Malicious Requests Research Articles

DoubleR: Effective XSS attacking reality detection

Cross-site scripting (XSS) attack has been one of the most dangerous attacks in cyberspace security. Traditional methods essentially discover XSS attack by detecting malicious payloads in requests, which is unable to distinguish blind&random scanning with the attacking reality. Moreover, it also brings tens of thousands of worthless security alerts to administrators, as well as unfriendly experience to users. In this paper, we propose DoubleR, a bi-directional framework which detects both Requests and Responses to discover XSS attacking reality. On the basis of conventional detection of malicious requests, DoubleR collects responses from web server and trains a bagging based PU learning model to determine whether the vulnerability is truly triggered. To validate our proposed framework, experiments are performed on 5 popular Web applications with 11 specified CVE recorded vulnerabilities. Results show that DoubleR effectively distinguishes attacking reality from attacking attempts, reduce the worthless security alarms, and at the same time works well on other web attacks of the same type.

Automated Network Incident Identification through Genetic Algorithm-Driven Feature Selection

The cybersecurity landscape presents daunting challenges, particularly in the face of Denial of Service (DoS) attacks such as DoS Http Unbearable Load King (HULK) attacks and DoS GoldenEye attacks. These malicious tactics are designed to disrupt critical services by overwhelming web servers with malicious requests. In contrast to DoS attacks, there exists nefarious Operating System (OS) scanning, which exploits vulnerabilities in target systems. To provide further context, it is essential to clarify that NMAP, a widely utilized tool for identifying host OSes and vulnerabilities, is not inherently malicious but a dual-use tool with legitimate applications, such as asset inventory services in company networks. Additionally, Domain Name System (DNS) botnets can be incredibly damaging as they harness numerous compromised devices to inundate a target with malicious DNS traffic. This can disrupt online services, leading to downtime, financial losses, and reputational damage. Furthermore, DNS botnets can be used for other malicious activities like data exfiltration, spreading malware, or launching other cyberattacks, making them a versatile tool for cybercriminals. As attackers continually adapt and modify specific attributes to evade detection, our paper introduces an automated detection method that requires no expert input. This innovative approach identifies the distinct characteristics of DNS botnet attacks, DoS HULK attacks, DoS GoldenEye attacks, and OS-Scanning, explicitly using the NMAP tool, even when attackers alter their tactics. By harnessing a representative dataset, our proposed method ensures robust detection of such attacks against varying attack parameters or behavioral shifts. This heightened resilience significantly raises the bar for attackers attempting to conceal their malicious activities. Significantly, our approach delivered outstanding outcomes, with a mid 95% accuracy in categorizing NMAP OS scanning and DNS botnet attacks, and 100% for DoS HULK attacks and DoS GoldenEye attacks, proficiently discerning between malevolent and harmless network packets. Our code and the dataset are made publicly available.

Detection of malicious requests aimed at disrupting the availability of cyber-physical systems

The work is devoted to solving the problem of algorithmization of the security management processes of cyber-physical systems by detecting malicious requests aimed at disrupting the availability of management interfaces. Particular attention is paid to attacks aimed at denial of service of cyber-physical systems by sending HTTP-flood to web management interfaces. This paper proposes algorithmic provision for comprehensive adaptive analysis of incoming requests. The proposed algorithm for the detection of malicious requests analyses the activity of the investigated components of the cyber-physical system's web service at various network levels. The work applies a visual analysis and data processing method based on the representation as a single normalized set. The raw data of the analysed queries is grouped in a special way to detect a particular anomaly as a suspected threat. Examples of data changes and security responses are given. The experimental results confirm that the proposed algorithmic software achieves first- and second-order error reduction compared to the commonly used regression models in modern application-layer firewalls. The results obtained can be applied to the further development of the theory of information security, in particular the information security of cyber-physical systems and systems of processing of especially protected confidential information.

Artificial Intelligence Web Application Firewall for advanced detection of web injection attacks

AbstractCurrently, web services‐based applications have an important presence in public and private organizations. The vulnerabilities that these types of applications may have pose an inherent potential risk to the business model of these organizations. These applications have the inherent risk of being used by organizations in such a way that their activity is affected and they become the main entry point for attackers who want to breach their security. The main barrier to this type of attack are web application firewalls (WAF), which are responsible for processing Hypertext Transfer Protocol requests between clients and web servers, classifying them and rejecting malicious requests. This type of (WAF) applications, for the most part, have regular expressions that correspond to general rules and allow detecting malicious requests that follow a pattern contained in them. However, due to the knowledge of these rules by attackers, it is easy to circumvent security and to impersonate a malicious request by an innocuous request. Therefore, in this article, we present a study of different models based on artificial intelligence techniques as Naïve Bayes, k‐nearest neighbors, support vector machines, and linear regression to test their effectiveness in detecting malicious requests from a synthetic dataset containing more than 100,000 requests. The results obtained show that the implementation of these methods optimize the detection of malicious requests obtaining results between 92% and 99% of success in their classification.

An Efficient DDoS Attack Detection Using Chaos Henry Gas Solubility Optimization Weight Initialization Based Rectified Linear Unit

The Denial of Service (DoS) attacks is one of the main issues faced by cloud service providers due to their intricate nature. The main aim of this attack is to disrupt the services of authorized users by forwarding massive malicious requests to the victim system. Even though the modern Artificial Intelligence-powered intrusion detection system offers improved benefits, it suffers from analyzing the traces of intrusion in the massive network flow. This article presents a novel Chaos-based Henry Gas Solubility Optimization—Weight initialization based-rectified linear Unit (HGSO-WIB-ReLU) framework to identify different types of DoS attacks like HTTP flood attacks, DNS flood attacks, and ICMP flood attacks. The main aim of this technique is to identify the low rate of DoS attacks which the state-of-art techniques often based on statistical analysis and machine learning are incapable of accomplishing. Convolutional neural network architecture incorporates the WIB-ReLU activation function primarily to prevent vanishing gradient issues and provide efficient training. The WIB-ReLU framework’s hyperparameters are primarily improved using the HGSO method by increasing the classifier’s accuracy rate for detecting DoS attacks. In this way, the proposed model minimized the high false positive rate in identifying low-rate DoS attacks in large datasets. Different benchmark datasets such as BUET- DDoS2020, CIC DoS Attacks, and Low Rate DDoS are used to conduct the experiments and the efficiency of the model is verified in terms of accuracy, F1-measure, and precision score. When evaluated using the BUET-DDoS, CIC-DoS, and Low rate DDoS datasets, the proposed model offers an accuracy of 97%, 96.67%, and 96%, respectively. The experimental analysis conducted demonstrates the effectiveness of the proposed HGSO-WIB-ReLU framework when compared to the different state-of-art methodologies.

Web Application Firewall Based on Anomaly Detection using Deep Learning

Anomaly detection has been researched in different areas and application domains. The main difficulty is to identify the outliers from the normals in case of encountering an input that has unique features and new values. In order to accomplish this task, the research focusses on using Machine Learning and Deep Learning techniques. In the world of the Internet, we are facing a similar problem to identify whether a website request contains malicious activity or just a normal request. Web Application Firewall (WAF) systems provide such protection against malicious requests using a rule based approach. In recent years, anomaly based solutions have been integrated in addition to rule based systems. Still, such solutions can only provide security up to a point and such techniques can generate false-positive results that leave the backend systems vulnerable and most of the time rules based protection can be bypassed with simple tricks (eg. encoding, obfuscation). The main focus of the research is WAF systems that employ single and stacked LSTM layers which are based on character sequences of user supplied data and revealing hyper-parameter values for optimal results. A semi-supervised approach is used and trained with PayloadAllTheThings dataset containing real attack payloads and only normal payloads of HTTP Dataset CSIC 2010 are used. The success rate of the technique - whether the user input is identified as malicious or normal - is measured using F1 scores. The proposed model demonstrated high F1 scores and success in terms of detection and classification of the attacks.

A variable-trust threshold-based approach for DDOS attack mitigation in software defined networks.

Software-defined networks offer a new approach that attracts the attention of most academic and industrial circles due to the features it contains. However, some loopholes make such modern networks vulnerable to many types of attacks. Among the most important types of these attacks is the Distributed Denial of Service (DDoS) attack, which in turn affects the network’s performance and delays many real user requests. As one of the main features of SDN is the centralization of all the control plane in the SDN controller, it becomes a central point of attack that may compromise the whole network. Hence, in our proposed approach, we aim to mitigate the DDoS attack that maybe launched to compromise the SDN controller, flood the control plane and cripple the entire network. Many DDoS mitigation scheme have been proposed, however, determining the threshold between legitimate requests and malicious requests is still a challenging task. Our proposed approach relies on a two-phases algorithm that assigns a variable trust value for every user. This trust value is compared with schemes relying on a threshold value that changes dynamically and assists in detecting the DDoS attack. The first phase of our two-phases algorithm is Header fields extraction, and the second phase is calculating the trust value based on header fields information. Our proposed approach shows better performance than related detection schemes in terms of accuracy, detection rate, and false-positive rate. Where the accuracy of the system reaches up to 98.83% which is high compared to other traditional methods.

A Trust-Influenced Smart Grid: A Survey and a Proposal

A compromised Smart Grid, or its components, can have cascading effects that can affect lives. This has led to numerous cybersecurity-centric studies focusing on the Smart Grid in research areas such as encryption, intrusion detection and prevention, privacy and trust. Even though trust is an essential component of cybersecurity research; it has not received considerable attention compared to the other areas within the context of Smart Grid. As of the time of this study, we observed that there has neither been a study assessing trust within the Smart Grid nor were there trust models that could detect malicious attacks within the substation. With these two gaps as our objectives, we began by presenting a mathematical formalization of trust within the context of Smart Grid devices. We then categorized the existing trust-based literature within the Smart Grid under the NIST conceptual domains and priority areas, multi-agent systems and the derived trust formalization. We then proposed a novel substation-based trust model and implemented a Modbus variation to detect final-phase attacks. The variation was tested against two publicly available Modbus datasets (EPM and ATENA H2020) under three kinds of tests, namely external, internal, and internal with IP-MAC blocking. The first test assumes that external substation adversaries remain so and the second test assumes all adversaries within the substation. The third test assumes the second test but blacklists any device that sends malicious requests. The tests were performed from a Modbus server’s point of view and a Modbus client’s point of view. Aside from detecting the attacks within the dataset, our model also revealed the behaviour of the attack datasets and their influence on the trust model components. Being able to detect all labelled attacks in one of the datasets also increased our confidence in the model in the detection of attacks in the other dataset. We also believe that variations of the model can be created for other OT-based protocols as well as extended to other critical infrastructures.

Evolutionary privacy-preserving learning strategies for edge-based IoT data sharing schemes

The fast proliferation of edge devices for the Internet of Things (IoT) has led to massive volumes of data explosion. The generated data is collected and shared using edge-based IoT structures at a considerably high frequency. Thus, the data-sharing privacy exposure issue is increasingly intimidating when IoT devices make malicious requests for filching sensitive information from a cloud storage system through edge nodes. To address the identified issue, we present evolutionary privacy preservation learning strategies for an edge computing-based IoT data sharing scheme. In particular, we introduce evolutionary game theory and construct a payoff matrix to symbolize intercommunication between IoT devices and edge nodes, where IoT devices and edge nodes are two parties of the game. IoT devices may make malicious requests to achieve their goals of stealing privacy. Accordingly, edge nodes should deny malicious IoT device requests to prevent IoT data from being disclosed. They dynamically adjust their own strategies according to the opponent's strategy and finally maximize the payoffs. Built upon a developed application framework to illustrate the concrete data sharing architecture, a novel algorithm is proposed that can derive the optimal evolutionary learning strategy. Furthermore, we numerically simulate evolutionarily stable strategies, and the final results experimentally verify the correctness of the IoT data sharing privacy preservation scheme. Therefore, the proposed model can effectively defeat malicious invasion and protect sensitive information from leaking when IoT data is shared.

An Enhanced Intrusion Detection System for IoT Networks Based on Deep Learning and Knowledge Graph

Nowadays, the intrusion detection system (IDS) plays a crucial role in the Internet of Things (IoT) networks, which could effectively protect sensitive data from various attacks. However, the existing works have not considered multiview features fusion and failed to capture the semantic relationships among the anomalous requests. They are not robust and cannot detect the attack types in real-time. This paper proposes a lightweight intrusion detection system based on deep learning and knowledge graph. First, our system extracts semantic relationships and key features by knowledge graph and statistical analysis. Then, IoT network requests are converted into word vectors through multiview feature fusion and feature alignment. Finally, an attention-based CNN-BiLSTM model is designed to identify malicious request attacks, which can capture long-distance dependence and contextual semantic information. Experiment results show that the proposed model significantly outperforms the existing solution in the robustness of the model. Moreover, it can select more critical features for IDS to achieve better accuracy and lower the false alarm rate. Compared with the state-of-the-art systems, the proposed IDS achieves a higher detection accuracy of 90.01%. In addition, our system can detect various stealthy attack types (including DoS, Probe, R2L, and U2L) and extract semantic relationships among features.

GTA-IDS: Game Theoretic Approach to Enhance IDS Detection in Cloud Environment

The Internet of Things (IoT) industry is growing with the high-quality collaboration with Cloud Computing. The data generated by the IoT devices is quite large which can be efficiently stored and processed by the cloud. Further, the scenario like COVID-19 led to an unexpected flood of IoT devices on enabling networks to facilitate online services, which increases the potential threats to the companies fighting to remain operational during the crises. Still, the problem with the IoT devices is their weak security implications because vendors prioritize other factors like energy-saving and efficiency at the cost of security. The Attacker can send malicious requests through the vulnerable IoT device to the network and exploit the cloud in various ways. So, to address this issue, a Game Theoretic Approach to enhance IDS detection (GTA-IDS) in Cloud Environment has been devised that helps the Defender system to be more efficient, accurate in decision-making and save energy. The algorithm based on relative information entropy has been developed to defend against such attacks. The Bayesian Nash Equilibrium (BNE) has been used to make the Defender's strategies and perform actions to maximize its payoffs. The model has been tested on the NSL-KDD dataset and the results have been compared to the existing techniques. The results show that despite efforts made by the Attacker, the Defender always gets a better gain and ultimately eliminates the attack.

Detection analysis of malicious cyber attacks using machine learning algorithms

Cybersecurity is the practice of safeguarding information and the systems that store or process information. Cybersecurity violations are the foremost persecution instigated by cyber attackers through one or more systems on single or several networks or systems. This kind of cyber threats can ruthlessly trigger data loss or theft besides halting the network systems partially or fully. Among various cybersecurity attacks, the Denial of Service (DoS) attack is one of the most dominant hacking modus operandi over the internet. The hackers use the weapons at their disposal to disrupt traffic in and around the network surroundings or the target system by bombarding it with a lot of malicious requests. This paper introduced machine learning algorithms such as Gaussian Naïve Bayes and Nearest Centroid to identify the attacks via classifying the given dataset into normal and malicious traffic. Furthermore, metrics such as accuracy, f-score, FNR, precision, and prediction time etc., were calculated to identify the best performing model.

Cipher-Policy Attribute-Based Encryption on Cloud Computing

Cloud computing has drawn expanding interests from both scholastic and industry in the recent years because of its productiveness and low-cost management. Since it offers different types of assistance in an open organization, it is critical for users to utilize secure information for stockpiling and sharing data to guarantee information classification and data users protection. To safely Protect information, the most broadly utilized technique is encryption. The dual-access control, with regards to cloud-based storage, is a control system over both the data owner and the user who can upload and download files without loss of safety, data[1] and effectiveness. The credulous arrangement is that the user can download the whole database[2]. The framework planned in this paper is when the A user logs in with his credentials and after successful acceptance from the two different administrators, the user will be able to download the file present over the cloud. When a malicious user requests, the administrators can find it because it will generate a null value and they can block the user from downloading the files.

Machine Learning Approaches for Combating Distributed Denial of Service Attacks in Modern Networking Environments

A distributed denial of service (DDoS) attack represents a major threat to service providers. More specifically, a DDoS attack aims to disrupt and deny services to legitimate users by overwhelming the target with a massive number of malicious requests. A cyberattack of this kind is likely to result in tremendous economic losses for businesses and service providers due to increasing both operating and financial costs. In recent years, machine learning (ML) techniques have been widely used to prevent DDoS attacks. Indeed, many defense systems have been transformed into smart and intelligent systems through the use of ML techniques, which allow them to defeat DDoS attacks. This paper analyzes recent studies concerning DDoS detection methods that have adapted single and hybrid ML approaches in modern networking environments. Additionally, the paper discusses different DDoS defense systems based on ML techniques that make use of a virtualized environment, including cloud computing, software-defined network, and network functions virtualization environments. As the development of the Internet of Things (IoT) has been the subject of significant research attention in recent years, the paper also discusses ML approaches as security solutions against DDoS attacks in IoT environments. Furthermore, the paper recommends a number of directions for future research. This paper is intended to assist the research community with the design and development of effective defense systems capable of overcoming different types of DDoS attacks.

A Web-Based Honeypot in IPv6 to Enhance Security

IPv6 is a next-generation IP protocol that replaces IPv4. It not only expands the number of network address resources but also solves the problem of multiple access devices connected to the Internet. While IPv6 has brought excellent convenience to the public, related security issues have gradually emerged, and an assessment of the security situation in IPv6 has also become more important. Unlike passive defense, the honeypot is a security device for active defense. The real network application and the fake network application, disguised by the honeypot, are located on a similar subnet, and provide a network application service; but, in both cases, behavior logs from unauthorized users are caught. In this manner, and to protect web-based applications from attacks, this article introduces the design and implementation of a web-based honeypot that includes a weak password module and an SQL inject module, which supports the IPv6 network to capture unauthorized access behavior. We also propose the Security Situation Index (SSI), which can measure the security situation of the network application environment. The value of SSI is established according to the different parameters that are based on honeypots. There is a firewall outside the test system environment, so the obtained data should be used as the real invasion data, and the captured behavior is not a false positive. Threats can be spotted smartly by deploying honeypots; this paper demonstrates that the honeypot is an excellent method of capturing malicious requests and can be measured with the SSI of the whole system. According to the information, the administrator can modify the current security policy, which can improve the security level of a whole IPv6 network system.

Web Application DDoS Attack Defense Using Access Correlation

Web application distributed denial-of-service attack (Web-App DDoS Attack) is a common dangerous attack that hackers use to attack the information systems of organizations. Web application is often hackers' target because this kind of application is an external interface of an organization to provide the organization's activities services. In addition, due to the emergence of weaknesses and security holes in applications and operating systems, hackers can easily create a large-scale botnet for more effective Web-App DDoS Attack. In fact, there have been many research projects related to the defense against this type of attack. However, DDoS attacks still cause serious damage to the systems of organizations due to the fact that the attack methods are increasingly sophisticated and constantly changing. In this study, we propose a method for Web-App DDoS Attack mitigation on the basis of analyzing the relationship among the requests sent to the Web application to find out the source IP address of malicious requests and to perform mitigation. Our method provides a set of criteria that allows determining whether a source IP address is normal or malicious in a short period of time. The criteria also make it difficult for hackers to change the attack methods to overcome the characteristics of the criteria.

Network attack detection and visual payload labeling technology based on Seq2Seq architecture with attention mechanism

In recent years, Internet of things (IoT) devices are playing an important role in business, education, medical as well as in other fields. Devices connected to the Internet is much more than the number of world population. However, it may face all kinds of attacks from the Internet easily for its accessibility. As we all know, most attacks against IoT devices are based on Web applications. So protecting the security of Web services can effectively improve the situation of IoT ecosystem. Conventional Web attack detection methods highly rely on samples, and artificial intelligence detection results are uninterpretable. Hence, this article introduced a supervised detection algorithm based on benign samples. Seq2Seq algorithm is been chosen and applied to detect malicious web requests. Meanwhile, the attention mechanism is introduced to label the attack payload and highlight labeling abnormal characters. The results of experiments show that on the premise of training a benign sample, the precision of proposed model is 97.02%, and the recall is 97.60%. It explains that the model can detect Web attack requests effectively. Simultaneously, the model can label attack payload visually and make the model “interpretable.”

STARVATION DELAYED DHCP SERVICE FOR ENABLING POOL RECOVERY

Dynamic Host Configuration Protocol (DHCP) Internet Protocol (IP) address starvation is a method, used by attackers, to breakdown communication over IP network. In order to solve this problem, a method to detect and recover malicious IP address request by using Internet Control Message Protocol (ICMP) protocol has been proposed. However, the ICMP based was not be able to work faster in detecting and recovering the malicious request than the attack rate. This study proposed an ease and effective authentication method to emphasize on limiting the rate of IP addresses request by malicious client during the DHCP discovering process and prevent the DHCP server from being IP address starved. Experimental results revealed that the proposed method was not only limited to the IP addresses requested time by attackers but also able to prevent the DHCP server from facing the IP address starvation attack.

Dual server based security system for multimedia Services in Next Generation Networks

Next Generation Networks (NGN) provide multimedia services to a large set of users by maintaining concurrent sessions for multimedia services using IP multimedia sub-system (IMS). SIP protocol are used for building, keeping and detaching session with clients. The main problem is that intruders can launch SIP flooding attacks that cause a bottleneck at IMS entities. In this paper, we have presented a Dual Server based Intrusion Detection and Prevention System (DS-IDPS) to guard against INVITE flooding attack. We have proposed two-level security for VoLTE environment by involving two servers titled helper and main servers to handle spoofing and attack detection respectively. We have defined three thresholds at main server by utilizing CUSUM algorithm to generate alarms by detecting intrusion. By attaching DS-IDPS at the middle of client and server, our system filters every request. We have developed a test bed using OpenIMS to develop IMS entities and launch attacks by malicious nodes and detect the intrusion in the system. It reduces CPU load and memory stack from P--CSCF. Results prove that DS-IDPS produces lesser false alarms and detect more number of malicious or bogus requests. Our proposed approach dominates as compared to preliminaries in terms of memory utilization, response time, malicious requests recognition ratios and CPU load consumption.

An IoT Honeynet Based on Multiport Honeypots for Capturing IoT Attacks

Internet of Things (IoT) devices are vulnerable against attacks because of their limited network resources and complex operating systems. Thus, a honeypot is a good method of capturing malicious requests and collecting malicious samples but is rarely used on the IoT. Accordingly, this article implements three kinds of honeypots to capture malicious behaviors. First, on the basis of the CVE-2017–17215 vulnerability, we implement a medium-high interaction honeypot that can simulate a specific series of router UPnP services. It has functions, such as service simulation, log recording, malicious sample download, and service self-check. Second, given the limited details available for the simulated UPnP service and to help the honeypot respond to unrecognizable malicious requests, we use the actual IoT device firmware that matches the vulnerability to build a high-interaction honeypot. In addition, we investigate the most exposed SOAP service ports and design corresponding multiport honeypot to improve the capacity of the honeynet, providing a hybrid service from a real device and simulating honeypots. The Docker in the honeynet, which reduces the volume of the honeypot and realizes the rapid deployment of the honeynet, encapsulates all these honeypots. Moreover, the honeynet control center is simultaneously designed to distribute commands and transfer files to each physical node in the honeynet. We implemented the proposed honeynet system and deployed it in practice. We have successfully caught many unknown malicious attacks excluded in the VT, which proved the effectiveness of the proposed framework.