Risk assessment of code injection vulnerabilities using fuzzy logic-based system

Abstract

Web applications are notoriously vulnerable to code injection attacks. Given that, practitioners need to assess the risk posed by applications due to code injection attacks to plan ahead on employing necessary mitigation approaches. This paper proposes a risk assessment approach for code injection vulnerability in web applications. We are motivated by the observation that traditional risk assessment approaches work well when quantitative values of specific parameters of the risk computation model is known in advance. In practice, they are difficult to predict correctly. Moreover, one specific code injection vulnerabilities can be exploited in different ways that may result in different types of severity level. Further, diverse types of injection vulnerabilities and their implications cannot be combined in existing approaches. To address these limitations, we propose a Fuzzy Logic-based System (FLS) to assess the risk due to different types of code injection vulnerabilities. Our further contribution is a set of proposed code-level metrics that can be used to establish the linguistic terms to express vulnerability levels and their impact subjectively. We apply nested FLS to combine risk from multiple vulnerabilities to assess a single value representing the overall risk. We evaluate our approach with three real-world web applications implemented in PHP, and apply for SQL Injection (SQLI) and Cross-Site Scripting (XSS), the two most widely reported vulnerabilities in today's web applications. The initial results indicate that the proposed approach can effectively assess high risks present in vulnerable applications.

RETRACTED: A quantitative risk analysis methodology for the security of web application database against SQL injection (SQLi) attacks utilizing fuzzy logic system as computational technique

“…low, medium, and high. 7 Now it is time to define membership function for each linguistic variable. A membership function (denoted by the…”

“…The example values of trapezoidal membership function (TNF) for our three linguistic variables are as follows: as Low (l1), the TNF (o,p,q,r) is (2,3,4,5). Similarly for Medium(l2) is (4,5,6,7) and High (l3) is (6,7,8,9). The values for these three linguistic variables are assumed as follows: value of Low ¼ 0.3, Medium ¼ 0.6, and High ¼ 0.9 on y-axis to draw respective membership function.…”

Review of XSS Attack and Detection on Web Applications

“…Meanwhile, inputs leading to Web applications' data flow and control flow variability, which make it difficult to accurately obtain injection points' information, especially for the hidden interfaces. Therefore, new mathematical methods such as fuzzy logic, threat modeling are introduced to evaluate potential risk of injection vulnerabilities [33,35].…”

Generative Adversarial Network (GAN)-Based Autonomous Penetration Testing for Web Applications

“…There are some research works that involve the use of fuzzy logic for generating attack samples. The Fuzzy Logic System (FLS), introduced by Shahriar et al [24], utilizes input from different attack types, described as top threats in Open Worldwide Application Security Project (OWASP) web attacks, and risk assessment models, to generate attack payloads. These payloads can be tested against PHP-based applications, to check the security risk level of different applications.…”