A Closer Look at Intrusion Detection System for Web Applications

Abstract

Intrusion Detection System (IDS) acts as a defensive tool to detect the security attacks on the web. IDS is a known methodology for detecting network-based attacks but is still immature in monitoring and identifying web-based application attacks. The objective of this research paper is to present a design methodology for efficient IDS with respect to web applications. In this paper, we present several specific aspects which make it challenging for an IDS to monitor and detect web attacks. The article also provides a comprehensive overview of the existing detection systems exclusively designed to observe web traffic. Furthermore, we identify various dimensions for comparing the IDS from different perspectives based on their design and functionalities. We also propose a conceptual framework of a web IDS with a prevention mechanism to offer systematic guidance for the implementation of the system. We compare its features with five existing detection systems, namely AppSensor, PHPIDS, ModSecurity, Shadow Daemon and AQTRONIX WebKnight. This paper will highly facilitate the interest groups with the cutting edge information to understand the stronger and weaker sections of the domain and provide a firm foundation for developing an intelligent and efficient system.

An adaptive anomaly request detection framework based on dynamic web application profiles

“…The classification is mainly based on the detection mechanism of the methods.  Signature-based methods [3,4]: this is a well-known approach and has been investigated by many researchers. So far, the research community of web attack detection has built up a complete Core Rule Set [9] to support network users.…”

“…So far, the research community of web attack detection has built up a complete Core Rule Set [9] to support network users. Currently, the Core Rule Set is used in most of the web firewalls [3].  Anomaly-based methods: there have been many different anomaly based approaches on network security.…”

“…In [2], Mookhey presented the characteristics, compositions and operation principles of WA. Besides, some other works in [2][3][4] have shown several vulnerabilities and threats that attackers could exploit to attack the web applications. According to the surveys in [3] and [4], the vulnerabilities of the protocol hyper text transfer protocol (HTTP) or hypertext transfer protocol secure (HTTPS) are often preferable to be exploited by attackers.…”

“…Both signature-based and anomaly-based methods have certain advantages and disadvantages. In general, solutions applying signature-based techniques [2,3] are not able to detect unusual requests since these methods are mainly based on fixed ruling systems. Anomaly-based methods are capable of detecting abnormal requests because they utilize techniques to analyze and evaluate the behaviors of the requests.…”

Trusted Time-Based Verification Model for Automatic Man-in-the-Middle Attack Detection in Cybersecurity

“…To prevent the attack, an intrusion detection/prevention system (IDS/IPS) can be used. However, several studies in the literature concur that such third-party solutions exhibit practical limitations due to persistent system complexities, escalating deployment costs, and several inconveniences, including business productivity losses due to high false alarms [3,4]. To address these issues with the aim of ensuring secure information communications, we propose a novel inference scheme using trusted time-based verification for automatically detecting MITM attacks.…”