HTTP Header Research Articles

An Enhanced Mechanism for Protecting Web Applications from Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) is considered one of the top vulnerabilities in today’s web, where an untrusted website can force the user browser to send an unauthorized valid request to the trusted site. Legitimate users will lose their integrity over the website when the CSRF takes place. So far, many solutions have been proposed for the CSRF attacks such as the referrer HTTP header, custom HTTP header, origin header, client site proxy, a browser plug-in, and random token validation, but in this research, the use of random token validation to solve the problem of CSRF attacks was implemented. The proposed solution in the study used a concept known as Nonce which is a type of random token attached to requests sent over a server. This solution proved to be effective enough to protect and prevent web applications from CSRF attacks. Although no system can be secured against attacks, this study recommends that the random token validation (Nonce) approach of protecting web applications should be adopted by all web applications developers and users to improve on the already established solutions to reduce the chances of attacks on web applications to a very slim percentage, if not eliminated.

HTTP header based phishing attack detection using machine learning

AbstractIn the past, many techniques like blacklisting/whitelisting, third‐party, search engine, visual similarity, heuristic, URL features, and website content were used for anti‐phishing. Search engine‐based, third‐party assisted tools and blacklist/whitelist fail to identify new phishing attacks resulting in high FPR. Heuristic and visual similarity approaches are slow, whereas URL and web content‐based techniques do not mimic the dynamic content of current websites and hence cannot stop zero‐day attacks. A study was conducted to understand the critical features used in the past for anti‐phishing, and we found 16 HTTP header features that were novel. In this paper, we have developed a real‐time, highly scalable, feature‐rich anti‐phishing detection technique based on ML that extracts the HTTP headers (predominantly security headers) from web pages to identify them as legitimate or phished. It is observed that phishing sites are short‐lived and are created to achieve a specific objective, like stealing the credential of a user. Once the goal is met, the sites are pulled down immediately. Hence these sites do not take pain to use the security features of web technology and only focus on making the site as similar as possible to the original website. Test results based on our novel features show high accuracy of 97.8% with an average response time of 1.57 s. We have created multiple datasets for different scenarios, like a dataset for website creation through phishing tools and a new dataset for testing unseen phishing attacks. The results thus obtained show detection accuracy of 99% and 95%, respectively.

R1DIT: Privacy-Preserving Malware Traffic Classification With Attention-Based Neural Networks

With the advances in deep learning techniques and the increase in the volume of network traffic data, deep neural networks trained directly with the raw traffic data have become more popular and successful for malware traffic classification without explicit feature extraction. However, most of the existing studies raises privacy concerns when using the payload data and ignore the generalization of the model to the newly emerged traffic such as DDoS detection on TLS 1.3. To overcome these limitations, we introduce a malware traffic classification system, Residual 1-D Image Transformer (R1DIT) model. We first leverage network domain knowledge by carefully parsing IP, HTTP, DNS, and unencrypted TLS record headers as sequences of bytes for input without interfering with IP addresses, port numbers and the payload. Then, we apply raw data transform and attention-based modules in our deep model to classify different malware types and benign traffic. Our results on NetML dataset show that the proposed model delivers 0.972 F1 score, nearly 0.3 higher than the feature-based methods and outperforms state-of-the-art models with 0.9999 F1 score for multi-class malware classification task using CICIDS2017 dataset. The generalization of this model has been proven using the TLS 1.3 traffic obtained from CICDDoS2019 dataset with the detection rate 0.9897 using meta-learning.

DASH Framework Using Machine Learning Techniques and Security Controls

Interest in video streaming has increased recently, as it constitutes most of the traffic on the Internet and cellular networks. These networks use different video streaming technologies. One of the most famous technologies is DASH (which stands for Dynamic Adaptive Steaming using HTTP). DASH adapts streaming parameters according to network conditions and uses the HTTP protocol to communicate between the user and the server. DASH faces many challenges that may lead to video interruptions and poor quality of user experiences (QoE) such as bad network conditions and buffering level control. In addition to the lack of studies, we cover security issues for these types of services. In this paper, we proposed an integrated framework that consists of four components: quality prediction model, precache model, light web application firewall, and a monitoring system. These four components improve QoE and precache and increase the level of security. The results of the quality prediction model are used to predict the quality of the next segments depending on the user’s network conditions and in the precache model to improve caching to reduce the load on the streaming system and rely more on cache servers. The proposed web application firewall is a light version used to defend against video streaming attacks and verify the existence of necessary HTTP headers. The quality predictor model with the generated dataset achieved 97% classification accuracy using DecisionTree, and this experiment proved the strong relationship between congestion periods and streaming quality, which is s the main key in QoE.

Long Live Software Easter Eggs!

It's a period of unrest. Rebel developers, striking from continuous deployment servers, have won their first victory. During the battle, rebel spies managed to push an epic commit in the HTML code of https://pro.sony. Pursued by sinister agents, the rebels are hiding in commits, buttons, tooltips, API, HTTP headers, and configuration screens.

Who Knows I Like Jelly Beans? An Investigation Into Search Privacy

Abstract Internal site search is an integral part of how users navigate modern sites, from restaurant reservations to house hunting to searching for medical solutions. Search terms on these sites may contain sensitive information such as location, medical information, or sexual preferences; when further coupled with a user’s IP address or a browser’s user agent string, this information can become very specific, and in some cases possibly identifying. In this paper, we measure the various ways by which search terms are sent to third parties when a user submits a search query. We developed a methodology for identifying and interacting with search components, which we implemented on top of an instrumented headless browser. We used this crawler to visit the Tranco top one million websites and analyzed search term leakage across three vectors: URL query parameters, payloads, and the Referer HTTP header. Our crawler found that 512,701 of the top 1 million sites had internal site search. We found that 81.3% of websites containing internal site search sent (or leaked from a user’s perspective) our search terms to third parties in some form. We then compared our results to the expected results based on a natural language analysis of the privacy policies of those leaking websites (where available) and found that about 87% of those privacy policies do not mention search terms explicitly. However, about 75% of these privacy policies seem to mention the sharing of some information with third-parties in a generic manner. We then present a few countermeasures, including a browser extension to warn users about imminent search term leakage to third parties. We conclude this paper by making recommendations on clarifying the privacy implications of internal site search to end users.

Vulnerability Assessment and Penetration Testing On The Xyz Website Using Nist 800-115 Standard

Currently the website has become an effective communication tool. However, it is essential to have vulnerabilities assessment and penetration testing using specific standards on released websites to the public for securing information. The problems raised in this research are conducting vulnerability testing on the XYZ website to analyze security gaps in the XYZ website, as well as conducting penetration testing on high vulnerabilities found. Testing was conducted using the NIST 800 – 115 Standard through 4 main stages: planning, discovery, attack, and report. Several tools were used: Nmap, OWASP ZAP, Burp Suite, and Foxy Proxy. This research results are presented and analyzed. There were seven vulnerabilities found, one high-level vulnerability, two medium-level vulnerabilities, and four low-level vulnerabilities. At the high level, SQL Injection types are found, at the medium level, Cross-Domains Misconfiguration and vulnerabilities are found, at the low level, Absence of Anti-CSRF Tokens, Incomplete or No Cache-control and Pragma HTTP Header Set, Server Leaks Information via “X-Powered-By” HTTP Response Header Field and X-Content-Type-Options Header Missing are found.

ГИБРИДНЫЙ СПОСОБ ОБЕСПЕЧЕНИЯ КОНФИДЕНЦИАЛЬНОСТИ ПОЛЬЗОВАТЕЛЯ ПРИ РАБОТЕ С ВЕБ-БРАУЗЕРОМ

Introduction: One of the most common privacy vulnerabilities on the Internet is digital tracking that identifies users, which includes cookies and digital fingerprinting mechanisms. A comparative analysis of existing modern web tracking methods shows that approaches that rely on detecting and blocking web trackers are less effective than ones using value spoofing, since they do not provide passive fingerprinting methods protection, and are also easily detectable and, as a consequence, are susceptible to being used user identification. To eliminate these shortcomings, new, generally combined, methods should be developed. Purpose is to analyze the main mechanisms and varieties of digital tracking, describe the principles of their operation and develop an effective hybrid method to counteract the digital fingerprinting of the user's device. Results: It is shown that fingerprint tracking is extremely dangerous, as it cannot be effectively blocked by the browser. To solve the problem, a hybrid method of spoofing transmitted data, including both randomization and unification, is proposed. This method is chosen due to the fact that it provides protection against known digital fingerprinting methods. In addition, the method lacks the tracker detection stage, that provides instant protection. Characteristics with a wider range of possible values, that are also difficult to unify (Canvas, WebGL, Audio) are proposed to be replaced with the real ones with the addition of minor distortions. Attributes that must comply with the value adequacy property and changing of which may disrupt the website will be unified. Consequently, it is proposed to unify HTTP headers and global JavaScript browser parameters. The software implementation of the described algorithm is made in the JavaScript programming language in the ECMAScript 6 specification using the standard of the Web-Extensions API cross-browser add-on development system.

Distributed Denial of Service (DDoS) Analysis on Virtual Network and Real Network Traffic

Data communication, computers and computer networks increase the needs and facilitation offered by a variety of server services that are owned by individuals and companies. Servers are the core of continuous communication on the internet and the main factor in the life, development and death of individual businesses or companies that rely on the internet. The other side is also developing rapidly targeting server attacks from starting to weaken performance to crippled, the most popular in the hacker world, namely attacks by bombarding servers with many requests from one computer or more, with one machine to thousands of machines. This study implements several DDoS attack techniques targeted at virtual servers and real servers to determine the type of protocol used and its accuracy and reliability. The research method uses the concept of Robert Maribe Branch (2009) or ADDIE which consists of Analysis, Design, Development, Implementation and Evaluation with the results of successful attacks on the HTTP header on the virtual network and on the real network 85.68%, while the TCP has an accuracy value. 87.75% and the real network produces 90.02%. In addition, the attack using the ping of death on the virtual server was successfully carried out and the real server had an accuracy value of 41.45% so that the attack on the TCP protocol was declared very effective in crippling the target PC or server. Â

HTTP-Based APT Malware Infection Detection Using URL Correlation Analysis

APT malware exploits HTTP to establish communication with a C & C server to hide their malicious activities. Thus, HTTP-based APT malware infection can be discovered by analyzing HTTP traffic. Recent methods have been dependent on the extraction of statistical features from HTTP traffic, which is suitable for machine learning. However, the features they extract from the limited HTTP-based APT malware traffic dataset are too simple to detect APT malware with strong randomness insufficiently. In this paper, we propose an innovative approach which could uncover APT malware traffic related to data exfiltration and other suspect APT activities by analyzing the header fields of HTTP traffic. We use the Referer field in the HTTP header to construct a web request graph. Then, we optimize the web request graph by combining URL similarity and redirect reconstruction. We also use a normal uncorrelated request filter to filter the remaining unrelated legitimate requests. We have evaluated the proposed method using 1.48 GB normal HTTP flow from clickminer and 280 MB APT malware HTTP flow from Stratosphere Lab, Contagiodump, and pcapanalysis. The experimental results have shown that the URL-correlation-based APT malware traffic detection method can correctly detect 96.08% APT malware traffic, and its recall rate is 98.87%. We have also conducted experiments to compare our approach against Jiang’s method, MalHunter, and BotDet, and the experimental results have confirmed that our detection approach has a better performance, the accuracy of which reached 96.08% and the F1 value increased by more than 5%.

Déjà vu: Abusing Browser Cache Headers to Identify and Track Online Users

Abstract Many browser cache attacks have been proposed in the literature to sniff the user’s browsing history. All of them rely on specific time measurements to infer if a resource is in the cache or not. Unlike the state-of-the-art, this paper reports on a novel cache-based attack that is not a timing attack but that abuses the HTTP cache-control and expires headers to extract the exact date and time when a resource was cached by the browser. The privacy implications are serious as this information can not only be utilized to detect if a website was visited by the user but it can also help build a timeline of the user’s visits. This goes beyond traditional history sniffing attacks as we can observe patterns of visit and model user’s behavior on the web. To evaluate the impact of our attack, we tested it on all major browsers and found that all of them, except the ones based on WebKit, are vulnerable to it. Since our attack requires specific HTTP headers to be present, we also crawled the Tranco Top 100K websites and identified 12, 970 of them can be detected with our approach. Among them, 1, 910 deliver resources that have expiry dates greater than 100 days, enabling long-term user tracking. Finally, we discuss possible defenses at both the browser and standard levels to prevent users from being tracked.

Diagnosing the start of a slow HTTP DDoS attack based on two-parameter traffic correlation analysis

The article investigates the problem of detecting slow DDoS attacks based on network traffic analysis. Detecting a slow HTTP attack is a significant challenge because the attacker's behavior can mimic that of a legitimate user with slow resources. The authors proposed a four-zone attack detection architecture based on the analysis of two parameters: the number of connections to the server and the average client response delay time. A technique for detecting slow DDOS attacks based on correlation analysis and parameter forecasting is proposed. The author's approach uses an original two-parameter correlation analysis model based on the number of connections and the average real delay in the network. An algorithm for detecting a slow DDoS attack based on the prediction of two parameters has been developed. These parameters are used both for analysis and for short-term prediction of traffic behavior. The forecasting algorithm uses the method of calculating the posterior trajectory of the time series depending on a priori statistical observations. Prediction of user behavior parameters allows early detection of slow DDoS attacks based on an algorithm for searching for unknown future values for a time series of parameters. Using the relative values of NC and ARNL as prediction parameters makes it possible to build a flexible recognition system adapted to the specifics of a particular system. Simulation of the two-parameter algorithm for detecting slow DDOS attacks based on prediction was carried out and its effectiveness was evaluated. The proposed method is a combination of artificial intelligence and statistical analysis and uses a self-learning algorithm with sufficient attack statistics. Experimental results show that the method is suitable for early detection of attacks such as Slow HTTP Headers, Slow HTTP Body, Slow HTTP Read. Simulation of traffic parameters confirms the method's ability to detect slow attacks at different time intervals, since the accuracy of the forecast depends on the timeliness of the observations. With sufficient statistics of observations, the deviation of the forecast curve can be less than 5%.

Characterizing Anomalies in Malware-Generated HTTP Traffic

Currently, we are witnessing a significant rise in various types of malware, which has an impact not only on companies, institutions, and individuals, but also on entire countries and societies. Malicious software developers try to devise increasingly sophisticated ways to perform nefarious actions. In consequence, the security community is under pressure to develop more effective defensive solutions and to continuously improve them. To accomplish this, the defenders must understand and be able to recognize the threat when it appears. That is why, in this paper, a large dataset of recent real-life malware samples was used to identify anomalies in the HTTP traffic produced by the malicious software. The authors analyzed malware-generated HTTP requests, as well as benign traffic of the popular web browsers, using 3 groups of features related to the structure of requests, header field values, and payload characteristics. It was observed that certain attributes of the HTTP traffic can serve as an indicator of malicious actions, including lack of some popular HTTP headers and their values or usage of the protocol features in an uncommon way. The findings of this paper can be conveniently incorporated into the existing detection systems and network traffic forensic tools, making it easier to spot and eliminate potential threats.

Exploring HTTPS security inconsistencies: A cross-regional perspective

If two or more identical HTTPS clients, located at different geographic locations (regions), make an HTTPS request to the same domain (e.g. example.com), on the same day, will they receive the same HTTPS security guarantees in response? Our results give evidence that this is not always the case. We conduct scans for the top 250000 most visited domains on the Internet, from clients located at five different regions: Australia, Brazil, India, the UK, and the US. Our scans gather data from both application (URLs and HTTP headers) and transport (servers’ selected TLS version, ciphersuite, and certificate) layers. Overall, we find that HTTPS inconsistencies at the application layer are higher than those at the transport layer. We also find that HTTPS security inconsistencies are strongly related to URLs and IPs diversity among regions, and to a lesser extent to the presence of redirections. Further manual inspection shows that there are several reasons behind URLs diversity among regions such as downgrading to the plain-HTTP protocol, using different subdomains, different TLDs, or different home page documents. Furthermore, we find that downgrading to plain-HTTP is related to websites’ regional blocking. We also provide attack scenarios that show how an attacker can benefit from HTTPS security inconsistencies, and introduce a new attack scenario which we call the “region confusion” attack. Finally, based on our analysis and observations, we provide discussion, which include some recommendations such as the need for testing tools for domain administrators and users that help to mitigate and detect regional domains’ inconsistencies, standardising regional domains format with the same-origin policy (of domains) in mind, standardising secure URL redirections, and avoid redirections whenever possible.

Energy and quality of experience aware web browsing for smartphones

In this paper we propose a framework for improving the web browsing experience of users by reducing battery energy consumption and webpage load time, while maintaining the quality of experience for the user. This is made possible through a collaborative protocol between the web server and the web client application that works using HTTP header fields. The innovation herein lies in dynamically creating multiple versions of the webpages that differ in their quality of content and size, and then delivering an appropriate version to the client based on metrics related to the webpage and the user's phone relevant specifications. These metrics include the user's battery consumption profile, user's network speed, the sizes of the different versions of the webpage, and the estimated energy consumption of the versions. We implemented a prototype and validated the system in terms of maintaining the battery profile and enhancing the load time of different webpages. The results indicate that over 50% reduction in power consumption and 80% reduction in speed requirements (and hence download times) can be achieved as a result of switching over to a lower quality version of the webpage that is still in line with the users’ experience.

The Slow HTTP DDOS Attacks: Detection, Mitigation and Prevention in the Cloud Environment

Cloud computing is the latest buzzword and cutting-edge technology. The cost-efficiency, easy to operate, on-demand services, availability, makes the cloud so popular. The online web applications based on the internet such as E-Healthcare, E-Commerce are moving to the cloud to reduce the operating investment cost. These applications are vulnerable to slow HTTP Distributed Denial of Service (DDoS) attack in the cloud. This kind of attacks aims to consume the resources of the application as well as the hosting system so that to bring down the services. The various forms of the slow HTTP DDoS are HTTP header attack, HTTP body attack and HTTP read attack. Due to the nature of mimicking the slow network behaviour, this attack is very challenging to detect. This is even more difficult to identify in the cloud environment as it has multiple attack paths. Theweb applications running in the cloud should have been safeguarded from the slow HTTP DDoS attacks. This paper proposed a novel multi-stage zone-based classification model to identify, mitigate and prevent the slow HTTP DDoS attacks in the cloud environment. The solution is implemented using the OpenStack cloud environment. The open-source slowHTTPTest tool is used to generate different types of slow HTTP DDoS attacks.

Using XGBoost to Discover Infected Hosts Based on HTTP Traffic

In recent years, the number of malware and infected hosts has increased exponentially, which causes great losses to governments, enterprises, and individuals. However, traditional technologies are difficult to timely detect malware that has been deformed, confused, or modified since they usually detect hosts before being infected by malware. Host detection during malware infection can make up for their deficiency. Moreover, the infected host usually sends a connection request to the command and control (C&C) server using the HTTP protocol, which generates malicious external traffic. Thus, if the host is found to have malicious external traffic, the host may be a host infected by malware. Based on the background, this paper uses HTTP traffic combined with eXtreme Gradient Boosting (XGBoost) algorithm to detect infected hosts in order to improve detection efficiency and accuracy. The proposed approach uses a template automatic generation algorithm to generate feature templates for HTTP headers and uses XGBoost algorithm to distinguish between malicious traffic and normal traffic. We conduct a performance analysis to demonstrate that our approach is efficient using dataset, which includes malware traffic from MALWARE-TRAFFIC-ANALYSIS.NET and normal traffic from UNSW-NB 15. Experimental results show that the detection speed is about 1859 HTTP traffic per second, and the detection accuracy reaches 98.72%, and the false positive rate is less than 1%.

The Slow HTTP Distributed Denial of Service Attack Detection in Cloud

Cloud computing became popular due to nature as it provides the flexibility to add or remove the resources on-demand basis. This also reduces the cost of investments for the enterprises significantly. The adoption of cloud computing is very high for enterprises running their online applications. The availability of online services is critical for businesses like financial services, e-commerce applications, etc. Though cloud provides availability, still these applications are having potential threats of going down due to the slow HTTP Distributed Denial of Service (DDoS) attack in the cloud. The slow HTTP attacks intention is to consume all the available server resources and make it unavailable to the real users. The slow HTTP DDoS attack comes with different formats such as slow HTTP headers attacks, slow HTTP body attacks and slow HTTP read attacks. Detecting the slow HTTP DDoS attacks in the cloud is very crucial to safeguard online cloud applications. This is a very interesting and challenging topic in DDoS as it mimics the slow network. This paper proposed a novel method to detect slow HTTP DDoS attacks in the cloud. The solution is implemented using the OpenStack cloud platform. The experiments conducted exhibits the accurate results on detecting the attacks at the early stages. The slowHTTPTest open source tool is used in this experiment to originate slow HTTP DDoS attacks.

HTTP SECURITY HEADERS

Nowadays security becomes more important than the content and the SEO of a web application. Due to a lack of protection, the number of attacked websites augments in the past few years. In most of the cases, developers are either uninformed or unqualified to implement security during the application development, which causes a huge amount of data flaws. Supporting the developers and easily managing the workflow, some organizations have developed different kind of guidelines for security integration. Such guide helps handling the security from the outset of the development process, which influence over the protection of the entire application. The one used in this article is a project developed by Open Web Application Security Project (OWASP) Foundation named OWASP Secure Headers Project. Its aim is to show the developers the balance between usability and security implemented through http headers. By giving general data and examples of HTTP response headers usability it is a platform which help increasing the security of the application. In this article, we explain the necessity of HTTP Security Headers and how they can help in preventing a cyber invasion in our web application! We will give details on the most important HTTP headers and will retrieve a basic information for some with a lower need. We will give examples for their implementation in one ASP.NET web application to provide more descriptive perspective of their use! In the recent years, browsers have integrated certain security header controls to support the web application security. Those headers give instructions to the browser how to behave when handling sensitive content and data of the application. If developers enable them in the application, browser will prevent attacks automatically. But not all browsers support them, which brings a compatibility question: what are the alternatives in a case of deprecated header on a specific browser. As a part of the research we will provide an analyze of the use of the HTTP headers in some of the most common sites used in Bulgaria with the help of ALEXA Top 1 Million sites. There have already been developed a lot of applications to show if a certain website has HTTP security headers implemented. Most of them are freely to use and gives detailed information on what was done and what should be done in case that specific layer of security is missing from the web application. The need of security in the web applications become more and more necessary. Along with other security implementations on a programming and on a server level the ones described in the article bring another layer of security management that mitigates certain types of cyberattacks and vulnerabilities.

Analysis of the adoption of security headers in HTTP

With the increase in the number of threats within web-based systems, a more integrated approach is required to ensure the enforcement of security policies from the server to the client. These policies aim to stop man-in-the-middle attacks, code injection, and so on. This study analyses some of the newest security options used within HTTP responses, and scans the Alexa Top 1 Million sites for their implementation within HTTP responses. These options scanned for include: content security policy, public key pinning extension for HTTP, HTTP strict transport security, and HTTP header field X-frame-options, in order to understand the impact that these options have on the most popular websites. The results show that, while the implementation of the parameters is increasing, it is still not implemented on many of the top sites. Along with this, the study shows the profile of adoption of Let's Encrypt digital certificates across the one million sites, along with a way of assessing the quality of the security headers.