Victim Web Research Articles

The World of Defacers: Looking Through the Lens of Their Activities on Twitter

Many web-based attacks have been studied to understand how web hackers behave, but web site defacement attacks (malicious content manipulations of victim web sites) and defacers' behaviors have received less attention from researchers. This paper fills this research gap via a computational data-driven analysis of a public database of defacers and defacement attacks and activities of 96 selected defacers who were active on Twitter. We conducted a comprehensive analysis of the data: an analysis of a friendship graph with 10,360 nodes, an analysis on how sentiments of defacers related to attack patterns, and a topical modelling based analysis to study what defacers discussed publicly on Twitter. Our analysis revealed a number of key findings: a modular and hierarchical clustering method can help discover interesting sub-communities of defacers; sentiment analysis can help categorize behaviors of defacers in terms of attack patterns; and topic modelling revealed some focus topics (politics, country-specific topics, and technical discussions) among defacers on Twitter and also geographic links of defacers sharing similar topics. We believe that these findings are useful for a better understanding of defacers' behaviors, which could help design and development of better solutions for detecting defacers and even preventing impeding defacement attacks.

An adaptive system for detecting malicious queries in web attacks

Web request query strings (queries), which pass parameters to the referenced resource, are always manipulated by attackers to retrieve sensitive data and even take full control of victim web servers and web applications. However, existing malicious query detection approaches in the current literature cannot cope with changing web attacks with constant detection models. In this paper, we propose AMODS, an adaptive system that periodically updates the detection model to detect the latest unknown attacks. We also propose an adaptive learning strategy, called SVM HYBRID, leveraged by our system to minimize manual work. In the evaluation, an up-to-date detection model is trained on a ten-day query dataset collected from an academic institute's web server logs. Our system outperforms existing web attack detection methods, with an F-value of 94.79% and FP rate of 0.09%. The total number of malicious queries obtained by SVM HYBRID is 2.78 times that by the popular Support Vector Machine Adaptive Learning (SVM AL) method. The malicious queries obtained can be used to update the Web Application Firewall (WAF) signature library.

Isolating malicious content scripts of browser extensions

In recent years, browser extensions gain great popularity among users, as they significantly enhance functionality and improve the usability of web browsers. Browser extensions can have high privileges to access web page content, thus recent browsers, such as Chrome, controls their capabilities with permissions. However, permission control is not effective to control the behaviours of content scripts injected into web sessions. Once injected into victim web sessions, malicious content scripts can perform all sorts of actions in a web application without user's knowledge. Therefore, content scripts pose serious threats to the confidentiality and integrity of web application data. To address this problem, we propose a mechanism, SessionGuard, which isolates content scripts in an isolated environment, called the shadow DOM. With the shadow DOM, SessionGuard provides content scripts an encrypted view of web application data, and controls their access to the original DOM. We have developed a proof-of-concept prototype in the Google Chrome web browser with little effect on normal browsing experience. Our experiments with real-world browser extensions demonstrate the effectiveness of the SessionGuard in protecting the confidentiality and integrity of web application data against malicious content scripts.

A comprehensive approach to discriminate DDoS attacks from flash events

Most of the business applications on the Internet are dependent on web services for their transactions. Distributed denial of service (DDoS) attacks either degrade or completely disrupt web services by sending a flood of packets in the form of legitimate looking requests towards the victim web servers. Flash event (FE), which is an overload condition caused by a large number of legitimate requests, has similar characteristics as that of DDoS attacks. Therefore, detection of DDoS attacks with FE as background traffic is one of the hardest problems confronted by the network security researchers. Moreover, DDoS attacks and FEs require altogether different handling procedures. In this paper, traffic cluster entropy is derived from source address entropy and their combination is used not only to detect various types of DDoS attacks against web services but also to distinguish DDoS attacks from FEs. Optimal thresholds for traffic cluster entropy are calibrated through receiver operating characteristic curve (ROC). Proposed detection approach can operate in one of the defence modes: naive, normal or best, based on attack detection sensitivity requirements. Sensitivity of detection metric is tested using multiple simulation scenarios with different types of DDoS attacks along with variation in origins of attack and FE traffic. Detection of a variety of DDoS attacks like high rate skewed DDoS attacks, low rate isotropic attacks, subnet spoofed DDoS attacks and sophisticated DDoS attacks has been demonstrated. The effectiveness of the proposed approach in terms of false positive rate, detection rate and classification rate is validated through simulations carried out using NS-2 on a Linux platform.

Exploitation of Cross-Site Scripting (XSS) Vulnerability on Real World Web Applications and its Defense

on web applications are growing rapidly with the opening of new technologies, HTML tags and JavaScript functions. Cross-Site Scripting (XSS) vulnerabilities are being exploited by the attackers to steal web browser's resources (cookies, credentials etc.) by injecting the malicious JavaScript code on the victim's web applications. The existing techniques like filtering of tags and special characters, maintaining a list of vulnerable sites etc. cannot eliminate the XSS vulnerabilities completely. In this paper, initially we have tried out the experiments on the exploitation of XSS vulnerabilities using local host server (i.e. XAMPP). After this, we have investigated for the XSS vulnerabilities on social networking sites (like Facebook, Orkut, Blogs, Twitter etc.) and tried to exploit the same on blogs. Finally, on the basis of some analysis and results, we have discussed a novel technique of mitigating this XSS vulnerability by introducing a Sandbox environment on the web browser. Keywordsare your own designated keywords which can be used for easy location of the manuscript using any search engines.

DDoS Traffic Verification Algorithm for Legitimate Clients Identification in Distributed Denial of Service (DDoS) Attacks

Denial of Service (DDoS) attacks have become a major threat to the stability of the internet and there is no satisfactory solution yet. These attacks are familiar threats to internet users for more than 10 years. Such attacks are carried out by a bot-net, an army of zombie hosts spread around the internet, that overwhelm the bandwidth toward their victim web server, by sending traffic upon command. This paper introduces traffic verification algorithm is especially designed to protect the victim server from the harm attacks and legitimate clients are identified in an effective manner. The legitimate clients are maintained in a separate list called whitelist and it will be refreshed frequently. So the attacker cant spoof the legitimate client addresses. The simulation result shows that the legitimate clients are maintained in an effective manner. KeywordsDenial of Service (DDoS), botnet, zombie.

WDA: A Web farm Distributed Denial Of Service attack attenuator

Distributed Denial Of Service (DDoS) attacks are familiar threats to Internet users for more than 10 years. Such attacks are carried out by a “bot-net”, an army of zombie hosts spread around the Internet, that overwhelm the bandwidth toward their victim Web server, by sending traffic upon command. This paper introduces WDA, a novel architecture to attenuate the DDoS attacker’s bandwidth. WDA is especially designed to protect Web farms. WDA is asymmetric and only monitors and protects the uplink toward the Web farm, which is the typical bottleneck in DDoS attacks. Legitimate traffic toward Web farms is very distinctive since it is produced by humans using Web-browsing software. Specifically, such upload traffic has low volume, and more importantly, has long off times that correspond to human view time. WDA utilizes these properties of legitimate client traffic to distinguish it from attack traffic, which tends to be continuous and heavy. A key feature of WDA is in its use of randomized thresholds that trap and penalize deterministic zombie traffic that tries to mimic human client patterns. WDA’s heart is WDAQ, a novel active queue management mechanism aimed to prefer legitimate client traffic over attacker traffic. With WDA installed, the attacker traffic toward the victim is attenuated. Extensive simulation results show that WDA can defeat simple flooding attacks, and can attenuate the bandwidth usable by sophisticated WDA-aware attacks by orders of magnitude. As a consequence, the attacker must increase his “bot-net” size by the same factor, to compensate for the effects of WDA. Our simulations show that WDA can defend a typical Web farm from DDoS attacks launched by hundreds of thousands zombies, while keeping legitimate clients’ service degradation under 10%.