Abstract
Recently, the security threat on web application is increasing rapidly and especially open source web applications are becoming popular target of web server hacking. And more there was a worm which spread via web application vulnerabilities. Web application attack uses the vulnerability not in web server itself, but in structural, logical, and code errors. The majority of flaws in web applications are caused by absence of the user input validation. But, it is difficult to detect various abnormal user inputs by pattern matching method. In this paper, we propose the web application securing proxy based on profiling which can be constructed by learning usual normal activity. The proposed proxy system can detect and filter out attacker’s abnormal requests via anomaly detection mechanism.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Turner, D., Entwisle, S., et al.: Semantec Internet Security Threat Report Volume VII. In: Semantec (March 2005)
Williams, J.R., et al.: The Ten Most Critical Web Application Security Vulnerabilities. In: OWASP (2004)
Curphey, M., Scambray, J., Olson, E.: Improving Web Application Security: Threats and Countermeasures. Microsoft Corporation (2003)
Ristic, I.: Web Intrusion Detection with Mod_Security. In: OWASP AppSec Europe
Shah, S.: Defending Web Services using Mod Security(Apache). NetSquare (2004)
Barnett, R.C.: mod_security Web Intrusion Detection And Prevention. In: SANS (December 2003)
Scott, D., Sharp, R.: Abstracting Application-Level Web Security. In: Proc. of the World Wide Web Conference (2002)
Huang, Y.W., et al.: Securing Web Application Code by static Analysis and Runtime Protection. In: Proc. of the World Wide Web Conference (May 2004)
Benedikt, M., Freire, J., Godeproid, P.: VeriWeb: Automatically Testing Dynamic Web Sites. In: Proc. of the World Wide Web Conference (2002)
Curphey, M., Endler, D.: A Guide to Building Secure Web Applications. In: OWASP (September 2002)
Kruegel, C., Vigna, G., Robertson, W.: A multi-model approach to the detection of web-based attacks. Computer Networks 48(5), 717–738 (2005)
Auger, R., Barnett, R.: Web Application Security Consortium: Threat Classification Version 1.0. Web Application Security Consortium (2004), http://www.webappsec.org
Segal, O.: Web Application Forensics: The unchatterd Territory. In: SANCTUM (2002)
Huseby, S.H.: Common Security Problems in the Code of Dynamic Web Applications. Web Application Security Consortium (June 2005), www.webappsec.org
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Yun, Y., Park, S., Kim, Y., Ryou, J. (2006). A Design and Implementation of Profile Based Web Application Securing Proxy. In: Chen, K., Deng, R., Lai, X., Zhou, J. (eds) Information Security Practice and Experience. ISPEC 2006. Lecture Notes in Computer Science, vol 3903. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11689522_23
Download citation
DOI: https://doi.org/10.1007/11689522_23
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-33052-3
Online ISBN: 978-3-540-33058-5
eBook Packages: Computer ScienceComputer Science (R0)