BlackWatch: Increasing Attack Awareness within Web Applications

Abstract

Web applications are relied upon by many for the services they provide. It is essential that applications implement appropriate security measures to prevent security incidents. Currently, web applications focus resources towards the preventative side of security. Whilst prevention is an essential part of the security process, developers must also implement a level of attack awareness into their web applications. Being able to detect when an attack is occurring provides applications with the ability to execute responses against malicious users in an attempt to slow down or deter their attacks. This research seeks to improve web application security by identifying malicious behaviour from within the context of web applications using our tool BlackWatch. The tool is a Python-based application which analyses suspicious events occurring within client web applications, with the objective of identifying malicious patterns of behaviour. Based on the results from a preliminary study, BlackWatch was effective at detecting attacks from both authenticated, and unauthenticated users. Furthermore, user tests with developers indicated BlackWatch was user friendly, and was easy to integrate into existing applications. Future work seeks to develop the BlackWatch solution further for public release.

Measuring Developers’ Web Security Awareness from Attack and Defense Perspectives

“…This could also help to identify if application frameworks provide useful artifacts, e.g., event or exception classes, that can be utilized for logging and monitoring purposes. This could complement related research on automatically modelling security incidents for logging [47] and application intrusion detection approaches to create attack-aware software applications [53], [26], [55].…”

A Taxonomy of Approaches for Integrating Attack Awareness in Applications

“…Work by Kerschbaum et al [16] provides an example of code triggers usage to detect network-based attacks within the OpenBSD kernel, and application-specific attacks from within Sendmail. The AppSensor framework [31], and BlackWatch [11] are further examples which apply the code trigger variant.…”

“…Solutions like the AppSensor framework [31] and Black-Watch [11] rely on the hypothesis that an attacker can be detected by monitoring application-specific invariants (properties that must always hold while the application is executed).…”

“…It is the developers responsibility to put the security controls in place, however there is a chance that the placement is neglected due to a lack of priority or time spent on nonsecurity tasks, leading to areas of the application which are not covered. In the worst case, this approach will not be accepted by the developers as it can be seen as an additional effort which needs to be completed on top of others tasks [11] [34]. Due to this issue, integration approaches should utilize proven development techniques e.g.…”

A Taxonomy of Approaches for Integrating Attack Awareness in Applications

“…Solutions like the AppSensor framework [31] and Black-Watch [11] rely on the hypothesis that an attacker or malicious behavior can be detected by knowing the 'normal' behavior of the target application, and by being able to monitor deviations from such behavior. Application developers are therefore ideal candidates to apply this integration approach as they have specified, designed and implemented the application, and know where to strategically place security controls.…”