Classification features for detecting Server-side and Client-side Web attacks

A web attack is an attack against a web server through the HTTP Protocol. By analyzing known web attacks, we find out that each one has its own behavior. Vestiges of their behavior could be detected in non-body parts of the HTTP Protocol. Such information can be used to verify web alerts generated by Web Application Firewalls (WAFs) and Web Intrusion Detection Systems (Web IDSs). In this paper, we propose a method to verify web alerts generated by mentioned sensors. The goal of the alert verification component is to eliminate or tag alerts that do not represent successful attacks. Our approach is based on analyzing HTTP Transaction metadata, including Request method, Request Headers, Status Code, and Response Headers. We implemented an alert verification module, reconfigured ModSecurity, modified a subset of the OWASP ModSecurity Core Rule Set, and developed knowledge-base of web attack vectors to evaluate our method. We show that our approach significantly reduces false and non-relevant alerts with quite low processing overhead, thus enhances the quality of the results.

In image retrieval, relevance feedback uses information, obtained interactively from the user, to understand the user's perceptions of a query image and to improve retrieval accuracy. We propose simultaneous relevant feature selection and classification using the samples provided by the user to improve retrieval accuracy. The classifier is defined by a separating hyperplane, while the sparse weight vector characterizing the hyperplane defines a small set of relevant features. This set of relevant features is used for classification and can be used for analysis at a later stage. Mutually exclusive sets of images are shown to the user at each iteration to obtain maximum information from the user. Experimental results show that our algorithm performs better than the feature relevance weighting and feature selection schemes and comparably with the classification scheme using SVMs, in terms of retrieval accuracy, and it has the advantage of being faster than the classification scheme using SVMs.

Abstract— Nowadays, web attacks have become more complicated, leading to the difficulty of traditional web application firewalls (WAFs) in recognizing those threats, especially when dealing with new attacks. Hence, machine learning/deep learning (ML/DL) approaches have been applied to the field of web attack detection with proven success. However, most existing ML/DL-based web attack detectors focus on a specific type of attack due to the difference in the payload of various attacks, which sets a border to the capability of those solutions in detecting new attack types. In this paper, we propose a novel DL-based solution for web attack detection, named DL-WAD, leveraging deep learning and natural language processing techniques. Moreover, DL-WAD is designed with a data preprocessing mechanism aimed at differentiating between regular web requests and malicious ones that carry attack payloads encompassing multiple types of web attacks. The experiment results indicate the effectiveness of our solution in protecting the target web services from a wide range of attacks with high accuracy.

Web application security has become a major requirement for any business, especially with the wide web attacks spreading despite the defensive measures and the continuous development of software frameworks and servers. In this study, we present a proposed model for a web application firewall that used machine learning and features engineering to detect common web attacks. Our proposed model analyses incoming requests to the webserver, parses these requests to extract four features that describe completely HTTP request parts (URL, payload, and headers), and classifies whether a request is normal or an anomaly. We took into consideration the limitation of previous works that use URL and payload only in classification and provided five features that describe and summarize all parts of the HTTP request using features engineering and previous experience in the field of the software security domain. Extracted features are length of request, percentage of characters allowed, percentage of special characters, and attack weight. These features were calculated for four different datasets CSIC 2010, HTTPParams 2015, Hybrid dataset (CSIC 2010 and HTTPParams), and real logs for the compromised web server. We evaluated our proposed model by using these updated datasets with four classification algorithms (Naive Bayes, logistic regression, decision tree, and support vector machine) with two methods (train test split and cross-validation) to negate the probability of overfitting and ensure that features are effective. Features values for a normal request are usually short request length, large allowed character ratio, small special character ratio, and zero attack weight or close to zero. Features values for anomaly requests are large request length, small allowed character percentage, large special character percentage, and very large numerically attack weight. Our proposed model achieved a classification accuracy of 99.6% with datasets used in research studies in this field and 98.8% with datasets of real web servers.

The past decade has witnessed a rapidly developing Internet, which consequently brings about devastating web attacks of various types. The popularity of automated web attack tools also pushes the need for better methods to proactively detect the huge amounts of evolutionary web attacks. In this work, large quantities of URLs were used for detecting web attacks using machine learning models. Based on the dataset and feature selection methods of [1], multi-classification of six types of URLs was explored using the random forest method, which was later compared against the gated recurrent neural networks. Even without the need of manual feature creation, the gated recurrent neural networks consistently outperformed the random forest method with well-selected features. Therefore, we determine it is an efficient and adaptive proactive detection system, which is more advanced in the ever-changing cyberspace environment.

This paper proposes a hybrid feature selection method for predicting user influence on Twitter. A set of candidate features from Twitter is identified based on the five attributes of influencers defined in sociology. Firstly, less relevant features are filtered out with a feature-weighting algorithm. Then the Sequential Backward Floating Selection is utilized as the search strategy. A Back Propagation Neural Network is employed to evaluate the feature subset at each step of searching. Finally, an optimal feature set is obtained for predicting user influence with a high degree of accuracy. Experimental results are provided based on a real world Twitter dataset including seven million tweets associated with 200 popular users. The proposed method can provide a set of features that could be used as a solid foundation for studying complicated user influence evaluation and prediction.

Integrating access to web services with desktop applications allows for an expanded set of application features, including performing computationally intensive tasks and convenient searches of databases. We describe how we have enhanced UCSF Chimera (http://www.rbvi.ucsf.edu/chimera/), a program for the interactive visualization and analysis of molecular structures and related data, through the addition of several web services (http://www.rbvi.ucsf.edu/chimera/docs/webservices.html). By streamlining access to web services, including the entire job submission, monitoring and retrieval process, Chimera makes it simpler for users to focus on their science projects rather than data manipulation. Chimera uses Opal, a toolkit for wrapping scientific applications as web services, to provide scalable and transparent access to several popular software packages. We illustrate Chimera's use of web services with an example workflow that interleaves use of these services with interactive manipulation of molecular sequences and structures, and we provide an example Python program to demonstrate how easily Opal-based web services can be accessed from within an application. Web server availability: http://webservices.rbvi.ucsf.edu/opal2/dashboard?command=serviceList.

Nowadays the usage of handheld devices in a young generation were constantly increasing. Handheld devices had been involved in high profiles cases that involved children, therefore strict monitoring of children’s devices usage are required for safety risks. This project is to develop Stealth-based Android Parental Monitoring App to help parent monitor their child’s mobile activity silently. The mobile usage behavior can be analyze and then parents can plan for proactive measures to deal with the problem. This application was developed based on client server application, where Android based application is developed for client side and web application is developed on the server-side. Authentication process is required to activate the application, as only authenticated user can manage the application and at the same time, the application will run stealthily, invisible from the users. Pattern Lock and password method were used for authentication process. For the purpose of stealth process, “secret door” technique, where developer will disable an application component; this technique will have the effect of removing an application shortcut from any Launcher. The application at android based will be able to log the location, message log, call log, network log, and device information. The collected data will be uploaded to a web server to be reviewed through the internet-enabled devices. The functionality testing were done on both Android Based client side application and web application server side web application. For client side application eight test cases were developed: Android Authentication Module, Android device registration module, Android logging module, Android uploading module, Android system cleaner module, Android stealth hide/reveal icon module, Android stealth launch application via dialer module and Android protection module. For each test case, the result is indicated as pass. For Server Side Web application, four test cases were developed; Web Application Registration Module, Web Application Authentication Module, Web Application Monitoring Module and Web Application Disconnect Device Module. For each test case, the result is indicated as pass. Android Based Parental Monitoring Apps has been successfully developed and meet the development objective to collect Android critical data including network log, call log, device information log, incoming or outgoing SMS and Call logs in stealth and synchronized it to the server where it can be used as digital evidence if necessary. The result of this project is hoped to benefits the society by providing a better monitoring technique for the concerned parent via implementing an alternate way on how to continuously collect and monitor their children/teen mobile activity.

JavaScript has become one of the most popular programming languages for both client-side and server-side applications. In JavaScript applications, events may be generated, triggered and consumed non-deterministically. Thus, JavaScript applications may suffer from non-deterministic bugs, when events are triggered and consumed in an unexpected order. In this proposal, we aim to characterize and combat non-deterministic bugs in JavaScript applications. Specifically, we first perform a comprehensive study about real-world non-deterministic bugs in server-side JavaScript applications. In order to facilitate bug diagnosis, we further propose approaches to isolate the necessary events that are responsible for the occurrence of a failure. We also plan to design new techniques in detecting non-deterministic bugs in JavaScript applications.

Currently, researchers are developing numerous plant diseases recognition model using image processing and soft computing. The models are mainly based on the extraction of discolored features and applying in various soft computing approaches to automate plant diseases recognition process. The extracted features are statistical, frequency, spatial-frequency or hybrid features of captured images accessed in device-dependent or device-independent color spaces. The performance of diseases recognition system is significantly dependent upon the selection of color spaces and extracted features. This paper presents a comprehensive review of the impact of color spaces and feature sets on machine learning and rule base automated plant diseases classifier. The review performed with six categories of rice plant images with two machine learning and two rule base classifiers. Initially, a thorough literature review performed on the previous investigation based on color spaces and used feature sets for designing diseases recognition model. Then common conditions created to extract feature sets in different color spaces, and applied machine learning and rule base classifier to analyze the impact of color spaces with feature sets. The review presents a detailed discussion on the correlation between color spaces, feature sets, and performance of diseases recognition system. The review results reveal the most relevant features on specific color space for machine learning and rule base classifier. It also deduces that the performance of plant diseases classifier highly dependent upon used color space and extracted features.

Drive-by-download attacks are client-side attacks that originate from web servers that are visited by web browsers. While many web browsers are vulnerable to the drive-by-download attacks, the cost of detecting malicious web pages that launch drive-by-download attacks is expensive. High-interaction client honeypots are security devices capable of detecting malicious web pages; however, their slow and expensive operations in web page visiting have been considered as a problem. The high-interaction client honeypots employ a visitation algorithm to pinpoint which page has made an unauthorized change of system state when any unauthorized change of the system state occurred after visiting suspicious web pages. To improve the performance of the high-interaction client honeypots, we propose a new visitation algorithm, logarithmic divide-and-conquer (LDAC), for identifying malicious web pages. The LDAC algorithm is an enhanced version of the existing binary divide-and-conquer (BDAC) algorithm. If any system state is abnormally changed after having visited k suspicious web pages concurrently, our LDAC algorithm divides the buffer of k pages into [log2k] pieces and recursively visits the pieces until the malicious page or pages are identified, while the BDAC splits the buffer into k/2 portions. Experimental results show that the LDAC has improved performance of the system up to 15 percent compared to the BDAC algorithm.

In the present paper, a set of robust texture features based on morphological residues of opening or closing by reconstruction is introduced. This set of features is proven much more robust to noise than those based on traditional morphological residues. The robustness to noise of this set of features is investigated in detail. An algorithm is constructed to select the most discriminating feature subset. In texture classification experiments, it is found that this feature subset bears high robustness to various noises even when the noise levels are quite high.

We look at a number of policies for managing a file system cache in a Web server. Traces from NCSA World Wide Web (WWW) server are used in this study. We study several caching policies for improving the overall performance of such a server and show that request response time can be improved by some of the replacement policies that take size of the request into account. It is shown that least frequently used (LFU) performs well when cache sizes are small (<16 MB) and SpacexAge replacement policy performs consistently better than LRU. We show that previously proposed cache sharing policies improve performance significantly in clustered Web servers.

Web services are being embraced by IT industry in the recent past to enable rapid development of distributed systems with optimal cost. Web services in SOA are self-adaptable to context, which makes SOA widely recognized in IT system as the technology, which has the potential of improving the receptiveness of both business and IT organizations. Web services help in building Service Based Systems (SBS) like Paytm, Amazon, Paypal, e-bay etc. which evolves frequently to fit the new user requirements which impacts the evolvability and quality of software design. Similar to software systems built using other paradigms, Service based systems also suffer from bad or poor design choices as in anti-pattern, code smells etc. Anti-patterns are explicit structures in the design that indicates violation of fundamental design principles and negatively impact the design quality. Anti-patterns have obstructive influence on the maintainability and perception of software systems. Thus there is a rising need for the early prediction of anti-patterns and refactoring them to improve the software quality in terms of execution cost, maintenance cost and memory consumption. In this work, a frame work is proposed for significant feature selection from source code metrics which includes Wilcoxon signed rank test, Univariate logistic regression analysis and Cross-correlation analysis. Then the different sets of features from various steps along with the original source code metrics are considered and are used for anti-pattern detection using 13 machine learning algorithms. Experimental results show the approximation capability of different classifiers and data balancing techniques with the features selected from the various steps of feature validation framework in addition to the original features for developing anti-pattern prediction model. The results also shows that the prediction model built with by the ensemble techniques using the features obtained from proposed feature selection framework outperforms other techniques.KeywordsSoftware engineeringAnti-patternWeb serviceImbalanced dataService oriented architectureMachine learningPredictionSource code metric

Determining disease-related variations of the anatomy and function is an important step in better understanding diseases and developing early diagnostic systems. In particular, image-based multivariate prediction models and the “relevant features” they produce are attracting attention from the community. In this article, we present an empirical study on the relevant features produced by two recently developed discriminative learning algorithms: neighborhood approximation forests (NAF) and the relevance voxel machine (RVoxM). Specifically, we examine whether the sets of features these methods produce are exhaustive; that is whether the features that are not marked as relevant carry disease-related information. We perform experiments on three different problems: image-based regression on a synthetic dataset for which the set of relevant features is known, regression of subject age as well as binary classification of Alzheimer’s Disease (AD) from brain Magnetic Resonance Imaging (MRI) data. Our experiments demonstrate that aging-related and AD-related variations are widespread and the initial sets of relevant features discovered by the methods are not exhaustive. Our findings show that by knocking-out features and re-training models, a much larger set of disease-related features can be identified.KeywordsSynthetic DatasetRelevance Vector MachineCommon Coordinate SystemRandom Permutation TestRelevant PixelThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.