Foundation of semantic rule engine to protect web application attacks

Proceedings - 2011 10th International Symposium on Autonomous Decentralized Systems, ISADS 2011

Volumn , Issue , 2011, Pages 95-102

  Razzaq, Abdul ^a   Hur, Ali ^a   Masood, Muddassar ^a   Latif, Khalid ^a   Ahmad, H Farooq ^a,c   Takahashi, Hironao ^b,c  

^a NATIONAL UNIVERSITY OF SCIENCES AND TECHNOLOGY NUST   (Pakistan)

^b TOKYO INSTITUTE OF TECHNOLOGY   (Japan)

^c DTS Inc   (Japan)

Author keywords

Ontology security; Semantic security; Web application security

Indexed keywords

APPLICATION LAYERS; APPLICATION SECURITY; BASE SYSTEMS; CYBER THREATS; EBUSINESS; ENCODING SCHEMES; FALSE POSITIVE RATES; INFORMATION SHARING; INTELLIGENT INTRUSION DETECTION SYSTEMS; PACKET LEVEL; REASONING ABILITY; SEARCH SPACE REDUCTION; SECURITY SOLUTIONS; SEMANTIC CONCEPT; SEMANTIC RULES; SEMANTIC SECURITY; SYSTEM COMPONENTS; WEB APPLICATION; WEB APPLICATION SECURITY; WEB ATTACKS;

INTERNET PROTOCOLS; INTRUSION DETECTION; ONTOLOGY; PERSONAL COMPUTING; SEMANTICS; SURVEYS; WORLD WIDE WEB;

SEMANTIC WEB;

EID: 79955734165     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISADS.2011.19     Document Type: Conference Paper

References (28)

1. WebCohort, Inc. "Only 10% of Web applications are secured against common hacking techniques", http://2004-feb-02.html, 2004.
2. G. Hulme. "New software may improve application security". http://www.Informationweek.com, 2001.
3. Monica S. Lam, Michael Martin, Benjamin Livshits, and John Whaley. "Securing Web Applications with Static and Dynamic Information Flow Tracking" PEPM'08, January 7-8, 2008, San Francisco, California, USA.
4. http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20080424
5. National Vulnerability Database (NVD), http://nvd.nist.gov.
6. Open Web Application Security Project. "The ten most critical Web application security vulnerabilities", http://umn.dl.sourceforge.net/ sourceforge/owasp/OWASPTopTen2004.pdf.
7. Analyzing the Effectiveness and Coverage of Web Application Security Scanners 2007 http://searchsecurity.techtarget.com/tip.
8. By Jeff Forristal and Greg Shipley. "Vulnerability Assesment Scanners". http://www.networkcomputing.com
9. Scott Matsumoto. "Mitigating XSS-Why Input Validation is Bogus", http://www.cigital.com/justiceleague /2007/08/10/mitigating-xss- why-input-validation-is-bogus
10. C. Kruegel, T. Toth, and E. Kirda. "Service-specific Anomaly Detection for Network Intrusion Detection".
11. Frank S. Rietta. "Application Layer Intrusion Detection for SQL Injection". ACM SE'06 March 10 12, 2006, Melbourne, Florida, USA.
12. R. Boyer and J. Moore, "A fast string- searching algorithm", Commune ACM, 1977.
13. R. Liu, N. Huang, C. Kao, C. Chen, C. Chou. "A Fast Pattern-Match Engine for Network Processor-based Network Intrusion Detection System". Proceedings of the International Conference on Information Technology:, IEEE, Vol.1, pp.97 - 101.
14. T. Ryutov, C. Neuman, D. Kim, L. Zhou, "Integrated Access Control and Intrusion Detection for Web Servers". In IEEE transactions on parallel and distributed systems. Vol.14, No. 9, September 2003.
15. M. Roesch. "Snort - Lightweight Intrusion Detection for Networks". Proceedings of the USENIX LISA'99 Conference, November 1999.
16. Xin Zhao and Atul Prakash. WSF: An HTTP-level Firewall for Hardening Web Servers.
17. A. Anitha and V. Vaidehi. Context based Application Level Intrusion Detection. IEEE: International conference on Networking and Services (ICNS'06) 2006.
18. Xiao-Feng Wang, Jing-Li Zhou, Sheng-Sheng Yu, and Long-Zheng Cai. "Data Mining Methods for Anomaly Detection of HTTP Request Exploitations," Springer-Verlag Berlin Heidelberg 2005.
19. Y.B. Reddyl, R. Guha, "Intrusion Detection using Data Mining Techniques," Artificial Intelligence and Applications (AIA-2004), pp. 232-241, 2004.
20. S. Stolfo, A.L. Prodromidis, S. Tselepis, W. Lee, D.W. Fan, P.K. Chan, "JAM:Java Agents for Meta-Learning over Distributed Databases," Proceeding of KDD-97, pp. 74-81, 1997.
21. V. Raskin, C.F. Hempelmann, K.E. Triezenberg, Nirenburg, "Ontology in Information Security: A Useful Theoretical Foundation and Methodological Tool," Proceedings of the 2001 Workshop on New Security Paradigms (NSPW-2001), pp. 53-59, 2001.
22. G. Denker, L. Kagal, T. Finin, M. Paolucci, K. Sycara, "Security for DAML Web Services: Annotation and Matchmaking," The Semantic Web (ISWC 2003), LNCS 2870, Springer, 2003.
23. DAML+OIL. Availableat:http://www.daml.org/2000/12/daml+oil.dam.
24. J. Undercoffer, J., Pinkston, A. Joshi, T. Finin, "Target-Centric Ontology for Intrusion Detection," IJCAI Workshop on Ontologies and Distributed Systems (IJCAI'03), August, 2003.
25. Shao-Shin Hung and Damon Shing-Min Lio:A User-centric Intrusion Detection System by using Ontology Approach. 2006 conf/jcis/2006 JCIS http://dx.doi.org/10.2991/jcis.2006.
26. S.T. Sarasamma, Q.A. Zhu, and J. Huff, "Hierarchel Kohonenen Net for Anomaly Detection in Network Security", IEEE Transaction on Systems, Man, and Cybernetics-Part B: Cybernetics, 35(2), 2005, pp.302-312. (Pubitemid 40535913)
27. Web Application Firewalls: Defense in Depth for Your Web Infrastructure, By Jim Beechey - March 2009
28. Abdul Razzaq, Ali Hur, Hafiz Farooq Ahmad, Nasir Haider "Ontology Based Application Level Intrusion Detection System by using Bayesian Filter" The 2nd IEEE International Conference on Computer, Control & Communication (IEEE-IC4) 2009, PNEC Karachi, Pakistan.