Opportunistic Diversity-Based Detection of Injection Attacks in Web Applications

Qu, Wenyu and Huo, Wei and Wang, Lingyu (2018) Opportunistic Diversity-Based Detection of Injection Attacks in Web Applications. EAI Endorsed Transactions on Security and Safety, 5 (16). e5. ISSN 2032-9393

[img]
Preview
Text
eai.11-12-2018.156032.pdf
Available under License Creative Commons Attribution No Derivatives.

Download (3MB) | Preview

Abstract

Web-based applications delivered using clouds are becoming increasingly popular due to less demand of client-side resources and easier maintenance than desktop counterparts. At the same time, larger attack surfaces and developers’ lack of security proficiency or awareness leave Web applications particularly vulnerable to security attacks. On the other hand, diversity has long been considered as a viable approach to detecting security attacks since functionally similar but internally different variants of an application will likely respond to the same attack in different ways. However, most diversity-by-design approaches have met difficulties in practice due to the prohibitive cost in terms of both development and maintenance. In this work, we propose to employ opportunistic diversity inherent to Web applications and their database backends to detect injection attacks. We first conduct a case study of common vulnerabilities to confirm the potential of opportunistic diversity for detecting potential attacks. We then devise a multi-stage approach to examine features extracted from the database queries, their effect on the database, the query results, as well as the user-end results. Next, we combine the partial results obtained from different stages using a learning-based approach to further improve the detection accuracy. Finally, we evaluate our approach using a real world Web application.

Item Type: Article
Uncontrolled Keywords: Diversity, SQL Injection, Web Application Security, Intrusion Detection
Subjects: H Social Sciences > H Social Sciences (General)
Q Science > QA Mathematics > QA75 Electronic computers. Computer science
QA75 Electronic computers. Computer science
Depositing User: EAI Editor IV
Date Deposited: 26 Mar 2021 13:58
Last Modified: 26 Mar 2021 13:58
URI: https://eprints.eudl.eu/id/eprint/2096

Actions (login required)

View Item View Item