protecting a moving target addressing web application
play

Protecting a Moving Target: Addressing Web Application Concept Drift - PowerPoint PPT Presentation

Feb 10, 2023 •289 likes •1.08k views

Protecting a Moving Target: Addressing Web Application Concept Drift The 12 th International Symposium on Recent Advances in Intrusion Detection 2009 Federico Maggi, William Robertson, Christopher Krgel, Giovanni Vigna Politecnico di Milano,

  1. Protecting a Moving Target: Addressing Web Application Concept Drift The 12 th International Symposium on Recent Advances in Intrusion Detection 2009 Federico Maggi, William Robertson, Christopher Krügel, Giovanni Vigna Politecnico di Milano, Univeristy of California Santa Barbara September 23, 2009

  2. Adapting to changes of the protected web application.

  3. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses)

  4. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32

  5. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val>

  6. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val>

  7. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val> ...

  8. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val> ... /<component1>/<par1>/<par1-val>/<par2>/<par2-val>

  9. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val> ... /<component1>/<par1>/<par1-val>/<par2>/<par2-val> /<component2>/<par1>/<par1-val>

  10. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val> ... /<component1>/<par1>/<par1-val>/<par2>/<par2-val> /<component2>/<par1>/<par1-val> Webserver Clients Millions of good HTTP messages

  11. Modeling benign HTTP interactions

  12. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Models of good messages /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  13. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M2 M3 Mn M1 /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Example of models /<component1>/<par1>/<par1-val> — parameter string length /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> — numeric range /<component1>/<par1>/<par1-val> — probabilistic grammar of strings /<component1>/<par1>/<par1-val> — string character distribution /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  14. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Models of good sessions /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> C7 C1 C3 /<component1>/<par1>/<par1-val> C2 /<component1>/<par1>/<par1-val> C1 C2 C3 C10 C7 /<component1>/<par1>/<par1-val> M1 M2 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  15. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> C1 C7 C1 C2 C3 /<component1>/<par1>/<par1-val> C2 C5 /<component1>/<par1>/<par1-val> C1 C3 C3 C10 C7 /<component1>/<par1>/<par1-val> M1 M2 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  16. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> C1 C7 C1 C2 C3 /<component1>/<par1>/<par1-val> C2 C5 /<component1>/<par1>/<par1-val> C1 C3 C3 C10 C7 /<component1>/<par1>/<par1-val> M1 M2 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  17. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Detection of bad messages /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  18. Modeling benign HTTP interactions Client Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Detection of bad sessions /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> C1 C7 C1 C2 C3 /<component1>/<par1>/<par1-val> C2 C5 /<component1>/<par1>/<par1-val> C1 C3 C3 C10 C7 /<component1>/<par1>/<par1-val> M1 M2 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver Webserver

  19. What if the modeled features change? Note that this is the common problem of anomaly detection, per sé

  20. What if the modeled features change? Note that this is the common problem of anomaly detection, per sé In practice, what if the protected website suddenly changes?

  21. What if the modeled features change? Note that this is the common problem of anomaly detection, per sé In practice, what if the protected website suddenly changes? ◮ site changes means changes in the good behavior,

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target

Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target

Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target techniques, their threat models, and their technical details. Cyber moving target technique: Defend a system Increase the complexity of cyber

442 views • 40 slides
Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber

Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber

Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber moving target technique refers to any technique that attempts to defend a system and increase the complexity of cyber attacks by making the system

728 views • 27 slides
Pwned: Protecting Yourself in the 2019 By Dallin Warne 1 Why are you a target? 99% Money

Pwned: Protecting Yourself in the 2019 By Dallin Warne 1 Why are you a target? 99% Money

Pwned: Protecting Yourself in the 2019 By Dallin Warne 1 Why are you a target? 99% Money 1% Everything else (revenge, activism, hate, espionage, etc) Why do they do it? Because it works. 3% 5% clicks on phishing links, down

581 views • 23 slides
Moving HPC into the Mainstream Addressing the challenges of Mainstream HPC WHOS ON THE PANEL

Moving HPC into the Mainstream Addressing the challenges of Mainstream HPC WHOS ON THE PANEL

Moving HPC into the Mainstream Addressing the challenges of Mainstream HPC WHOS ON THE PANEL Jon Collins / The Register Nick Curcuru / MasterCard Onur Celebioglu / Dell EMC Bryan Betts / Freeform Dynamics AGENDA HPC coming into the mainstream

478 views • 14 slides
Understanding the Uncertainty in 1D Unidirectional Moving Target Selection Jin Huang , Feng Tian,

Understanding the Uncertainty in 1D Unidirectional Moving Target Selection Jin Huang , Feng Tian,

Understanding the Uncertainty in 1D Unidirectional Moving Target Selection Jin Huang , Feng Tian, Xiangmin Fan, Xiaolong(Luke) Zhang, Shumin Zhai CHI 2018 April 26 th , 2018 INTRODUCTION MOVING TARGETS EVERYWHERE Screenshot of StarCraft II

430 views • 39 slides
ARM Assembler Addressing Modes Addressing Modes p. 1/14 op1 : Data Addressing Mode

ARM Assembler Addressing Modes Addressing Modes p. 1/14 op1 : Data Addressing Mode

Systems Architecture ARM Assembler Addressing Modes Addressing Modes p. 1/14 op1 : Data Addressing Mode Used when processing data Moving data from one register to another: D ESTINATION S OURCE D ESTINATION must be a

444 views • 17 slides
MOVING TOWARD Addressing MEANINGFUL PUBLIC Rider 42 Requirements ENGAGEMENT Tim Lomax, TTI A

MOVING TOWARD Addressing MEANINGFUL PUBLIC Rider 42 Requirements ENGAGEMENT Tim Lomax, TTI A

MOVING TOWARD Addressing MEANINGFUL PUBLIC Rider 42 Requirements ENGAGEMENT Tim Lomax, TTI A Member of The Texas A&amp;M University System 1 PUBLIC ENGAGEMENT PROGRESSION Inform Consult Provide Involve information to Obtain assist

242 views • 11 slides
Runtime Considerations Were moving towards actually producing target code. This means we need

Runtime Considerations Were moving towards actually producing target code. This means we need

10/29/2012 Runtime Considerations Were moving towards actually producing target code. This means we need to consider the runtime actions of the program. CS 1622: Runtime support: Functions and local variable storage Activation

160 views • 4 slides
A moving target: Assessing the process and progress of learning Shane Sutherland, Yangama

A moving target: Assessing the process and progress of learning Shane Sutherland, Yangama

#THETA2015 A moving target: Assessing the process and progress of learning Shane Sutherland, Yangama Jokwiro, Kath Fisher, Terri Downer, Christine Slade, Richard Bostwick, Alison Poot This work is licensed under a

348 views • 33 slides
OF-RHM: Transparent Moving Target Defense using Software Defined Networking Haadi Jafarian, Qi

OF-RHM: Transparent Moving Target Defense using Software Defined Networking Haadi Jafarian, Qi

OF-RHM: Transparent Moving Target Defense using Software Defined Networking Haadi Jafarian, Qi Duan and Ehab Al-Shaer ACM SIGCOMM HotSDN Workshop August 2012 Helsinki, Finland CyberDNA lab, UNC Charlotte Why IP Mutation Static assignment

571 views • 28 slides
Introduction to: Moving Target Indicator Radar (DRAFT) Armin Doerry This presentation is an

Introduction to: Moving Target Indicator Radar (DRAFT) Armin Doerry This presentation is an

10/24/2017 Introduction to: Moving Target Indicator Radar (DRAFT) Armin Doerry This presentation is an informal communication intended for a limited audience comprised of attendees to the Institute for Computational and Experimental Research

807 views • 39 slides
Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik

Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik

Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik Sengupta, Ankur Chowdhary, Subbarao Kambhampati Dijiang Huang SNAC Secure Networking and Yochan AI Lab Computing Lab Intrusion Detection Systems?

681 views • 38 slides
MCMC for Cut Models or Chasing a Moving Target with MCMC Martyn Plummer International Agency

MCMC for Cut Models or Chasing a Moving Target with MCMC Martyn Plummer International Agency

MCMC for Cut Models or Chasing a Moving Target with MCMC Martyn Plummer International Agency for Research on Cancer MCMSki Chamonix, 6 Jan 2014 Cut models What do we want to do? 1. Generate some random variables under one model 2. Analyze

1.24k views • 24 slides
Application of the Lattice Boltzmann method with moving boundaries in a coarse-grained suspension

Application of the Lattice Boltzmann method with moving boundaries in a coarse-grained suspension

Basics Moving particles Coarse-grained blood model Application of the Lattice Boltzmann method with moving boundaries in a coarse-grained suspension model for hemodynamics Florian Janoschek Jens Harting Department of Applied Physics,

725 views • 27 slides
The Transmission Control Protocol (TCP) June 6, 1998 TCP 2 What are transmission protocols

The Transmission Control Protocol (TCP) June 6, 1998 TCP 2 What are transmission protocols

TCP 1 The Transmission Control Protocol (TCP) June 6, 1998 TCP 2 What are transmission protocols needed for? Addressing: application-to-application addressing Reliable delivery: the receiver application should receive the same data stream

624 views • 40 slides
CAFE: A Virtualization-Based Approach to Protecting Sensitive Cloud Application Logic

CAFE: A Virtualization-Based Approach to Protecting Sensitive Cloud Application Logic

CAFE: A Virtualization-Based Approach to Protecting Sensitive Cloud Application Logic Confidentiality Chung Hwan Kim Sungjin Park Junghwan Rhee Taisook Han Dongyan Xu Jong-jin Won Purdue University The Attached NEC Laboratories KAIST

305 views • 29 slides
Client / Server 2.0 with Java and Flex James Ward Adobe Systems www.jamesward.com @riacowboy

Client / Server 2.0 with Java and Flex James Ward Adobe Systems www.jamesward.com @riacowboy

Client / Server 2.0 with Java and Flex James Ward Adobe Systems www.jamesward.com @riacowboy About James Ward I want to be a cowboy Co-authored First Steps in Flex with Bruce Eckel Java Developer since 1997 Adobe's JCP Rep for JSR-286,

222 views • 11 slides
New Paradigm Related to Innovative Technologies at Czech Secondary Schools Ivo Martink

New Paradigm Related to Innovative Technologies at Czech Secondary Schools Ivo Martink

New Paradigm Related to Innovative Technologies at Czech Secondary Schools Ivo Martink VB-Technical University of Ostrava Faculty of Economics Czech Republic ivo.martinik@vsb.cz eLearning Forum Asia 2015 Motivation, Problem Area Problem

522 views • 34 slides
The Mobility Project Building network of web-servers for exchange of data on student mobility

The Mobility Project Building network of web-servers for exchange of data on student mobility

The Mobility Project Building network of web-servers for exchange of data on student mobility Janina Mincer-Daszkiewicz University of Warsaw jmd@mimuw.edu.pl EUNIS 2010, 2010-06-23 Agenda Real life scenarios (motivation) History and

396 views • 26 slides
Wt, The Witty Web Toolkit FOSDEM Lightning talk Koen Deforche Wim Dumon Pieter Libin

Wt, The Witty Web Toolkit FOSDEM Lightning talk Koen Deforche Wim Dumon Pieter Libin

Wt, The Witty Web Toolkit FOSDEM Lightning talk Koen Deforche Wim Dumon Pieter Libin http://witty.sf.net/ FOSDEM 2007 Wim Dumon Wt Basics Library to develop web applications Rich Internet Applications Web 2.0

350 views • 22 slides
Tutorial: setting up a web application 1. Introduction 2.

Tutorial: setting up a web application 1. Introduction 2.

Elective in Software and Services (Complementi di software e servizi per la societ dell'informazione) Section Information Visualization Number of credits : 3

469 views • 23 slides
CSCC09 Programming on the Web Thierry Sans Architecture of a Web Application Client Side

CSCC09 Programming on the Web Thierry Sans Architecture of a Web Application Client Side

CSCC09 Programming on the Web Thierry Sans Architecture of a Web Application Client Side Server Side Web Server Web Browser Web Technologies Content Resources Presentation management Client Side Processing Multimedia The evolution of

1.24k views • 23 slides
Creating Innovation in an Operational Testing Program: Next Generation NCLEX Ada Woo, PhD

Creating Innovation in an Operational Testing Program: Next Generation NCLEX Ada Woo, PhD

Creating Innovation in an Operational Testing Program: Next Generation NCLEX Ada Woo, PhD Director of Measurement and Testing NCSBN Overview Timeline Rationale for prototype development Classification framework for prototype items

714 views • 13 slides
F OUNDATIONAL E MPIRICAL C LAIM : Many forms of human suffering and many deficits in human

F OUNDATIONAL E MPIRICAL C LAIM : Many forms of human suffering and many deficits in human

E NVISIONING R EAL U TOPIAS Erik Olin Wright University of Wisconsin Madison May , 2012 F OUNDATIONAL E MPIRICAL C LAIM : Many forms of human suffering and many deficits in human flourishing are the result of existing institutions and

880 views • 47 slides

More recommend