Skip to main content
SpringerLink
Log in
Book cover

Transactions on Computational Collective Intelligence XXII pp 45–59Cite as

Identification of Possible Attack Attempts Against Web Applications Utilizing Collective Assessment of Suspicious Requests

  • Chapter

Part of the book series: Lecture Notes in Computer Science ((TCCI,volume 9655))

Abstract

The number of web-based activities and websites is growing every day. Unfortunately, so is cyber-crime. Every day, new vulnerabilities are reported and the number of automated attacks is constantly rising. In this article, a new method for detecting such attacks is proposed, whereas cooperating systems analyze incoming requests, identify potential threats and present them to other peers. Each host can then utilize the knowledge and findings of the other peers to identify harmful requests, making the whole system of cooperating servers “remember” and share information about the existing threats, effectively “immunizing” it against them.

The method was tested using data from seven different web servers, consisting of over three million of recorded requests. The paper also includes proposed means for maintaining the confidentiality of the exchanged data and analyzes impact of various parameters, including the number of peers participating in the exchange of data. Samples of identified attacks and most common attack vectors are also presented in the paper.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

References

  1. Agosti, M., Crivellari, F., Di Nunzio, G.: Web log analysis: a review of a decade of studies about information acquisition, inspection and interpretation of user interaction. Data Min. Knowl. Disc. 24(3), 663–696 (2012)

    Article  Google Scholar 

  2. Anderson, R., Barton, C., Böhme, R., Clayton, R., Van Eeten, M.J., Levi, M., Moore, T., Savage, S.: Measuring the cost of cybercrime. In: Böhme, R. (ed.) The Economics of Information Security and Privacy, pp. 265–300. Springer, Heidelberg (2013)

    Chapter  Google Scholar 

  3. Auxilia, M., Tamilselvan, D.: Anomaly detection using negative security model in web application. In: 2010 International Conference on Computer Information Systems and Industrial Management Applications (CISIM), pp. 481–486 (2010)

    Google Scholar 

  4. Florêncio, D., Herley, C.: Sex, lies and cyber-crime surveys. In: Schneier, B. (ed.) Economics of Information Security and Privacy III, pp. 35–53. Springer, Heidelberg (2013)

    Chapter  Google Scholar 

  5. García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., Vázquez, E.: Anomaly-based network intrusion detection: techniques, systems and challenges. Comput. Secur. 28(1–2), 18–28 (2009)

    Article  Google Scholar 

  6. van Goethem, T., Chen, P., Nikiforakis, N., Desmet, L., Joosen, W.: Large-scale security analysis of the web: challenges and findings. In: Holz, T., Ioannidis, S. (eds.) Trust 2014. LNCS, vol. 8564, pp. 110–126. Springer, Heidelberg (2014)

    Google Scholar 

  7. Han, E.E.: Detection of web application attacks with request length module and regex pattern analysis. In: Genetic and Evolutionary Computing: Proceedings of the Ninth International Conference on Genetic and Evolutionary Computing, 26–28 August 2015, Yangon, Myanmar, vol. 2, pp. 157. Springer, Switzerland (2015)

    Google Scholar 

  8. Hyman, P.: Cybercrime: it’s serious, but exactly how serious? Commun. ACM 56(3), 18–20 (2013)

    Article  Google Scholar 

  9. Iváncsy, R., Vajk, I.: Frequent pattern mining in web log data. Acta Polytechnica Hungarica 3(1), 77–90 (2006)

    Google Scholar 

  10. JSON: a lightweight data-interchange format. http://www.json.org

  11. Kruegel, C., Vigna, G., Robertson, W.: A multi-model approach to the detection of web-based attacks. Comput. Netw. 48(5), 717–738 (2005)

    Article  Google Scholar 

  12. McAfee: Net Losses: Estimating the Global Cost of Cybercrime (2014). http://www.mcafee.com/us/resources/reports/rp-economic-impact-cybercrime2.pdf

  13. Muller, J.: Implementation of a Framework for Advanced HTTPD Logfile Security Analysis, Master’s thesis (2012)

    Google Scholar 

  14. Netcraft: Web Server Survey (2015). http://news.netcraft.com/archives/2013/11/01/november-2013-web-server-survey.html

  15. OWASP: Web Application Firewall. https://www.owasp.org/index.php/Web_Application_Firewall

  16. Pałka, D., Zachara, M.: Learning web application firewall - benefits and caveats. In: Tjoa, A.M., Quirchmayr, G., You, I., Xu, L. (eds.) ARES 2011. LNCS, vol. 6908, pp. 295–308. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

  17. Rieck, K., Laskov, P.: Language models for detection of unknown attacks in network traffic. J. Comput. Virol. 2(4), 243 (2007)

    Article  Google Scholar 

  18. Roesch, M.: Snort: lightweight intrusion detection for networks. In: LISA, USENIX, pp. 229–238 (1999)

    Google Scholar 

  19. Salama, S.E., Marie, M.I., El-Fangary, L.M., Helmy, Y.K.: Web server logs preprocessing for web intrusion detection. Comput. Inf. Sci. 4(4), p123 (2011)

    Google Scholar 

  20. Stevens, M.: Advances in hash function cryptanalysis. ERCIM News 2012(90), 26–27 (2012)

    Google Scholar 

  21. Symantec: Internet Security Threat Report (2015). http://www.symantec.com/security_response/publications/threatreport.jsp

  22. WhiteHat: Website Security Statistics Report (2013). http://info.whitehatsec.com/2013-website-security-report.html

  23. Zachara, M.: Collective detection of potentially harmful requests directed at web sites. In: Hwang, D., Jung, J.J., Nguyen, N.-T. (eds.) ICCCI 2014. LNCS, vol. 8733, pp. 384–393. Springer, Heidelberg (2014)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. AGH University of Science and Technology, Kraków, Poland

    Marek Zachara

Authors
  1. Marek Zachara
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Marek Zachara .

Editor information

Editors and Affiliations

  1. Wroclaw University of Technology, Wroclaw, Poland

    Ngoc Thanh Nguyen

  2. Swinburne University of Technology, Hawthorn, Australia

    Ryszard Kowalczyk

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer-Verlag Berlin Heidelberg

About this chapter

Cite this chapter

Zachara, M. (2016). Identification of Possible Attack Attempts Against Web Applications Utilizing Collective Assessment of Suspicious Requests. In: Nguyen, N.T., Kowalczyk, R. (eds) Transactions on Computational Collective Intelligence XXII. Lecture Notes in Computer Science(), vol 9655. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-49619-0_3

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-49619-0_3

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-49618-3

  • Online ISBN: 978-3-662-49619-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation