whereas content information is fed to a deep CNN. We have evaluated DeepSBD over five real-world benchmark datasets and found that it performs significantly better in comparison to the state-of-the-arts and baseline methods. We have also analyzed the efficacy of DeepSBD at different ratios of socialbots and benign users and found that an imbalanced dataset moderately affects the classification accuracy. Finally, we have analyzed the discrimination power of different behavioral components, and it is found that both profile characteristics and content behavior are most impactful, whereas diurnal temporal behavior is the least effective for detecting socialbots on OSNs.

Incremental collusive fraud detection in large-scale online auction networks

An online auction network (OAN) is a community of users who buy or sell items through an auction site. Along with the growing popularity of auction sites, concerns about auction frauds and criminal activities have increased. As a result, fraud detection in OANs has attracted renewed interest from researchers. Since most real OANs are large-scale networks, detecting fraudulent users is usually difficult, especially when multiple users collude with each other and new online auctions are continuously added. Although collusive auction frauds are not as popular as other types of auction frauds, they are more horrible and catastrophic because they often bring huge financial losses. To tackle this issue, some techniques have been proposed to detect collusive frauds in OANs. While all of the techniques have demonstrated promising results, they often suffer from low detection performance or slow convergence, especially in large-scale OANs. In this paper, we overcome these deficiencies by presenting ICAFD, a novel technique that recasts the problem of detecting collusive frauds in large-scale OANs as an incremental semi-supervised anomaly detection problem. In this technique, we propagate reputations from a small set of labeled benign users to unlabeled users along the auction relationships between them and then incrementally update reputations when a new auction gets added to the OAN. This increases the convergence of ICAFD and allows it to avoid wasteful recalculation of reputations from scratch. Our experimental results show that ICAFD can successfully detect different types of collusive auction frauds in a reasonable detection time.

Taxonomy of Payment Structures and Economic Incentive Schemes in Internet

Recently the study of economics of internet has emerged as an emerging field of study. The workstations being distributed across the network along with the users having varied interests has made this study very important from an information security and policy designing point of view. The main purpose of any framework design is to keep up with the security standards of confidentiality, integrity and availability without being an overburden on the deployer. The same goes for the users, the Quality of Service (QoS) should be in accordance with what they pay for. The concept of “tragedy of commons” plays an important role in distributing the limited resources of the internet. In this, the users because of their own self-interest destroy the collective interest of a community sharing the resource. A sustainable pricing strategy is the one which is able to cater to the competitive advantage of different network providers offering the same set of services but on varied prices. A pricing mechanism will help in differentiating the services offered to the users, but another important task is of fixing the incentives. The pricing strategy plays a very important role in facilitating varied kinds of QoS requirements. Security professionals have realized that while designing any security mechanism it is vital to keep in consideration the “theory of mind” which explains the way the attackers and benign users take decision to deceive of remain loyal to the system. So, studying the incentive and payment structure from economic point of view is important.

A Fine-grained Approach for Anomaly Detection in File System Accesses with Enhanced Temporal User Profiles

Protecting sensitive data from theft, exfiltration, and other kinds of abuses by malicious insiders is a challenging problem. While access control mechanisms cannot always prevent the insiders from misusing sensitive data (since, in most of the cases, authorized users within organizations are granted access permissions), malicious outsiders also pose severe threats due to different security vulnerabilities in the systems, e.g., phishing attacks, memory corruptions, etc., which enable them to steal the credentials of the authorized users who have access to the data. To protect sensitive data from such attackers, anomaly detection techniques are often combined with other existing security measures, e.g., access control and encryption. An anomaly detection technique for identifying anomalies in file system accesses is based on the key idea that there should be significant differences between the file access behaviors of a benign user and an attacker. In this article, we propose an approach to create fine-grained profiles of the users’ regular file access activities while extensively analyzing the timestamp information of the file accesses. According to our observation, even if a user’s access to a file seems benign, only a fine-grained analysis of the access (such as the size of access, the timestamp of access) can determine the original intention of the user. We exploit the users’ file access information at the block level to model their regular file access behaviors (user profiles) which are then securely stored and used for identifying anomalous file system accesses in the detection phase. We are also able to automatically profile new files and new users added to the system dynamically. Finally, our performance evaluations demonstrate that our proposed approach has an accuracy of 98.7 percent in detecting anomalies while incurring an overhead of only 2 percent.

Enabling Data Trustworthiness and User Privacy in Mobile Crowdsensing

Ubiquitous mobile devices with rich sensors and advanced communication capabilities have given rise to mobile crowdsensing systems. The diverse reliabilities of mobile users and the openness of sensing paradigms raise concerns for data trustworthiness, user privacy, and incentive provision. Instead of considering these issues as isolated modules in most existing researches, we comprehensively capture both conflict and inner-relationship among them. In this paper, we propose a holistic solution for trustworthy and privacy-aware mobile crowdsensing with no need of a trusted third party. Specifically, leveraging cryptographic technologies, we devise a series of protocols to enable benign users to request tasks, contribute their data, and earn rewards anonymously without any data linkability. Meanwhile, an anonymous trust/reputation model is seamlessly integrated into our scheme, which acts as reference for our fair incentive design, and provides evidence to detect malicious users who degrade the data trustworthiness. Particularly, we first propose the idea of limiting the number of issued pseudonyms which serves to efficiently tackle the anonymity abuse issue. Security analysis demonstrates that our proposed scheme achieves stronger security with resilience against possible collusion attacks. Extensive simulations are presented which demonstrate the efficiency and practicality of our scheme.

GADM: Manual fake review detection for O2O commercial platforms

O2O (online to offline) commercial platforms, such as Yelp, play a crucial role in our daily purchases. Seeking fame and profit, some people try to manipulate the O2O market by opinion spamming, i.e., engaging in fraudulent behavior such as writing fake reviews, which affects the online purchasing environment. Manual fake reviews imitate honest reviews in many ways; hence they are more deceptive and harmful than botnet reviews. Several efficient methods have been proposed to detect fake reviews, but manual fake reviewers are evolving rapidly. They pretend to be benign users, control the velocity of review fraud actions, and deceive detection systems. Previous work has focused on the contents of reviews or the information of reviewers. We find that geolocation factors have potential and have been neglected in most studies. Our research indicates that geolocation can well distinguish between fake reviewers and benign users on an O2O platform. We propose a manual fake review detection model, the geolocation-based account detection model (GADM), which combines the AdaBoost model and a long short-term memory (LSTM) neural network to analyze a user’s account and geolocation information, achieving 83.3% accuracy and an 86.2% F1-score on a Yelp dataset. We also propose a high-efficiency algorithm to detect review fraud groups.

Securing keystroke dynamics from replay attacks

Keystroke dynamics is a viable behavioral biometric technique for identity verification based on users’ keyboard interaction traits. Keystroke dynamics can help prevent credentials from being abused in case of theft or leakage. But what happens if the keystroke events are eavesdropped and being replayed? Attackers that intercept keystroke dynamics authentication sessions of benign users can easily replay them from other sources unchanged or with minor changes and gain illegitimate privileges. Hence, even with its major security advantages, keystroke dynamics can still expose authentication mechanisms to replay attacks. Although replay attack is one of the oldest techniques to manipulate authentication systems, keystroke dynamics does not help preventing it. We suggest a new protocol for dynamics exchange based on choosing a subset of real and fake information snippets shared between the client and service providers to lure potential attackers. We evaluated our method on four state-of-the-art keystroke dynamics algorithms and three publicly available datasets and showed that we can dramatically reduce the possibility of replay attacks while preserving highly accurate user verification.

On The Robustness of Price-Anticipating Kelly Mechanism

The price-anticipating Kelly mechanism (PAKM) is one of the most extensively used strategies to allocate divisible resources for strategic users in communication networks and computing systems. The users are deemed as selfish and also benign, each of which maximizes his individual utility of the allocated resources minus his payment to the network operator. However, in many applications a user can use his payment to reduce the utilities of his opponents, thus playing a misbehaving role. It remains mysterious to what extent the misbehaving user can damage or influence the performance of benign users and the network operator. In this work, we formulate a non-cooperative game consisting of a finite amount of benign users and one misbehaving user. The maliciousness of this misbehaving user is captured by his willingness to pay to trade for unit degradation in the utilities of benign users. The network operator allocates resources to all the users via the price-anticipating Kelly mechanism. We present six important performance metrics with regard to the total utility and the total net utility of benign users, and the revenue of network operator under three different scenarios: with and without the misbehaving user, and the maximum. We quantify the robustness of PAKM against the misbehaving actions by deriving the upper and lower bounds of these metrics. With new approaches, all the theoretical bounds are applicable to an arbitrary population of benign users. Our study reveals two important insights: 1) the performance bounds are very sensitive to the misbehaving user’s willingness to pay at certain ranges and 2) the network operator acquires more revenues in the presence of the misbehaving user which might disincentivize his countermeasures against the misbehaving actions.

One-Class Adversarial Nets for Fraud Detection

Many online applications, such as online social networks or knowledge bases, are often attacked by malicious users who commit different types of actions such as vandalism on Wikipedia or fraudulent reviews on eBay. Currently, most of the fraud detection approaches require a training dataset that contains records of both benign and malicious users. However, in practice, there are often no or very few records of malicious users. In this paper, we develop one-class adversarial nets (OCAN) for fraud detection with only benign users as training data. OCAN first uses LSTM-Autoencoder to learn the representations of benign users from their sequences of online activities. It then detects malicious users by training a discriminator of a complementary GAN model that is different from the regular GAN model. Experimental results show that our OCAN outperforms the state-of-the-art oneclass classification models and achieves comparable performance with the latest multi-source LSTM model that requires both benign and malicious users in the training phase.

Structure-Based Sybil Detection in Social Networks via Local Rule-Based Propagation

Social networks are known to be vulnerable to the so-called Sybil attack, in which an attacker maintains massive Sybils and uses them to perform various malicious activities. Therefore, Sybil detection in social networks is a basic security research problem. Structure-based methods have been shown to be promising at detecting Sybils. Existing structure-based methods can be classified into two categories: Random Walk (RW)-based methods and Loop Belief Propagation (LBP)-based methods. RW-based methods cannot leverage labeled Sybils and labeled benign users simultaneously, which limits their detection accuracy, and/or they are not robust to noisy labels. LBP-based methods are not scalable, and they cannot guarantee convergence. In this work, we propose SybilSCAR, a novel structure-based method to detect Sybils in social networks. SybilSCAR is Scalable, Convergent, Accurate, and Robust to label noise. We first propose a framework to unify RW-based and LBP-based methods. Under our framework, these methods can be viewed as iteratively applying a (different) local rule to every user, which propagates label information among a social graph. Second, we design a new local rule, which SybilSCAR iteratively applies to every user to detect Sybils. We compare SybilSCAR with state-of-the-art RW-based methods and LBP-based methods both theoretically and empirically. Theoretically, we show that, with proper parameter settings, SybilSCAR has a tighter asymptotical bound on the number of Sybils that are falsely accepted into a social network than existing structure-based methods. Empirically, we perform evaluation using both social networks with synthesized Sybils and a large-scale Twitter dataset (41.7M nodes and 1.2B edges) with real Sybils, and our results show that 1) SybilSCAR is substantially more accurate and more robust to label noise than state-of-the-art RW-based methods; and 2) SybilSCAR is more accurate and one order of magnitude more scalable than state-of-the-art LBP-based methods.

Cryptojacking injection: A paradigm shift to cryptocurrency-based web-centric internet attacks

ABSTRACTCrypto-mining attacks have emerged as a new generation of web-based attacks which have seen cybercriminals eschew the infamous crypto ransomware. The watering hole attack vector has by far been the most widely employed attack methodology but it faces the task of luring the victim to the infected web resources. However, cryptojacking injection presents a paradigm shift to web-based crypto-mining attacks in that it eliminates the need for a pivotal third-party such as the exploitable web server. Thus, instead of attacking credit card and other private information of e-commerce users, attackers seek to maliciously abuse a victim’s CPU to generate cryptocurrency. In this paper, we investigate and evaluate cryptojacking injection – a state-of-the-art web-centric attack vector in the crypto-mining attacks landscape. We formulate an attack model based on finite state machines which depicts the various breaches of confidentiality, integrity and availability in the web system as the attack progresses. We show how this new attack vector attacks some of the core components of e-commerce (URL, HTTP and HTML) to generate Monero crypto currency from benign web users. We evaluate our modeling approach with a series of experiments with two attack scenarios using different operating systems. Results show that the attack is indeed cross-platform and feasible on any operating system of a browser-capable device. We analyze the generated network traffic during the attack and draw features such as URLs and the parsed files, the associated cryptographic hashes, and the IP addresses of the crypto-mining domains. These, together with host-based features such as exhaustive CPU usage can be used as indicators of compromise and subsequently act as feed into intrusion detection systems.