Detecting web application attacks with use of Gene Expression Programming

Abstract

In the paper we present a novel approach based on applying a modern metaheuristic Gene Expression Programming (GEP) to detecting web application attacks. This class of attacks relates to malicious activity of an intruder against applications, which use a database for storing data. The application uses SQL to retrieve data from the database and web server mechanisms to put them in a web browser. A poor implementation allows an attacker to modify SQL statements originally developed by a programmer, which leads to stealing or modifying data to which the attacker has not privileges. While the attack consists in modification of SQL queries sent to the database, they are the only one source of information used for detecting attacks. Intrusion detection problem is transformed into classification problem, which the objective is to classify SQL queries between either normal or malicious queries. GEP is used to find a function used for classification of SQL queries. Experimental results are presented on the basis of SQL queries of different length. The findings show that the efficiency of detecting SQL statements representing attacks depends on the length of SQL statements. Additionally we studied the impact of classification threshold on the obtained results.

A novel approach for detection of SQL injection and cross site scripting attacks

“…Above the defined 36 tokens can be a potential risk to the system. False positive results are also a possibility [9].…”

Detection of SQL Injection Attack in Web Applications using Web Services

“…The existing solutions focus on web application attacks in general and are dependent on the applications [8] [9]. All the solutions are not placed as a layered approach and are specific to back-end databases and specific to platforms [10][11] [12]. This paper presents a different methodology to detect and protect SQL Injection in web applications through independent web services in a layered approach.…”

GEP-based Framework for Immune- Inspired Intrusion Detection

“…For example, the greedy generation scheme is based on the r-continuous bit matching: when generating an initial detector, it searches for any detector that can match the initial one. If there exists the detector, it means that the initial detector is redundant and should be deleted [18]. Meanwhile, the variable-length method that generating variable-length detectors can solve the problem with "holes" caused by the r-continuous bit matching [20], and the detector set is optimized during the detector generation process to avoid the redundant detectors.…”

“…As being briefly mentioned earlier, in IIDS, a detector is the rule for recognizing attacks. The constraint-based GEP rule (here in after to be referred as GEP-rule), has been proposed in our previous work and been proved to be feasible and effective [18]. Let L be a logical operator set, R be a relational operator set, and A be an arithmetic operator set.…”

“…Applying a modern metaheuristic GEP, a novel approach to detecting web application attacks was proposed by J. Skaruz [17]. A GEP-based constraint grammar and a constraint-based GEP rule extraction algorithm (CGREA) were proposed in our previous work [18]. Within a few evolution generations, CGREA can generate a small number of bi-attribute detection rules ( i.e., each rule consists of only two attributes) for IDS to achieve a high degree of coverage.…”