Web application protection techniques: A taxonomy

Journal of Network and Computer Applications

Volumn 60, Issue , 2016, Pages 95-112

  Prokhorenko, Victor ^a   Choo, Kim Kwang Raymond ^a   Ashman, Helen ^a  

^a UNIVERSITY OF SOUTH AUSTRALIA   (Australia)

Author keywords

Web application; Web IDS; Web protection; Web security

Indexed keywords

COMPUTER NETWORKS;

DEVELOPMENT PRACTICES; PROTECTION METHODS; PROTECTION TECHNIQUES; SECURE SOFTWARE; WEB APPLICATION; WEB IDS; WEB PROTECTION; WEB SECURITY;

WORLD WIDE WEB;

EID: 84951790264     PISSN: 10848045     EISSN: 10958592     Source Type: Journal    
DOI: 10.1016/j.jnca.2015.11.017     Document Type: Review

References (109)

1. Ars Technica. Just-released WordPress 0day makes it easy to hijack millions of websites. ; 2015a [retrieved on 20.06.15].
2. Ars Technica. Serious bug in fully patched Internet Explorer puts user credentials at risk. ; 2015b [retrieved on 20.06.15].
3. Antoniol Giuliano, Di Penta Massimiliano, Zazzara Michele. Understanding web applications through dynamic analysis. In: Proceedings of the 12th IEEE international workshop on program comprehension (IWPC'04); 2004.
4. Artzi Shay, Kiezun Adam, Dolby Julian, Tip Frank, Dig Danny, Paradkar Amit, Ernst Michael D. Finding bugs in dynamic web applications. In: Proceedings of the 2008 international symposium on Software testing and analysis (ISSTA'08); 2008.
5. Usman Asghar Sandu, Sajjad Haider, Salman Naseer, and Obaid Ullad Ateeb A study of the novel approaches used in intrusion detection and prevention systems Int J Inf Educ Technol 1 5 2011
6. Bezemer Cor-Paul, Mesbah Ali, van Deursen Arie. Automated security testing of web widget interactions. In: Proceedings of the 7th joint meeting of the European software engineering conference and the ACM SIGSOFT symposium on the foundations of software engineering (ESEC/FSE'09); 2009.
7. Bates Daniel, Barth Adam, Jackson Collin. Regular expressions considered harmful in client-side XSS filters. In: Proceedings of the 19th international conference on World wide web (WWW'10); 2010.
8. Balzarotti Davide, Cova Marco, Felmetsger Vika, Jovanovic Nenad, Kirda Engin, Kruegel Christopher, Vigna Giovanni. Saner: composing static and dynamic analysis to validate sanitization in web applications. In: Proceedings of the 29th IEEE Symposium on Security and Privacy (Oakland'08); 2008.
9. Balzarotti Davide, Cova Marco, Felmetsger Viktoria V, Vigna Giovanni. Multi-module vulnerability analysis of web-based applications. In: Proceedings of the 14th ACM conference on computer and communications security (CCS'07); 2007.
10. Batory Don, Lofaso Bernie, Smaragdakis Yannis. JTS: tools for implementing domain-specific languages. In: Proceedings of the 5th international conference on software reuse (ICSR'98); 1998.
11. Buehrer Gregory, Weide Bruce W, Sivilotti Paolo AG. Using parse tree validation to prevent SQL injection attacks. In: Proceedings of the 5th international workshop on software engineering and middleware (SEM'05); 2005.
12. Balduzzi Marco, Torrano Gimenez Carmen, Balzarotti Davide, Kirda Engin. Automated discovery of parameter pollution vulnerabilities in web applications. In: Proceedings of the 18th annual network and distributed system security symposium; 2011.
13. Bravenboer Martin, Dolstra Eelco, Visser Eelco. Preventing injection attacks with syntax embeddings. In: Proceedings of the 6th international conference on generative programming and component engineering (GPCE'07); 2007.
14. Prithvi Bisht, P. Madhusudan, and V.N. Venkatakrishnan CANDID: dynamic candidate evaluations for automatic prevention of SQL injection attacks ACM Trans Inf Syst Secur 13 2010 2 Article 14
15. Bisht Prithvi, Hinrichs Timothy, Skrupsky Nazari, Venkatakrishnan VN. WAPTEC: whitebox analysis of web applications for parameter tampering exploit construction. In: Proceedings of the 18th ACM conference on computer and communications security (CCS'11); 2011.
16. Boyd Stephen W, Keromytis Angelos D. SQLrand: preventing SQL injection attacks. In: Proceedings of the 2nd applied cryptography and network security conference (ACNS); 2004.
17. Bai Yuebin, Kobayashi Hidetsune. Intrusion detection systems: technology and development. In: Proceedings 17th international conference on advanced information networking and applications (AINA'2003); 2003.
18. Brian Chess, and Jacob West Dynamic taint propagation: finding vulnerabilities without attacking Inf Secur Tech Rep 13 1 2008
19. CWE. CWE/SANS Top 25 Most Dangerous Software Errors. ; 2011 [retrieved on 06.20.15].
20. Chin Erika, Wagner David. Efficient character-level taint tracking for Java. In: Proceedings of the 2009 ACM workshop on secure web services (SWS'09); 2009.
21. Jian Chang, Krishna K. Venkatasubramanian, Andrew G. West, and Insup Lee Analyzing and defending against web-based malware ACM Comput Surv 45 4 2013 Article 49
22. Cova Marco, Balzarotti Davide, Felmetsger Viktoria, Vigna Giovanni. Swaddler: an approach for the anomaly-based detection of state violations in web applications. In: Proceedings of the 10th international symposium on recent advances in intrusion detection (RAID'07); 2007.
23. Chong Stephen, Vikram K, Myers Andrew C. SIF: enforcing confidentiality and integrity in web applications. In: Proceedings of 16th USENIX security symposium on usenix security symposium (SS'07); 2007.
24. Varun Chandola, Arindam Banerjee, and Vipin Kumar Anomaly detection: a survey ACM Comput Surv 41 3 2009 Article 15
25. Doupé Adam, Cavedon Ludovico, Kruegel Christopher, Vigna Giovanni. Enemy of the state: a state-aware black-box web vulnerability scanner. In: Proceedings of the 21st USENIX conference on security symposium (Security'12); 2012.
26. Doupé Adam, Cui Weidong, Jakubowski Mariusz H, Peinado Marcus, Kruegel Christopher, Vigna Giovanni. deDacota: toward preventing server-side XSS via automatic code and data separation. In: Proceedings of the ACM SIGSAC conference on Computer & communications security (CCS'13); 2013.
27. Diebold Boris, Kaufmann Michael. Usage-based visualization of web localities. In: Proceedings of the Asia-Pacific symposium on information visualisation-Volume 9 (APVis'01). Darlinghurst, Australia: Australian Computer Society Inc.; 2001
28. Sarang Dharmapurikar, Praveen Krishnamurthy, Todd S. Sproull, and John W. Lockwood Deep packet inspection using parallel bloom filters IEEE Micro 24 2004 1
29. Du Wenliang, Jayaraman Karthick, Tan Xi, Luo Tongbo, Chapin Steve. Position paper: why are there so many vulnerabilities in web applications? In: Proceedings of the workshop on new security paradigms workshop (NSPW'11); 2011.
30. Forbes. Wordpress under attack: how to avoid the coming botnet. ; 2013 [retrieved on 06.20.15].
31. Furr Michael, Foster Jeffrey S. Checking type safety of foreign function calls. In: Proceedings of the ACM SIGPLAN conference on programming language design and implementation (PLDI'05); 2005.
32. Felmetsger Viktoria, Cavedon Ludovico, Kruegel Christopher, Vigna Giovanni. Toward automated detection of logic vulnerabilities in web applications. In: Proceedings of the 19th USENIX Security symposium (USENIX'10); 2010.
33. Guha Arjun, Krishnamurthi Shriram, Jim Trevor. Using static analysis for Ajax intrusion detection. In: Proceedings of the 18th international conference on world wide web (WWW'09); 2009.
34. Grechanik Mark, Cook William R, Batory Don, Lieberherr Karl J. Static checking of interoperating components (ICSE'2006); 2006.
35. Hassan Ahmed E, Holt Richard C. Architecture recovery of web applications. In: Proceedings of the 24th international conference on software engineering (ICSE '02); 2002.
36. Heiderich Mario, Frosch Tilman, Jensen Meiko, Holz Thorsten. Crouching tiger-hidden payload: security risks of scalable vectors graphics. In: Proceedings of the 18th ACM conference on computer and communications security (CCS'11); 2011.
37. Mohammad Hossein Manshaei, Quanyan Zhu, Tansu Alpcan, Tamer Bacşar, and Jean-Pierre Hubaux Game theory meets network security and privacy ACM Comput Surv 45 3 2013 Article 25
38. Hooimeijer Pieter, Livshits Benjamin, Molnar David, Saxena Prateek, Veanes Margus. Fast and precise sanitizer analysis with BEK. In: Proceedings of the 20th USENIX conference on security (SEC'11); 2011.
39. Sang-Jun Han, and Sung-Bae Cho Evolutionary neural networks for anomaly detection based on the behavior of a program IEEE Trans Syst 36 3 2006 559 670
40. Shan Shan Huang, David Zook, and Yannis Smaragdakis Domain-specific languages and program generation with meta-AspectJ ACM Trans Softw Eng Methodol 18 2008 (Article 6)
41. Haldar Vivek, Chandra Deepak, Franz Michael. Dynamic taint propagation for java. In: Proceedings of the 21st annual computer security applications conference (ACSAC'05); 2005.
42. Halfond William GJ, Orso Alessandro. Preventing SQL injection attacks using AMNESIA. In: Proceedings of the 28th international conference on software engineering (ICSE'06); 2006.
43. Halfond William GJ, Orso Alessandro, Manolios Panagiotis. Using positive tainting and syntax-aware evaluation to counter SQL injection attacks. In: Proceedings of the 14th ACM SIGSOFT international symposium on foundations of software engineering (SIGSOFT'06/FSE-14); 2006.
44. Halfond William GJ, Anand Saswat, Orso Alessandro. Precise interface identification to improve testing and analysis of web applications. In: Proceedings of the eighteenth international symposium on software testing and analysis (ISSTA'09); 2009.
45. Huang Yao-Wen, Yu Fang, Hang Christian, Tsai Chung-Hung, Lee Der-Tsai, Kuo Sy-Yen. Securing web application code by static analysis and runtime protection. In: Proceedings of the 13th international conference on world wide web (WWW'04); 2004.
46. Imran Ghafoor, Jattala Imran, Durrani, Shakeel, Muhammad Tahir. Analysis of OpenSSL heartbleed vulnerability for embedded systems. In: Proceedings of the IEEE 17th international multi-topic conference (INMIC'2014); 2014.
47. Jovanovic Nenad, Kirda Engin, Kruegel Christopher. Preventing cross site request forgery attacks. In: Proceedings of the 2nd international conference on security and privacy in communication networks (SecureComm'06); 2006a.
48. Jovanovic Nenad, Kirda Engin, Kruegel Christopher. Pixy: a static analysis tool for detecting web application vulnerabilities. In: Proceedings of the 27th IEEE symposium on security and privacy (Oakland'06); 2006b.
49. Jovanovic Nenad, Kirda Engin, Kruegel Christopher. Precise Alias Analysis for Syntactic Detection of Web Application Vulnerabilities. In: Proceedings of the ACM SIGPLAN workshop on programming languages and analysis for security; 2006c.
50. Kruegel Christopher, Vigna Giovanni. Anomaly detection of web-based attacks. In: Proceedings of the 10th ACM conference on computer and communication security (CCS'03); 2003.
51. Kemalis Konstantinos, Tzouramanis Theodores. SQL-IDS: a specification-based approach for SQL-injection detection. In: Proceedings of the 2008 ACM symposium on applied computing (SAC'08); 2008.
52. Kukielka Przemyslaw, Kotulski Zbigniew. Analysis of different architectures of neural networks for application in intrusion detection systems. In: Proceedings of the international multiconference on computer science and information technology; 2008
53. Liu Anyi, Yuan Yi, Wijesekera Duminda, Stavrou Angelos. SQLProb: a proxy-based architecture towards preventing SQL injection attacks. In: Proceedings of the ACM symposium on applied computing (SAC'09); 2009.
54. Livshits Benjamin, Chong Stephen. Towards fully automatic placement of security sanitizers and declassifiers. In: Proceedings of the 40th annual ACM SIGPLAN-SIGACT symposium on principles of programming languages (POPL'13); 2013.
55. Livshits Benjamin, Nori Aditya V, Rajamani Sriram K, Banerjee Anindya. Merlin: specification inference for explicit information flow problems SIGPLAN Not 44, 6; 2009
56. Li Jian, Zhang Guo-Yin, Gu Guo-chang. The research and implementation of intelligent intrusion detection system based on artificial neural network. In: Proceedings of international conference on machine learning and cybernetics, volume 5; 2004
57. Louw Mike Ter, Venkatakrishnan VN. Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers. In: Proceedings of the 30th IEEE symposium on security and privacy (SP'09); 2009.
58. Livshits V. Benjamin, Lam Monica S. Finding security vulnerabilities in java applications with static analysis. In: Proceedings of the 14th conference on USENIX security symposium-volume 14 (SSYM'05); 2005.
59. Wenke Lee, and Salvatore J. Stolfo A framework for constructing features and models for intrusion detection systems ACM Trans Inf Syst Secur 3 4 2000 227 261
60. Lee Wenke, Stolfo SJ, Chan PK, Eskin E, Wei Fan, Miller M, Hershkop S, Junxin Zhang. Real time data mining-based intrusion detection. In: Proceedings of DARPA information survivability conference & exposition II (DISCEX'01); 2001.
61. Li Xiaowei, Xue Yuan. BLOCK: A black-box approach for detection of state violation attacks towards web applications. In: Proceedings of the 27th annual computer security applications conference (ACSAC'11); 2011.
62. Xiaowei Li, and Yuan Xue A survey on server-side approaches to securing web applications. ACM Comput Surv 46 4 2014 (Article 54)
63. Chuck Musciano, and Bill Kennedy HTML & XHTML: the definitive guide 4th edition 2000 O'Reilly Media Print ISBN: 978-0-596-00026-4, ISBN 10: 0-596-00026-X
64. Darren Mutz, Fredrik Valeur, Giovanni Vigna, and Christopher Kruegel Anomalous system call detection ACM Trans Inf Syst Secur 9 1 2006 61 93
65. Merlo Ettore, Letarte Dominic, Antoniol Giuliano. Automated Protection of PHP Applications Against SQL-injection Attacks. In: Proceedings of the 11th European conference on software maintenance and reengineering (CSMR'07); 2007.
66. Maggi Federico, Robertson William, Kruegel Christopher, Vigna Giovanni. Protecting a moving target: addressing web application concept drift. In: Proceedings of the 12th international symposium on recent advances in intrusion detection (RAID'09); 2009.
67. Marco-Gisbert Hector, Ripoll Ismael. On the effectiveness of NX, SSP, RenewSSP, and ASLR against Stack Buffer Overflows. In: Proceedings of the IEEE 13th international symposium on network computing and applications (NCA); 2014.
68. Medeiros Ibéria, Neves Nuno F, Correia Miguel. Automatic detection and correction of web application vulnerabilities using data mining to predict false positives. In: Proceedings of the 23rd international conference on world wide web (WWW'14); 2014.
69. Mason Joshua, Small Sam, Monrose Fabian, MacManus Greg. English shellcode. In: Proceedings of the 16th ACM conference on computer and communications security (CCS'09); 2009.
70. Moonen Leon. Generating robust parsers using island grammars. In: Proceedings of the eighth working conference on reverse engineering (WCRE'01); 2001.
71. Micahel Martin, Benjamin Livshits, and Monica S. Lam SecuriFly: runtime vulnerability protection for Web applications 2006 Stanford University San Diego, California, USA (OOPSLA'05), October 16-20, 2005
72. Robert Mitchell, and Ing-Ray Chen A survey of intrusion detection techniques for cyber-physical systems ACM Comput Surv 46 2014 4 Article 55
73. Minamide Yasuhiko. Static approximation of dynamically generated Web pages. In: Proceedings of the 14th international conference on world wide web (WWW'05); 2005.
74. Nguyen-tuong Anh, Guarnieri Salvatore, Greene Doug, Shirley Jeff, Evans David. Automatically hardening web applications using precise tainting. In: Proceedings of the 20th IFIP international information security conference; 2005.
75. Nadji Yacin, Saxena Prateek, Song Dawn. Document structure integrity: a robust basis for cross-site scripting defense. In NDSS'09; 2009.
76. Pietraszek Tadeusz, Berghe Chris Vanden. Defending against injection attacks through context-sensitive string evaluation. In: Proceedings of the 8th international symposium on recent advances in intrusion detection (RAID'05); 2005.
77. Park Yongsu, Lee Jaeheung, Cho Yookun. Intrusion detection using noisy training data. Computational science and its applications (ICCSA'2004); 2004.
78. Ray Donald, Ligatti Jay. Defining code-injection attacks. SIGPLAN Not 47, 1; 2012
79. Robertson William, Vigna Giovanni. Static enforcement of web application integrity through strong typing. In: Proceedings of the 18th conference on USENIX security symposium (SSYM'09); 2009.
80. Sung Andrew H, Mukkamala Srinivas. Identifying important features for intrusion detection using support vector machines and neural networks. In: Proceedings of the 2003 symposium on applications and the internet (SAINT'03); 2003.
81. Scott David, Sharp Richard. Abstracting application-level web security. In: Proceedings of the 11th international conference on world wide web (WWW'02); 2002.
82. Sun Fangqi, Xu Liang, Su Zhendong. Static detection of access control vulnerabilities in web applications. In: Proceedings of the 20th USENIX security symposium (USENIX'11); 2011.
83. Fred B. Schneider Enforceable security policies ACM Trans Inf Syst Secur 3 1 2000 30 50
84. Schmitt Isabell, Schinzel Sebastian. WAFFle: fingerprinting filter rules of web application firewalls. In: Proceedings of the 6th USENIX conference on offensive technologies (WOOT'12); 2012.
85. Skaruz Jaroslaw. Intrusion detection in web applications: evolutionary approach. In: Proceedings of the international multiconference on computer science and information technology; 2009
86. Shum Jimmy, Malki Heidar A. Network intrusion detection system using neural networks. In: Proceedings of the fourth international conference on natural computation volume 5 (ICNC'08); 2008.
87. Samuel Mike, Saxena Prateek, Song Dawn. Context-sensitive auto-sanitization in web templating languages using type qualifiers. In: Proceedings of the 18th ACM conference on computer and communications security (CCS'11); 2011.
88. Skrupsky Nazari, Bisht Prithvi, Hinrichs Timothy, Venkatakrishnan VN, Zuck Lenore. TamperProof: a server-agnostic defense for parameter tampering attacks on web applications. In: Proceedings of the third ACM conference on data and application security and privacy (CODASPY'13); 2013.
89. Saxena Prateek, Molnar David, Livshits Benjamin. SCRIPTGARD: automatic context-sensitive sanitization for large-scale legacy web applications. In: Proceedings of the 18th ACM conference on computer and communications security (CCS'11); 2011.
90. Sommer Robin, Paxson Vern. Outside the closed world: on using machine learning for network intrusion detection. In: Proceedings of the IEEE symposium on security and privacy (SP); 2010.
91. Son Sooel, McKinley Kathryn S, Shmatikov Vitaly. Diglossia: detecting code injection attacks with precision and efficiency. In: Proceedings of the 2013 ACM SIGSAC conference on computer & communications security (CCS'13); 2013.
92. Scholte Theodoor, Robertson William, Balzarotti Davide, Kirda Engin. An empirical analysis of input validation mechanisms in web applications and languages. In: Proceedings of the 27th annual ACM symposium on applied computing (SAC'12); 2012.
93. Srivastava Varun, Bond Michael D, McKinley Kathryn S, Shmatikov Vitaly. A security policy oracle: detecting security holes using multiple API implementations SIGPLAN Not46, 6; 2011
94. Su Zhendong, Wassermann Gary. The essence of command injection attacks in web applications. In: Proceedings of the conference record of the 33rd ACM SIGPLAN-SIGACT symposium on principles of programming languages (POPL'06); 2006.
95. Tripp Omer, Pistoia Marco, Fink Stephen J, Sridharan Manu, Weisman, Omri TAJ: effective taint analysis of web applications SIGPLAN Not 44; 2009, p. 6
96. Valeur Fredrik, Mutz Darren, Vigna Giovanni. A learning-based approach to the detection of SQL attacks. In: Proceedings of the conference on detection of Intrusions and malware and vulnerability assessment (DIMVA'05); 2005.
97. Van Gundy Matthew, Chen Hao. Noncespaces: using randomization to enforce information flow tracking and Thwart XSS Attacks. In: Proceedings of the 16th annual network and distributed system security symposium (NDSS'09); 2009.
98. Wassermann Garry, Su Zhendong. An analysis framework for security in web applications. In: Proceedings of the FSE workshop on specification and verification of component-based systems (SAVCBS'2004); 2004.
99. Wassermann Garry, Su Zhendong. Static detection of cross-site scripting vulnerabilities. In: Proceedings of the 30th international conference on software engineering (ICSE'08); 2008.
100. Weinberger Joel, Barth Adam, Song Dawn. Towards client-side HTML security policies. In: Proceedings of the 6th USENIX conference on hot topics in security (HotSec'11); 2011a.
101. Weinberger Joel, Saxena Prateek, Akhawe Devdatta, Finifter Matthew, Shin Richard, Song Dawn. A systematic analysis of XSS sanitization in web application frameworks. In: Proceedings of the 16th European conference on research in computer security (ESORICS'11); 2011b.
102. Wired. Massive Attack: Half a million microsoft-powered sites hit with SQL injection. ; 2008 [retrieved on 20.06.15].
103. Wired. 8 out of 10 software apps fail security test. ; 2011 [retrieved on 20.06.15].
104. Wired. Black Hat is Over, But SQL Injection Attacks Persist. ; 2012 [retrieved on 20.06.15.].
105. World Wide Web Consortium. HTML5 specification. W3C. ; 2014 [retrieved on 17.05.15.].
106. Xie Yichen, Aiken Alex. Static detection of security vulnerabilities in scripting languages. In: Proceedings of the 15th conference on USENIX security symposium-Volume 15 (USENIX-SS'06); 2006.
107. Yu Fang, Alkhalaf Muath, Bultan Tevfik. STRANGER: an automata-based string analysis tool for PHP. In: Proceedings of the 16th international conference on tools and algorithms for the construction and analysis of systems (TACAS'10); 2010.
108. Zheng Yunhui, Zhang Xiangyu. Path sensitive static analysis of web applications for remote code execution vulnerability detection. In: Proceedings of the 2013 international conference on software engineering (ICSE'13); 2013.
109. Zheng Yunhui, Zhang Xiangyu. Static detection of resource contention problems in server-side scripts (ICSE'12); 2012.