SQL-IDS

SummaryThe micro‐blog network is one of the most popular social networking platforms. By calculating the degree centrality, we found that hub nodes play an important role in micro‐blog networks, which is the main power of message forwarding. To improve the security of the micro‐blog network, we proposed a defending scheme against malicious Uniform Resource Locator (URL) diffusing in micro‐blog networks with hub nodes. After a node found a new malicious URL, it will edit a warning massage about the malicious URL. If the normal node obtains malicious URL warning message, it will send private message with the warning message to the hub node and update its blog article. The malicious URL warning messages spread rapidly in the whole networks in a short period because of the influence of Hub nodes. At the same time, we add the comparison mechanism to reduce the redundancy of spreading the warning message in the networks. So the security of entire micro‐blog networks can be improved against malicious URL without increasing the network load. Experiments show that our scheme can effectively defend against the malicious URL in the any scale of micro‐blog networks. Copyright © 2016 John Wiley & Sons, Ltd.

Cyber-attacks using malicious uniform resource locator (URL) propagation are very common and serious. Statistics indicate that there is a need to research and apply techniques and methods for identifying and preventing malicious URLs. The main objective of this research is to train machine learning models on selected dataset to predict phishing websites based on URL-related features. The accuracy level of each model is measured and compared. Finally, the best performing model will be used to develop a web application that provide internet users with an easy way to check suspicious URLs. We have used five different machine learning models to classify URLs as legitimate or phishing, these models are eXtreme Gradient Boosting (XGBoost), k-nearest neighbors (KNN), support vector machine (SVM), Decision Tree, and Random Forest. Finally, we used Voting Classifier to combine the work of Random Forest (RF) algorithm with other two models, Gaussian Naive Bayes, and Logistic Regression, to check if we can increase the accuracy of RF as suggested in the literature, but we found that the accuracy of RF alone was higher than the accuracy of the combined models. This project can be implemented as a browser extension or mobile application to classify suspicious URLs to legitimate or phishing with the use of the saved model.

Malicious Uniform Resource Locator (URL) detection is an important problem in web search and mining, which plays a critical role in internet security. In literature, many existing studies have attempted to formulate the problem as a regular supervised binary classification task, which typically aims to optimize the prediction accuracy. However, in a real-world malicious URL detection task, the ratio between the number of malicious URLs and legitimate URLs is highly imbalanced, making it very inappropriate for simply optimizing the prediction accuracy. Besides, another key limitation of the existing work is to assume a large amount of training data is available, which is impractical as the human labeling cost could be potentially quite expensive. To solve these issues, in this paper, we present a novel framework of Cost-Sensitive Online Active Learning (CSOAL), which only queries a small fraction of training data for labeling and directly optimizes two cost-sensitive measures to address the class-imbalance issue. In particular, we propose two CSOAL algorithms and analyze their theoretical performance in terms of cost-sensitive bounds. We conduct an extensive set of experiments to examine the empirical performance of the proposed algorithms for a large-scale challenging malicious URL detection task, in which the encouraging results showed that the proposed technique by querying an extremely small-sized labeled data (about 0.5% out of 1-million instances) can achieve better or highly comparable classification performance in comparison to the state-of-the-art cost-insensitive and cost-sensitive online classification algorithms using a huge amount of labeled data.

As the cyber threats increase in complexity and frequency, the defect reactive and rule-based approaches have given insufficient results for securing the crucial digital infrastructures. The experts provide a detailed review of the Artificial Intelligence (AI)-based forensic devices developed to improve the real-time threat mitigation and anomaly identification across various cybersecurity environments. The research starts by assessing the wide region of cybersecurity, highlighting the requirement for adaptive learning, continuous monitoring and scalable defense models regardless of insider threats, zero-day exploits and polymorphic attacks. Further, it narrows the concentration to the integration of AI in digital forensics, where deep learning techniques are leveraged to categorize the anomalous behavior, recognize intrusion patterns and predict future attack factors. This work presents a digital forensic investigation approach that has evolved into a multifaceted discipline, requiring the integration of diverse analytical methods to effectively investigate cyber incidents. This is a unified analytical framework that holistically analyzes digital assets by integrating three distinct investigation domains, such as email author attribution with email body contextual analysis, Uniform Resource Locator (URL) classification, and network traffic analysis. The framework is designed as a sequential pipeline, dynamically interconnected, with each stage enhancing the subsequent one through feedback loops and behavioral correlation. In the first stage, the email author attribution for forensic purposes is done using a Deep Neural Network (DNN) and model-based clustering, and then the contextual forensic analysis of emails based on the email body is done using the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm. Emails with suspicious links initiate the second stage of the process, where the URL classification is carried out using the Light Gradient Boosting (LGB), which effectively detects the malicious activities through this classified URL. Detected malicious URLs inform and direct the targeted monitoring during the third stage, where the network traffic is examined. In this stage, intrusion detection and network packet classification are executed using a Coordinate Attention-based Gated Recurrent Unit (CA-GRU) model, allowing for robust intrusion detection in modern, privacy-preserving communication systems. The developed framework is adaptable, evolving with emerging threats and scalable for diverse use cases, making it an essential tool for both small-scale and enterprise-level forensic investigations. Finally, experimental validation is done to ensure the effectiveness of the developed model in cyber investigations.

Today almost all organizations have changed their traditional systems and have improved their performance using web-based applications. This process will make more profit and at the same time will increase the efficiency of their activities through customer support services and data transactions. Usually, web application take inputs from users through web form and send this input to get the response from database. Modern web-based application use web database to store all critical information such as user credentials, financial and payment information, company statistics etc. However error in validation of user input can cause database vulnerable to Structured Query Language Injection (SQLI) attack. By using SQLI attack, the attackers might insert malicious code in the user input and trying to gain access to the confidential and sensitive data from database. Security tester need to identify the appropriate test cases before starting exploiting SQL vulnerability in web-based application during testing phase. Identifying the test cases of a web application and analyzing the test results of an attack are important parts and consider as critical issues that affects the effectiveness of security testing. Thus, this research focused on the developing a framework for testing and detecting SQL injection vulnerability in web application. In this research, test cases will be generated automatically based on SQLI attack pattern and then the results will be executed automatically based on generated test cases. The primary focus in this paper is to develop a framework to automate security testing based on input injection attack pattern. To test our framework, we install a vulnerable web application and test result shows that the proposed framework can detect SQLI vulnerability successfully.

Based on OWASP, code injection is one of the top lists of security risks. Structured Query Language (SQL) Injection is one of these types of attacks. SQL injection attack is an attack by spoofing the server to execute malicious code. The main object of this paper is to identify relevant works about deep learning methods to detect SQL-Injection on web applications. To achieve that, we conduct a survey review of the literature. In this study, we provide a review of 14 studies using deep learning algorithms to detect SQL Injection on web applications and it provides a comparison between them. Deep learning has great potential in threat intelligence detection.

Phishing remains a persistent ever-changing threat to cybersecurity, thus demanding the invention of intelligent and scalable detection algorithms. The study here examines the ability of deep learning methodologies, viz., Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN), in the detection of phishing Uniform Resource Locator (URL). Accurately detecting malicious URLs is tackled by this research through a systematic technique of data preprocessing, tokenization, and sequence padding. Experimental results demonstrate that the CNN model performs reasonably well, with an accuracy of 84.56%, recall of 72.19%, precision of 95.43%, and F1score of 82.20%, whereas the RNN model, with an accuracy of 91.56%, recall of 89.46%, precision of 93.17%, and F1-score of 91.28%, outperforms the CNN model. This evidently suggests that RNN is stronger in capturing the sequential patterns embedded in URLs and thus working better in phishing detection. This study exemplifies the promise of deep learning approaches towards making cyber security more robust and serves as a stepping stone for future research in hybrid models and real-time detection.

There are two essential ingredients for collecting information from the Internet: 1) a World Wide Web (Web) browser, and 2) an Internet search engine. The two most widely used Web browsers are Microsoft's Internet Explorer and Netscape Communications Corporation's Navigator. There are, however, more than 120 browser software possibilities available. These browsers have been cataloged by Adrian Roselli and may be found at Evolt, a site that supports the exchange of Web design information. Web browsers are like brands of shoes; some fit better than others. By visiting Evolt, whose uniform resource locator (URL) is listed below, one might find a browser that works better. For example, some Internet users prefer Firefox (Figure 1) and Safari, because Web browsers have different efficiencies in displaying Internet information on different computer platforms. Figure 1 Search page from the Web browser known as Firefox. Image used with permission of Mozilla, parent of Firefox. For a free copy of Firefox, which operates on either Apple or IBM compatibles, visit http://www.mozilla.org. Evolt http://browsers.evolt.org/ As is the case with Web browsers, there are a number of Internet search engines. Each search engine has a variety of features that address different objectives for finding information from the Internet. The State University of New York at Albany has organized an excellent list of Internet search engines.

In today’s world, phishing attacks are gradually increasing, resulting in individuals losing valuables, assets, personal information, etc., to unauthorized parties. In phishing, attackers craft malicious websites disguised as well-known, legitimate sites and send them to individuals to steal personal information and other related private details. Therefore, an efficient and accurate method is required to determine whether a website is malicious. Numerous methods have been proposed for detecting malicious uniform resource locators (URLs) using deep learning, machine learning, and other approaches. In this study, we have used malicious and benign URLs datasets and have proposed a detection mechanism for detecting malicious URLs using recurrent neural network models such as long short-term memory (LSTM), bidirectional long short-term memory (Bi-LSTM), and the gated recurrent unit (GRU). Experimental results have shown that the proposed mechanism achieved an accuracy of 97.0% for LSTM, 99.0% for Bi-LSTM, and 97.5% for GRU, respectively.

Devices connect to a wireless local area network (WLAN) with Wi-Fi communication (see Chapter 7 (Wireless local area network)). A router connected to an Internet Service Provider (ISP), through a telephone line using DSL (Digital Subscriber Line) technology, provides access to the Internet (see Figure 8-1). The Internet is formed by interconnected computer networks using the Internet Protocol suite, consisting of the Transmission Control Protocol and the Internet Protocol (TCP/IP), to globally link devices. The World Wide Web (WWW) identifies information resources by URLs (Uniform Resource Locators). The client or web browser, such as Google Chrome or Mozilla Firefox, sends an HTTP (HyperText Transfer Protocol) request to the server device hosting the resource to retrieve information at the web address defined by the URL. The server responds to the client HTTP request, and the client displays the requested web page information on the Android tablet or mobile phone. The client must request web page information from the server, as the server cannot impose updates on the client. The exception is WebSocket, as discussed in Chapter 9.

Over the years, injection vulnerabilities have been at the top of the Open Web Application Security Project Top 10 and are one of the most damaging and widely exploited types of vulnerabilities against web applications. Structured Query Language (SQL) injection attack detection remains a challenging problem due to the heterogeneity of attack loads, the diversity of attack methods, and the variety of attack patterns. It has been demonstrated that no single model can guarantee adequate security to protect web applications, and it is crucial to develop an efficient and accurate model for SQL injection attack detection. In this paper, we propose synBERT, a semantic learning-based detection model that explicitly embeds the sentence-level semantic information from SQL statements into an embedding vector. The model learns representations that can be mapped to SQL syntax tree structures, as evidenced by visualization work. We gathered a wide range of datasets to assess the classification performance of the synBERT, and the results show that our approach outperforms previously proposed models. Even on brand-new, untrained models, accuracy can reach 90% or higher, indicating that the model has good generalization performance.

Web apps are now widely used in many different business domains and are vital tools for billions of people in their everyday lives. Unfortunately, a lot of these programs are harmful, which poses a serious risk to Internet users as they may spread spam, install malware, and steal private data. Because of the intricacy of extracting representative features, the vast amount of data, the dynamic nature of dangerous patterns, the stealthiness of assaults, and the limits of conventional classifiers, detecting malicious websites by online content analysis is useless. Static Uniform Resource Locators (URL) characteristics may often provide you instant information about a website without requiring you to load its content.However, complicated feature extraction, large data volumes, changing attack patterns, and the limits of conventional classifiers sometimes make it difficult for current systems to identify malicious web apps using online content analysis. It is inadequate to rely just on lexical URL properties, which might result in incorrect classifications. In order to improve the efficacy of dangerous website identification, this research suggests a multimodal representation strategy that combines textual and image-based information. While picture features are useful for identifying more generic harmful patterns, textual features help the deep learning model comprehend and convey specific semantic information pertaining to attack patterns. By doing this, it may be possible to identify patterns in picture format that are obscured in text format. To extract the hidden features from both textual and image-represented information, two Convolutional Neural Network (CNN) models were built. Both models' output layers were merged and fed into a classifier that uses artificial neural networks to make decisions. The usefulness of the suggested model in comparison to other models is shown by the results. While the false positive rate decreased by 1.5%, the overall performance as measured by the Matthews Correlation Coefficient (MCC) increased by 4.3%.

A critical review of the techniques used for anomaly detection of HTTP-based attacks: taxonomy, limitations and open challenges

Background: Data mining (DM) is an approach used in extracting valuable information from environmental processes. This research depicts a DM approach used in extracting some information from influent and effluent wastewater characteristic data of a waste stabilization pond (WSP) in Birjand, a city in Eastern Iran. Methods: Multiple regression (MR) and neural network (NN) models were examined using influent characteristics (pH, Biochemical oxygen demand [BOD 5 ], temperature, chemical oxygen demand [COD], total suspended solids [TSS], total dissolved solid [TDS], electrical conductivity [EC] and turbidity) as the regression input vectors. Models were adjusted to input attributes, effluent BOD 5 (BODout) and COD (CODout). The models performances were estimated by 10-fold external cross-validation. An internal 5-fold cross-validation was also used for the training data set in NN model. The models were compared using regression error characteristic (REC) plot and other statistical measures such as relative absolute error (RAE). Sensitivity analysis was also applied to extract useful knowledge from NN model. Results: NN models (with RAE = 78.71 ± 1.16 for BODout and 83.67 ± 1.35 for CODout) and MR models (with RAE = 84.40% ± 1.07 for BODout and 88.07 ± 0.80 for CODout) indicate different performances and the former was better (P < 0.05) for the prediction of both effluent BOD 5 and COD parameters. For the prediction of CODout the NN model with hidden layer size (H) = 4 and decay factor = 0.75 ± 0.03 presented the best predictive results. For BODout the H and decay factor were found to be 4 and 0.73 ± 0.03, respectively. TDS was found as the most descriptive influent wastewater characteristics for the prediction of the WSP performance. The REC plots confirmed the NN model performance superiority for both BOD and COD effluent prediction. Conclusion: Modeling the performance of WSP systems using NN models along with sensitivity analysis can offer better understanding on exploring the most significant parameters for the prediction of system performance. The findings of this study could build the foundation for prospective work on the characterization of WSP operations and optimization of their performances with a view to conducting statistical approaches.

With the great impact of the advancement in the hardware field, major efforts have been made to create large-scale networks of IoT devices (e.g., embedded systems, sensors, and actuators) that can interact with each other as well as their surrounding environments. However, most of the deployments are based on proprietary and tightly-coupled systems. To overwhelm the application layer interoperability issues, the Web of Things (WoT) paradigm aims at making smart things an integral part of the Web and thus, enabling them to communicate through Web standards/protocols. Therefore, applications/services making use of smart things become easier to conceive by means of Web standards/protocols (e.g., HTTP, Websockets). This paper proposes an approach enabling the smart devices to join the Web using features provided by the Stack4Things (S4T) OpenStack-based middleware. Thereby, user agents, typically, Web browsers and/or smart devices can make use of the resources of (other) IoT devices using globally resolvable Uniform Resource Locators (URLs) regardless of their underlying used protocol stacks.