Web Application Firewalls Research Articles

Web-APT-Detect: A Framework For Web-Based Advanced Persistent Threat Detection Using Self-Translation Machine With Attention

With more and more companies providing online services through the Internet, Web applications have been targeted by hackers. Although the existing signature-based Web Application Firewall (WAF) can well defend against known attack methods against Web applications, it is vulnerable to Web Advanced Persistent Threat (APT) using a large number of unknown Web attack methods to attack online services. In an effort to combat Web-based APT, we propose an unsupervised anomaly detection algorithm, Web-APT-Detect (WAD), which implements self-translation machine through an encoder-decoder using attention mechanism. Our attention mechanisms can improve the quality of self-translation machine used to detect malicious patterns in HTTP requests. Through experiments on the CSIC 2010 dataset, the F1-Score of our algorithm reaches 0.9844, which surpasses the known unsupervised algorithm and reaches the same level as the state-of-the-art supervised algorithm.

A Novel Analysis of Advanced Visual Cryptography Techniques for Providing Security Against Web Attacks Using Support Vector Machine Technique

In today’s internet applications such as some real time application services like core banking and other public service oriented application have been major issue in authentication of user specification. To perform online dictionary attacks, passwords have been used for security and authentication mechanism. Present days, hacking of databases on web oriented applications is unavoidable to access them easily. Data maintenance is a complex task in internet applications. To solve these type of problems in internet applications, in this paper, we proposed a novel Integrated and Dynamic CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) (I&D CAPTCHA), which is extension version of existing CAPTCHA that valuated third party human attacks in internet applications based Visual Cryptography approach to discuss about authentication problem in real time applications. There is more number of methods presented for security in advanced pictures for insurance from inventive uninvolved or dynamic assaults in system correspondence environment. Like insightful Visual Cryptographic (VC) is a cutting edge strategy, which is utilized to mystery picture safely impart furthermore keep up to privacy. To proceed with difficulties of security in advanced picture information sharing, so in this paper we break down various VC security instruments for computerized picture information offering to regard tomystery information secrecy. Our examination give effective security answers for relative mystery advanced picture information imparting to correspondence progressively environment. Security aspects are main concepts in present days because of increasing statistical data storage. In Artificial Intelligence (AI) oriented applications, it is very difficult in terms of protection to increasing new aspects in real time world. So we also plan a Novel and Advanced Security system to enable solution for basic AI problems in this paper. This framework mainly works based on Captcha as visual security passwords (CaRP); it is two way communication plan which means that, it is the combination of Captcha and visual security plan. Our approach mainly worked with image security with respect to selection of passwords based on random way. In this paper, we also propose AMODS, an adaptive system that periodically updates the detection model to detect the latest unknown attacks. We also propose an adaptive learning strategy, called SVM HYBRID, leveraged by our system to minimize manual work. Our system out performs existing web attack detectionmethods, with an F-value of 94.79% and FP rate of 0.09%. The total number of malicious queries obtained by SVM HYBRID is 2.78 times that by the popular Support Vector Machine Adaptive Learning (SVMAL) method. The malicious queries obtained can be used to update the Web Application Firewall (WAF) signature library.

Securing Web Application by Embedded Firewall at Gytech Indosantara Mandiri Ltd.

Gytech Indosantara Mandiri Ltd. in the last few years experienced many Cybercrime attacks on the Web Server which caused many moral and material losses. Therefore, it is necessary to consider ways to fight and prevent attacks on the webserver. One way to fight and prevent attacks is to use the Attack Signatures method by using ModSecurity and fail2ban as a Web Application Firewall (WAF). ModSecurity is used to detect and prevent the occurrence of Cyber Crime in the Http and https services. Whereas Fail2ban is used to prevent Bruteforce attacks on ssh, FTP and telnet services. Modesecurity, which acts as a Web Application Firewall (WAF) will send logs to Fail2ban when exploits occur on the Web Server. Meanwhile, Fail2ban will block the Attacker's IP address so that both can be used as a Web Application Firewall or can be used as layer 7 network security.

AI4SAFE-IoT: an AI-powered secure architecture for edge layer of Internet of things

With the increasing use of the Internet of things (IoT) in diverse domains, security concerns and IoT threats are constantly rising. The computational and memory limitations of IoT devices have resulted in emerging vulnerabilities in most IoT-run environments. Due to the low processing ability, IoT devices are often not capable of running complex defensive mechanisms. Lack of an architecture for a safer IoT environment is referred to as the most important barrier in developing a secure IoT system. In this paper, we propose a secure architecture for IoT edge layer infrastructure, called AI4SAFE-IoT. This architecture is built upon AI-powered security modules at the edge layer for protecting IoT infrastructure. Cyber threat attribution, intelligent web application firewall, cyber threat hunting, and cyber threat intelligence are the main modules proposed in our architecture. The proposed modules detect, attribute, and further identify the stage of an attack life cycle based on the Cyber Kill Chain model. In the proposed architecture, we define each security module and show its functionality against different threats in real-world applications. Moreover, due to the integration of AI security modules in a different layer of AI4SAFE-IoT, each threat in the edge layer will be handled by its corresponding security module delivered by a service. We compared the proposed architecture with the existing models and discussed our architecture independence of the underlying IoT layer and its comparatively low overhead according to delivering security as service for the edge layer of IoT architecture instead of embed implementation. Overall, we evaluated our proposed architecture based on the IoT service management score. The proposed architecture obtained 84.7 out of 100 which is the highest score among peer IoT edge layer security architectures.

Web intrusion detection system combined with feature analysis and SVM optimization

The current network traffic is large, and the network attacks have multiple types. Therefore, anomaly detection model combined with machine learning is developing rapidly. Frequent occurrences of Web Application Firewall (WAF) bypass attacks and the redundancy of the data characteristics in Hypertext Transfer Protocol (HTTP) protocol make it difficult to extract data characteristics. In this paper, an integrated web intrusion detection system combined with feature analysis and support vector machine (SVM) optimization is proposed. By using expert’s knowledge, the characteristics of the common Web attacks are analyzed. The related data characteristics are selected by the analysis of the HTTP protocol. In the classification learning, the mature and robust support vector machine algorithm is utilized and the grid search method is used for the parameter optimization. Consequently, a better detection capability on Web attacks can be obtained. By using the HTTP DATASET CSIC 2010 data set, experiments have been carried out to compare the detection capability of different kernel functions. The results show that the proposed system performs good in the detection capability and can detect the WAF bypass attacks effectively.

Capturing-the-Invisible (CTI): Behavior-Based Attacks Recognition in IoT-Oriented Industrial Control Systems

Industrial Control Systems monitor, automate, and operate complex infrastructure and processes that integrate into critical industrial sectors that affect our daily lives. With the advent of networking and automation, these systems have moved from being dedicated and independent to centralized corporate infrastructure. While this has facilitated the monitoring and overall management using traditional detection methods, Web Application Firewalls or Intrusion Detection Systems has exposed the networks subjecting them to Behavior-based cybersecurity attacks. Such attacks alter the control flow and processes and have the malicious ability to alter the functioning of these systems altogether. This research focuses on the use of process analytics to detect attacks in the industrial control infrastructure systems and compares the effectiveness of signature-based detection methods. The proposed work presents a pattern recognition algorithm aptly named as “Capturing-the-Invisible (CTI)” to find the hidden process in industrial control device logs and detect Behavior-based attacks being performed in real-time.

Applying Semantic Web Technologies to Discover an Ontology of Computer Attacks

The main scope of this paper is to present a methodology of engineering an ontology and to demonstrate how it is applied for designing and evaluating cyber-defense systems. The ontology is intended to be a vast model of the cybersecurity domain that captures a lot of information about attacks, source and target systems, methods, vulnerabilities exploited, consequences, controls for mitigation etc. For evaluating the quality of the proposed model we headed towards state-of-art methodologies comprised of a suite of metrics for assessing, among others: correctness, consistency, accuracy, completeness, soundness, task orientation. For the most important task, evaluation of efficacy in attacks detection, the proposed ontology was used as a knowledge model of aprototype web application firewall and we tested the system on a known evaluation dataset. The proposed system yielded a good detection rate and a low rate of false positives and negatives on the test data, and it was compared with other existing solutions in the field.

Component Based Web Application Firewall for Analyzing and Defending SQL Injection Attack Vectors

Structured query language injection is a top rated vulnerability by open web application security project community. If a web application has structured query language vulnerability in source code, then such application is prone to cyber-attacks, leading to attack on confidentiality, integrity and availability. Attackers are always ready to exploit structured query language injection vulnerabilities by executing various online attack vectors and many times successfully bypass authentication and authorization to gain privilege access on web and database server leading to service interruption, data interception, modification, fabrication and sometime complete deletion of database. The present paper is an attempt to propose an advance component based web application firewall to enhance web application security by mitigating structured query language injection attack vectors by analyzing hypertext transfer protocol request variables through analyzer component and defending injection attack through defender component based on content policy installed on advance web application firewall.

A Distributed Deep Learning System for Web Attack Detection on Edge Devices

With the development of Internet of Things (IoT) and cloud technologies, numerous IoT devices and sensors transmit huge amounts of data to cloud data centers for further processing. While providing us considerable convenience, cloud-based computing and storage also bring us many security problems, such as the abuse of information collection and concentrated web servers in the cloud. Traditional intrusion detection systems and web application firewalls are becoming incompatible with the new network environment, and related systems with machine learning or deep learning are emerging. However, cloud-IoT systems increase attacks against web servers, since data centralization carries a more attractive reward. In this article, based on distributed deep learning, we propose a web attack detection system that takes advantage of analyzing URLs. The system is designed to detect web attacks and is deployed on edge devices. The cloud handles the above challenges in the paradigm of the Edge of Things. Multiple concurrent deep models are used to enhance the stability of the system and the convenience in updating. We implemented experiments on the system with two concurrent deep models and compared the system with existing systems by using several datasets. The experimental results with 99.410% in accuracy, 98.91% in true positive rate (TPR), and 99.55% in detection rate of normal requests (DRN) demonstrate the system is competitive in detecting web attacks.

DIAVA: A Traffic-Based Framework for Detection of SQL Injection Attacks and Vulnerability Analysis of Leaked Data

SQL injection attack (SQLIA) is among the most common security threats to web-based services that are deployed on cloud. By exploiting web software vulnerabilities, SQL injection attackers can run arbitrary malicious code on target databases to acquire or compromise sensitive data. Although web application firewalls (WAFs) are offered by most cloud service providers, tenants are reluctant to pay for them, since there are few approaches that can report accurate SQLIA statistics for their deployed services. Traditional WAFs focus on blocking suspicious SQL requests. Few of them can accurately decide whether an attack is really harmful and quickly answer how severe the attack is. To raise the tenants’ awareness of the seriousness of SQLIAs, in this paper, we introduce a novel traffic-based SQLIA detection and vulnerability analysis framework named DIAVA, which can proactively send warnings to tenants promptly. By analyzing the bidirectional network traffic of SQL operations and applying our proposed multilevel regular expression model, DIAVA can accurately identify successful SQLIAs among all the suspects. Meanwhile, the severity of such SQLIAs and the vulnerabilities of the corresponding leaked data can be quickly evaluated by DIAVA based on its GPU-based dictionary attack analysis engine. Experimental results show that DIAVA not only outperforms state-of-the-art WAFs in detecting SQLAs from the perspectives of precision and recall, but also enables real-time vulnerability evaluation of leaked data caused by SQL injection.

Leveraging deep neural networks for anomaly‐based web application firewall

Web applications are the most common platforms for the exchange of information and services on the Internet. With the launch of web 2.0, information has flourished through social networking and business online. Therefore, websites are often attacked directly. As a result, the industry has paid more attention to the security of web applications in addition to security under computer networks. Intelligent systems based on machine learning have demonstrated excellent result on tasks such as anomaly detection in web requests. However, current methods based on traditional models cannot extract high-level features from huge data. In this study, the authors proposed methods based on deep-neural-network and parallel-feature-fusion that features engineering as an integral part of them and plays the most important role in their performance. The proposed methods use stacked autoencoder and deep belief network as feature learning methods, in which only normal data is used in the classification of training phase, then, one-class SVM, isolation forest, and elliptic envelope are applied as classifiers. The authors compared the proposed model with different strategies on CSIC 2010 and ECML/PKDD 2007 datasets. Results show that deep model and feature fusion model demonstrated as hierarchical feature learning which had better performance in terms of accuracy and generalisation in a reasonable time.

Creation of a DDOS attack using HTTP-GET Flood with the Cyber Kill Chain methodology

This article illustrates by means of a demonstration and taking advantage of the vulnerability “Open redirect”, how easy it can be to attack web servers through distributed attacks of denial of services. In it, the Cyber Kill Chain® model is used to carry out this attack in phases. In the development of the research, a systematic UFONet tool is applied and the results obtained are analyzed and it is recommended to protect the Internet application services of said attacks through web application firewalls (WAF) whose presence allows the DDoS traffic of the application layer (including the HTTP-GET flood) arrives effortlessly at the destination server.

BlackWatch: Increasing Attack Awareness within Web Applications

Web applications are relied upon by many for the services they provide. It is essential that applications implement appropriate security measures to prevent security incidents. Currently, web applications focus resources towards the preventative side of security. While prevention is an essential part of the security process, developers must also implement a level of attack awareness into their web applications. Being able to detect when an attack is occurring provides applications with the ability to execute responses against malicious users in an attempt to slow down or deter their attacks. This research seeks to improve web application security by identifying malicious behavior from within the context of web applications using our tool BlackWatch. The tool is a Python-based application which analyzes suspicious events occurring within client web applications, with the objective of identifying malicious patterns of behavior. This approach avoids issues typically encountered with traditional web application firewalls. Based on the results from a preliminary study, BlackWatch was effective at detecting attacks from both authenticated and unauthenticated users. Furthermore, user tests with developers indicated BlackWatch was user-friendly, and was easy to integrate into existing applications. Future work seeks to develop the BlackWatch solution further for public release.

An Effective Method to Safeguard Cyber Security by Preventing Malicious Data

In order to ensure the information security of a network, network security devices have been widely deployed in the information and communication network. Based on the monitoring data collected by network security equipment, network security administrators analyze whether there is an attacking incident or abnormal situation in the current network environment. However, if the original monitoring data collected by network security equipment is tampered with by the attacker, then network security administrators will make a wrong judgment and delay the best time to take protective actions. Therefore, the reliability and authenticity of data generated by network security devices are of the utmost importance. In this paper, we first define a revised Euclidean distance formula for the D-S evidence theory and propose a dual test method for the authenticity of data based on algebra statistics and geometric trends, detecting any malicious tampering on these monitoring data. Utilizing a web application firewall (WAF) device, we carry out a series of experiments to verify the proposed method.

Distributed Detection and prevention of Web Threats in Heterogeneous Environment

The growth of web Applications have increased rapidly due to the huge development of technology with very short turnaround time and with this development the protection from vulnerabilities became very difficult. There is a continuous demand for developing new methods that is able to prevent the fast growth of attacking methods and vulnerabilities. Furthermore there is a great demand to have coordination between different security infrastructure and protection applications to distribution of the attack log in order to prevent the attacker from further attacks to other web hosts. This research proposes a distributed web firewall defensive mechanism which provide a synchronized environment that is consists of several synchronized web application firewalls. Every web application is protected by a web application firewall that send feedback reports that include the type of the attack, The IP Address of the attacker and time of attack to other synchronized firewalls inside the environment to take action against the attacker.

A Machine-Learning-Driven Evolutionary Approach for Testing Web Application Firewalls

Web application firewalls (WAFs) are an essential protection mechanism for online software systems. Because of the relentless flow of new kinds of attacks as well as their increased sophistication, WAFs have to be updated and tested regularly to prevent attackers from easily circumventing them. In this paper, we focus on testing WAFs for SQL injection attacks, but the general principles and strategy we propose can be adapted to other contexts. We present ML-Driven , an approach based on machine learning and an evolutionary algorithm to automatically detect holes in WAFs that let SQL injection attacks bypass them. Initially, ML-Driven automatically generates a diverse set of attacks and submits them to the system being protected by the target WAF. Then, ML-Driven selects attacks that exhibit patterns (substrings) associated with bypassing the WAF and evolves them to generate new successful bypassing attacks. Machine learning is used to incrementally learn attack patterns from previously generated attacks according to their testing results, i.e., if they are blocked or bypass the WAF. We implemented ML-Driven in a tool and evaluated it on ModSecurity, a widely used open-source WAF, and a proprietary WAF protecting a financial institution. Our empirical results indicate that ML-Driven is effective and efficient at generating SQL injection attacks bypassing WAFs and identifying attack patterns.

РАЗРАБОТКА СИСТЕМЫ МОНИТОРИНГА БЕЗОПАСНОСТИ ДЛЯ КЛАСТЕРА ИНФОРМАЦИОННЫХ СИСТЕМ, БАЗИРУЮЩИХСЯ НА ПЛАТФОРМЕ RUBY ON RAILS

Currently, the information environment of many large organizations is represented by a cluster of web-oriented information systems. Often these information systems are based on the Ruby on Rails framework. One of the most important tasks of complex information security in such organizations is monitoring of all cluster components in real-time. The review of modern monitoring tools carried out in this work has shown two important points. There are many effective programs for monitoring the separate components of the web environment. But there is no one complex tool that supports interaction with DBMS, an application server, a web server, a web application firewall and system or hardware resources. Thus, this paper is devoted to the development of a complex monitoring system for a cluster of web applications. The created system is based on free software and can be used by administrators to operational detection of failures or potentially dangerous situations. Analysis of existed development technologies is carried out. Application architecture is based on a combination of the following tools: Nginx, ModSecurity, puma, Ruby on Rails, PostgreSQL, Redis, Sidekiq. The Nginx web server and WAF ModSecurity provide primary processing of requests. Puma, PostgreSQL and Ruby on Rails are used to create the application core. Sidekiq and Redis implement the mechanism of delayed jobs. The web interface of the developed centralized system provides various integrated infographic tools that allow the administrators to control current status of the system and investigate the states of all components in past. The created software was successfully tested on the NRNU MEPhI ERP-system. It has proved to be an effective tool for the complex monitoring of a cluster of web applications. Its implementation does not involve significant financial costs.

A Study on Comparison of Network Location Efficiency of Web Application Firewall

This paper proposes a method to optimize the performance of web application firewalls according to their positions in large scale networks. Since ports for web services are always open and vulnerable in security, the introduction of web application firewalls is essential. Methods to configure web application firewalls in existing networks are largely divided into two types. There is an in-line type where a web application firewall is located between the network and the web server to be protected. This is mostly used in small scale single networks and is vulnerable to the physical obstruction of web application firewalls. The port redirection type configured with the help of peripheral network equipment such as routers or L4 switches can maintain web services even when physical obstruction of the web application firewall occurs and is suitable for large scale networks where several web services are mixed. In this study, port redirection type web application firewalls were configured in large-scale networks and there was a problem in that the performance of routers was degraded due to the IP-based VLAN when a policy was set for the ports on the routers for web security. In order to solve this problem, only those agencies and enterprises that provide web services of networks were separated and in-line type web application firewalls were configured for them. Internet service providers (ISPs) or central line-concentration agencies can apply the foregoing to configure systems for web security for unit small enterprises or small scale agencies at low costs.

Securing Web Applications against Structured Query Language Injection Attacks using a Hybrid Approach: Input Filtering and Web Application Firewall

Securing Web Applications against Structured Query Language Injection Attacks using a Hybrid Approach: Input Filtering and Web Application Firewall

IoT security through web application firewall

The current trend in home electronics needs to be Internet Connectivity. Internet of Things is a collection of many interconnected objects, services and devices that can communicate and share the data to achieve a common goal in different areas and applications using internet. Attacks on IoT devices are physical attacks, side channel attacks, cryptanalysis attacks, software attacks, network attacks. The network attacks does not require physical access to create a major disruption like DDos in the network. The attackers can insert themselves between us and our devices like Man in Middle Attack. A firewall acts as a barrier between a trusted network and an untrusted network. This is a proposed work to focus on the security challenges of IoT using web application firewall.