A Supervised Learning Approach to Protect Client Authentication on the Web

Abstract

Browser-based defenses have recently been advocated as an effective mechanism to protect potentially insecure web applications against the threats of session hijacking, fixation, and related attacks. In existing approaches, all such defenses ultimately rely on client-side heuristics to automatically detect cookies containing session information, to then protect them against theft or otherwise unintended use. While clearly crucial to the effectiveness of the resulting defense mechanisms, these heuristics have not, as yet, undergone any rigorous assessment of their adequacy. In this article, we conduct the first such formal assessment, based on a ground truth of 2,464 cookies we collect from 215 popular websites of the Alexa ranking.To obtain the ground truth, we devise a semiautomatic procedure that draws on the novel notion of authentication token, which we introduce to capture multiple web authentication schemes. We test existing browser-based defenses in the literature against our ground truth, unveiling several pitfalls both in the heuristics adopted and in the methods used to assess them. We then propose a new detection method based on supervised learning, where our ground truth is used to train a set of binary classifiers, and report on experimental evidence that our method outperforms existing proposals. Interestingly, the resulting classifiers, together with our hands-on experience in the construction of the ground truth, provide new insight on how web authentication is actually implemented in practice. . 2015. A supervised learning approach to protect client authentication on the web.

Semantics-Based Analysis of Content Security Policy Deployment

“…However, being more comprehensive would require a significant engineering effort and the creation of personal accounts at the crawled websites, a process which is notoriously hard to automate [6].…”

“…Just to mention a few relevant works, previous evaluations focused on other aspects of web security, like remote JavaScript inclusion [19], DOM-based XSS [15], mixed content websites [7], authentication cookies [6] and HSTS [14].…”

A Longitudinal Study on Web-Sites Password Management (in)Security: Evidence and Remedies

“…As for credentials, their disclosure would allow attackers to fully impersonate the user on the Web, exploiting the victim's privileges in the authenticated sessions. In [7], authors built a dataset gathering 2,464 authentication cookies from a sample of 215 most popular Web-sites of Alexa's ranking. As a result, they proposed the development of a set of binary classifiers, aimed at identifying these authentication cookies exploiting (supervised) machine learning techniques.…”

The Data Processing Approach for Preserving Personal Data in FinTech-Driven Paradigm

“…These days, there are several authentication technology studies [15,16], such as the two major ones being certificate and SMS authentication. But to provide new services, it is essential to improve alternate authentication technologies.…”