Web Application Security Research Articles

DATABASE PROTECTION BASED ON WEB APPLICATION FIREWALL

Web applications are increasingly being used in activities such as reading news, paying bills, and shopping online. As these services grow, you can see an increase in the number and extent of attacks on them, such as: theft of personal information, bank data and other cases of cybercrime. All of the above is a consequence of the openness of information in the database. Web application security is highly dependent on database security. Client request data is usually retrieved by a set of requests that request the application user. If the data entered by the user is not scanned very carefully, you can collect a whole host of types of attacks that use web applications to create security threats to the database. Unfortunately, due to time constraints, web application programmers usually focus on the functionality of web applications, but only few worry about security. This article provides methods for detecting anomalies using a database firewall. The methods of penetration and types of hacks are investigated. A database firewall is proposed that can block known and unknown attacks on Web applications. This software can work in various ways depending on the configuration. There are almost no false positives, and the overhead of performance is relatively small. The developed database firewall is designed to protect against attacks on web application databases. It works as a proxy, which means that requests for SQL expressions received from the client will first be sent to the developed firewall, rather than to the database server itself. The firewall analyzes the request: requests that are considered strange are blocked by the firewall and an empty result is returned to the client.

A Novel Data Augmentation Technique and Deep Learning Model for Web Application Security

Web applications are often exposed to attacks because of the critical information and valuable assets they host. In this study, Bi-LSTM based web application security models were developed in order to detect web attacks and classify them into binary or multiple classes using HTTP requests. A novel data augmentation technique based on the self-adapting noise adding method (DA-SANA) was developed. The DA-SANA method solves the low sensitivity problem caused by imbalanced data and the complex structure of multi-class classification in web attack detection. Experimental evaluations are carried out in detail using two benchmark web security datasets and a newly created dataset within the scope of the study. The achieved worst case detection rates are 98.34% and 93.91% for binary-class and multi-class classifications, respectively. The proposed DA-SANA technique provides an average of 6.52% improvement in multi-class classification for two datasets. These results revealed that the best classification performance values were achieved when compared with previous studies.

What is DOM XSS and why should you care?

For more than 10 years, cross-site scripting (XSS) has been included in OWASP's ‘Top 10 Web Application Security Risks’. 1 Although the issue is very well documented, it is sometimes overlooked by application owners. As a result, penetration testers frequently encounter this vulnerability, which takes several forms. For more than 10 years, cross-site scripting (XSS) has been included in OWASP's top web application security risks. Yet it's an issue that is often overlooked. The problem has also evolved and many people still do not understand the risks surrounding Document Object Model (DOM) or client-side XSS. Through understanding the vector itself, threat surfaces of applications will become ever-more restricted and safer for the end user. A thorough understanding of DOM-based XSS will help balance the scales of application security and usability, says Josh Hickling of Pentest People.

АВТОМАТИЗИРОВАННЫЙ ПОИСК УЯЗВИМОСТЕЙ ВЕБ-ПРИЛОЖЕНИЯ НА ОСНОВЕ МАШИННОГО ОБУЧЕНИЯ С ПОДКРЕПЛЕНИЕМ

We analyzed the urgency of the task of creating a more efficient (compared to analogues) means of automated vulnerability search based on modern technologies. We have shown the similarity of the vulnerabilities identifying process with the Markov decision-making process and justified the feasibility of using reinforcement learning technology for solving this problem. Since the analysis of the web application security is currently the highest priority and in demand, within the framework of this work, the application of the mathematical apparatus of reinforcement learning with to this subject area is considered. The mathematical model is presented, the specifics of the training and testing processes for the problem of automated vulnerability search in web applications are described. Based on an analysis of the OWASP Testing Guide, an action space and a set of environment states are identified. The characteristics of the software implementation of the proposed model are described: Q-learning is implemented in the Python programming language; a neural network was created to implement the learning policy using the tensorflow library. We demonstrated the results of the Reinforcement Learning agent on a real web application, as well as their comparison with the report of the Acunetix Vulnerability Scanner. The findings indicate that the proposed solution is promising.

Black-box Fuzzing Approaches to Secure Web Applications: Survey

Web applications are increasingly important tools in our modern daily lives, such as in education, business transac-tions, and social media. Because of their prevalence, they are becoming more susceptible to different types of attacks that exploit security vulnerabilities. Exploiting these vulnerabilities may cause damage to the web applications as well as the end-users. Thus, web apps’ developers should identify vulnerabilities and fix them before an attacker exploits them. Using black-box fuzzing techniques for vulnerability identification is very popular during the web apps’ development life cycle. These techniques pledge to find vulnerabilities in web applications by constructing attacks without accessing their source codes. This survey explores the research that has been done in the black-box vulnerability finding and exploits construction in web applications and proposes future directions.

Evaluating the Impact of Malware Analysis Techniques for Securing Web Applications through a Decision-Making Framework under Fuzzy Environment

Nowadays, most of the cyber-attacks are initiated by extremely malicious programs known as Malware. Malwares are very vigorous and can penetrate the security of information and communication systems. While there are different techniques available for malware analysis, it becomes challenging to select the most effective approach. In this context, the decision-making process may be an efficient means of empirically assessing the impact of different methods for securing the web applications. In this research study, we have used a methodology that includes the integration of Fuzzy AHP and Fuzzy TOPSIS technique for evaluating the impact of different malware analysis techniques in web application perspective. This study uses different versions of a university’s web application for evaluating the impact of several existing malware analysis techniques. The findings of the study show that the Reverse Engineering approach is the most efficient technique for analyzing complex malware. The outcome of this study would definitely aid the future researchers and developers in selecting the appropriate techniques for scanning the web application code and enhancing the security.

MODERN TOOLS FOR SECURITY TESTING FROM OWASP

With the development of information technology, humanity is increasingly delving into the world of gadgets, cloud technology, virtual reality, and artificial intelligence. Through web applications, we receive and distribute information, including confidential. During the pandemic, most people switched to online work and study. As a result, most of the data stored on personal computers, company servers, and cloud storage needs protection from cyberattacks. The problem of cybersecurity at the moment is incredibly relevant due to the hacking of cryptocurrencies, websites of ministries, bitcoin wallets or social network accounts. It is necessary to conduct high-quality testing of developed applications to detect cyber threats, to ensure reliable protection of different information. The article states that when testing applications, it checks for vulnerabilities that could arise as a result of incorrect system setup or due to shortcomings in software products. The use of innovation is necessary to improve quality. Modern realities have become a challenge for the development of cybersecurity products. Improvement of technology requires modern companies to update their IT systems and conduct regular security audits. The research is devoted to the analysis of modern OWASP testing tools that contribute to data security, with a view to their further use. The Open Web Application Security Project is an open security project. The research revealed a list of the most dangerous vectors of attacks on Web-applications, in particular, OWASP ZAP performs analyzes the sent and received data system security scanning at the primary level, MSTG performs security testing of mobile applications iOS and Android mobile devices. The practical result of the work is to test a specially developed web-application and identify vulnerabilities of different levels of criticality.

Hybrid Security AssessmentMethodology forWeb Applications

This study presents a methodology to evaluate and prevent security vulnerabilities issues for web applications. The analysis process is based on the use of techniques and tools that allow to perform security assessments of white box and black box, to carry out the security validation of a web application in an agile and precise way. The objective of the methodology is to take advantage of the synergies of semi-automatic static and dynamic security analysis tools and manual checks. Each one of the phases contemplated in the methodology is supported by security analysis tools of different degrees of coverage, so that the results generated in one phase are used as feed for the following phases in order to get an optimized global security analysis result. The methodology can be used as part of other more general methodologies that do not cover how to use static and dynamic analysis tools in the implementation and testing phases of a Secure Software Development Life Cycle (SSDLC). A practical application of the methodology to analyze the security of a real web application demonstrates its effectiveness by obtaining a better optimized vulnerability detection result against the true and false positive metrics. Dynamic analysis with manual checking is used to audit the results, 24.6 per cent of security vulnerabilities reported by the static analysis has been checked and it allows to study which vulnerabilities can be directly exploited externally. This phase is very important because it permits that each reported vulnerability can be checked by a dynamic second tool to confirm whether a vulnerability is true or false positive and it allows to study which vulnerabilities can be directly exploited externally. Dynamic analysis finds six (6) additional critical vulnerabilities. Access control analysis finds other five (5) important vulnerabilities such as Insufficient Protected Passwords or Weak Password Policy and Excessive Authentication Attacks, two vulnerabilities that permit brute force attacks.

Models and scenarios of implementation of threats for internet resources

To facilitate the detection of various vulnerabilities, there are many different tools (scanners) that can help analyze the security of web applications and facilitate the development of their protection. But these tools for the most part can only identify problems, and they are not capable of fixing them. Therefore, the knowledge of the security developer is a key factor in building a secure Web resource. To resolve application security problems, developers must know all the ways and vectors of various attacks in order to be able to develop various protection mechanisms. This review discusses two of the most dangerous vulnerabilities in the field of Web technologies: SQL injections and XSS attacks (cross-site scripting – XSS), as well as specific cases and examples of their application, as well as various approaches to identifying vulnerabilities in applications and threat prevention. Cross-site scripting as well as SQL-injection attacks are related to validating input data. The mechanisms of these attacks are very similar, but in the XSS attacks the user is the victim, and in the SQL injection attacks, the database server of the Web application. In XSS attacks, malicious content is delivered to users by means of a client-side programming language such as JavaScript, while using SQL injection, the SQL database query language is used. At the same time, XSS attacks, unlike SQL injections, harm only the client side leaving the application server operational. Developers should develop security for both server components and the client part of the web application.

Automated server-side model for recognition of security vulnerabilities in scripting languages

With the increase of global accessibility of web applications, maintaining a reasonable security level for both user data and server resources has become an extremely challenging issue. Therefore, static code analysis systems can help web developers to reduce time and cost. In this paper, a new static analysis model is proposed. This model is designed to discover the security problems in scripting languages. The proposed model is implemented in a prototype SCAT, which is a static code analysis Tool. SCAT applies the phases of the proposed model to catch security vulnerabilities in PHP 5.3. Empirical results attest that the proposed prototype is feasible and is able to contribute to the security of real-world web applications. SCAT managed to detect 94% of security vulnerabilities found in the testing benchmarks; this clearly indicates that the proposed model is able to provide an effective solution to complicated web systems by offering benefits of securing private data for users and maintaining web application stability for web applications providers.

Применение машинного обучения в защите веб-приложений

Security of network systems has become a necessity, as more and more important information is stored and used online. The spread of web applications opens up new attack vectors. Traditional security mechanisms, such as firewalls, are not designed to protect web applications and therefore do not provide adequate protection. Current attacks cannot be prevented only by blocking ports 80 (HTTP) and 443 (HTTPS). Preventative measures (such as web application firewall rules) are not always possible. Signature methods for detection are always behind the actual event. Protocol-enforced network firewalls usually provide the first line of defense, delaying most major attacks on the network perimeter. They mainly work on the network, session, and transport layers of the reference network model (OSI). Developers have significantly expanded the capabilities of network firewalls to control the integrity of a wide range of top-level protocols, such as DNS, FTP, HTTP, SMTP, and TFTP. Standard firewalls can help restrict or allow access to network ports. Although application proxy firewalls exist, they cannot understand the specific content of all web applications run by an enterprise. The purpose of this article is to study the features of using machine learning in web application protection. Methods of web application security and learning neural networks were studied. The result of this work is a theoretical overview of the neural network security of a web application.

Static analysis for discovering IoT vulnerabilities

The Open Web Application Security Project (OWASP), released the “OWASP Top 10 Internet of Things 2018” list of the high-priority security vulnerabilities for IoT systems. The diversity of these vulnerabilities poses a great challenge toward development of a robust solution for their detection and mitigation. In this paper, we discuss the relationship between these vulnerabilities and the ones listed by OWASP Top 10 (focused on Web applications rather than IoT systems), how these vulnerabilities can actually be exploited, and in which cases static analysis can help in preventing them. Then, we present an extension of an industrial analyzer (Julia) that already covers five out of the top seven vulnerabilities of OWASP Top 10, and we discuss which IoT Top 10 vulnerabilities might be detected by the existing analyses or their extension. The experimental results present the application of some existing Julia’s analyses and their extension to IoT systems, showing its effectiveness of the analysis of some representative case studies.

NCOG-43. NEUROCOGNITIVE IMPAIRMENT AND FRAILTY IN GERIATRIC PATIENTS WITH HIGH GRADE GLIOMA AND THORACIC MALIGNANCY

Abstract BACKGROUND The median age at diagnosis for high grade glioma is 64 years. With peak incidence 75-84, malignant glial tumors are frequently a disease of the elderly. Common assessment measures fail to accurately gauge geriatric cancer patient fitness. Comprehensive Geriatric Assessment (CGA) is recommended in patients older than 65 to gauge risk of toxicity and tolerance of therapeutic intervention. We reviewed data for older patients with high grade glioma (HGG) and thoracic malignancy (TM) who underwent CGA via Senior Oncology Clinic (SOC) at Levine Cancer Institute. METHODS From 2015 to 2019 104 thoracic malignancy patients and 19 high grade glioma patients completed CGA via SOC before treatment or a required change in therapy. Data was incorporated into the LCI Senior Oncology Database by the REDCap secure web application, allowing for both quantitative and qualitative data analysis. RESULTS The median age was 77 in the HGG cohort compared to 80 years with TM. The physician rated Karnofsky Performance Status (KPS) for HGG and TM were similar (76% v 79%) as were the percentages of patients that were frail or prefrail (90% v 87%). Montreal Cognitive Assessment scores were lower in HGG (20 v 23). Considerably more HGG had falls in the 6 months before their assessment (58% v 30%) and gait speed was slower (0.76 m/s v 0.85 m/s). CONCLUSIONS Older patients with high grade gliomas compared to similar thoracic malignancies had more neurocognitive impairment, falls in the preceding 6 months, and slower gait speed. Physician rated KPS and frailty were similar in both groups. The results illustrate the limitations of physician-rated performance measures and highlight the importance of CGA in older brain tumor patients.

WITHDRAWN: The security in web application of cloud and IoT service

This article has been withdrawn: please see Elsevier Policy on Article Withdrawal (https://www.elsevier.com/about/our-business/policies/article-withdrawal). This article has been withdrawn as part of the withdrawal of the Proceedings of the International Conference on Emerging Trends in Materials Science, Technology and Engineering (ICMSTE2K21). Subsequent to acceptance of these Proceedings papers by the responsible Guest Editors, Dr S. Sakthivel, Dr S. Karthikeyan and Dr I. A. Palani, several serious concerns arose regarding the integrity and veracity of the conference organisation and peer-review process. After a thorough investigation, the peer-review process was confirmed to fall beneath the high standards expected by Materials Today: Proceedings. The veracity of the conference also remains subject to serious doubt and therefore the entire Proceedings has been withdrawn in order to correct the scholarly record.

A novel architecture for web-based attack detection using convolutional neural network

Unprotected Web applications are vulnerable places for hackers to attack an organization's network. Statistics show that 42% of Web applications are exposed to threats and hackers. Web requests that Web users request from Web applications are manipulated by hackers to control Web servers. Web queries are detected to prevent manipulations of hacker's attacks. Web attack detection is extremely essential in information distribution over the past decades. Anomaly methods based on machine learning are preferred in the Web application security. This present study aimed to propose an anomaly-based Web attack detection architecture in a Web application using deep learning methods. The architecture structure consists of data preprocess and Convolution Neural Network (CNN) steps. To prove the suitability and success of the proposed CNN architecture, CSIC2010v2 datasets were used. The proposed architecture performed detection of Web attacks, using anomaly-based detection type. Based on the experimental results of the study, the proposed CNN deep learning architecture presented successful outcomes.

Mutation Testing and Its Analysis on Web Applications for Defect Prevention and Performance Improvement

The society's increasing reliance on web applications with the growing online market and digitization of almost every service, there is an increasing demand for better reliability, security, and interoperability of web applications. Testing becomes an integral part of improving this reliability on web applications. Despite the innumerable number of tools, techniques, methods for testing web applications, there is still scope for expansion in the code coverage of web applications. Mutation testing with its expansive potential to expose vulnerabilities of web applications took a backseat owing to its exhaustive testing cycles. Some mutation operators related to security, performance, and other non-functional attributes of web applications are presented in the current work. In the current work, a thorough analysis of various mutations operators proposed by authors towards the non-existent operators thus far is presented. An augment of 47% of operators occurred in the present work. A concise discussion on the scope of work future direction of work is presented.

A Survey on Web Application Security

Web application security has become real concern due to increase in attacks and data breaches. As Application becomes critical, complex and connected, the difficulty of achieving application security increases exponentially. Also there are tools and techniques to detect such attacks, threat and vulnerabilities that exist in application which developer prevent and mitigate the risk associated to it. This paper evaluates various web application attack detection mechanisms and how resistant they are against various attacking techniques. Such an evaluation is important for not only measuring the available attack defense against web application attacks but also identifying gaps to build effective solutions for different defense techniques on web application and use it for study. Based on the research, the limitations of these application attack detection techniques are identified and remedies proposed for improving the current state attack detection on web applications.

Web Uygulamalarında Güvenlik ve Süreç Etkinliği Kapsamında Bir Araç: DEBSA

The spread of internet usage has been increased the usage of web applications with regards to both individuals and organizations. Attacks on web applications are increasing day by day in order to have this knowledge in web applications. Some security measures are needed to prevent these attacks on web applications by people or organizations. During development of web applications, some security holes are inevitable although how measures are taken. Therefore, besides these measures, web applications should keep control and audit continuously. Many software has been developed to test web application. However, besides these tests, it is necessary to provide the continuity of security of web applications. Continuity of control of web applications is almost impossible on an individual basis. Planning these controls by software that performs tests, provides continuity. The general purpose of this study is to develop a process model that will control the security of web applications. In this sense, a software has been developed that tests web applications and can turn it into processes. The developed software carries out tests that find vulnerabilities on web applications..Also, this software provides planning tests by means of process management part on it and informing people who are responsible for control automatically.

An efficient approach for reviewing security-related aspects in agile requirements specifications of web applications

Defects in requirement specifications can have severe consequences during the software development life cycle. Some of them may result in poor product quality and/or time and budget overrun due to incorrect or missing quality characteristics, such as security. This characteristic requires special attention in web applications because they have become a target for manipulating sensible data. Several concerns make security difficult to deal with. For instance, security requirements are often misunderstood and improperly specified due to lack of security expertise and emphasis on security during early stages of software development. This often leads to unspecified or ill-defined security-related aspects. These concerns become even more challenging in agile contexts, where lightweight documentation is typically produced. To tackle this problem, we designed an approach for reviewing security-related aspects in agile requirements specifications of web applications. Our proposal considers user stories and security specifications as inputs and relates those user stories to security properties via natural language processing. Based on the related security properties, our approach identifies high-level security requirements from the Open Web Application Security Project (OWASP) to be verified and generates a reading technique to support reviewers in detecting defects. We evaluate our approach via three experimental trials conducted with 56 novice software engineers, measuring effectiveness, efficiency, usefulness and ease of use. We compare our approach against using: (1) the OWASP high-level security requirements and (2) a perspective-based approach as proposed in contemporary state of the art. The results strengthen our confidence that using our approach has a positive impact (with large effect size) on the performance of inspectors in terms of effectiveness and efficiency.

An efficient security data-driven approach for implementing risk assessment

Information security implementation in an organization regardless of its business processes will not be effective. Current approaches to risk assessment have moved towards business process-oriented ones. Thus, in new approaches, assets are got attention based on the business processes involved. But existing approaches that are based on business processes have their drawbacks. For example, we need to detail processes to know what security data is produced or used in tasks, and what are their importance from the organization’s point of view. Security data certainly has different meanings. How security data moves in an organization’s network environment is another important point. Therefore, the main task in information security would be protecting security data, from the point of creation location to storage.In this paper, several improvements over other solutions are presented. The business processes of the organization are categorized according to security concerns (called fear stories). In the next improvement, we have gone one step further in the business processes, which is extracting the organization’s security data. Therefore, security data plays a key role in our model. The next improvement is the introduction of the security data life cycle (creation, edit, display, process, transfer, store), and its adaptation to the asset layers (logical, physical, and human) through a series of predefined patterns. Thus, in this model, a multi-organization pyramid of security needs will be formed, each pyramid being a hierarchical multi-layer, involving security concerns, related business processes, extracted security data, assets involved, identified risks and optimal combination of security controls. At the end of the paper, we will show how the model presented in this paper will effectively improve the popular risk assessment methods such as CVSS (Common Vulnerability Scoring System) and OWASP (Open Web Application Security Project).