protecting a moving target addressing web application
play

Protecting a Moving Target: Addressing Web Application Concept Drift - PowerPoint PPT Presentation

Feb 10, 2023 •289 likes •1.08k views

Protecting a Moving Target: Addressing Web Application Concept Drift The 12 th International Symposium on Recent Advances in Intrusion Detection 2009 Federico Maggi, William Robertson, Christopher Krgel, Giovanni Vigna Politecnico di Milano,

  1. Protecting a Moving Target: Addressing Web Application Concept Drift The 12 th International Symposium on Recent Advances in Intrusion Detection 2009 Federico Maggi, William Robertson, Christopher Krügel, Giovanni Vigna Politecnico di Milano, Univeristy of California Santa Barbara September 23, 2009

  2. Adapting to changes of the protected web application.

  3. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses)

  4. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32

  5. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val>

  6. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val>

  7. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val> ...

  8. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val> ... /<component1>/<par1>/<par1-val>/<par2>/<par2-val>

  9. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val> ... /<component1>/<par1>/<par1-val>/<par2>/<par2-val> /<component2>/<par1>/<par1-val>

  10. Web Application Anomaly Detection Learning benign HTTP interactions (i.e., requests and responses) /article/id/32 /comment/<par1>/<par1-val> /login/<par1>/<par1-val>/<par2>/<par2-val> ... /<component1>/<par1>/<par1-val>/<par2>/<par2-val> /<component2>/<par1>/<par1-val> Webserver Clients Millions of good HTTP messages

  11. Modeling benign HTTP interactions

  12. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Models of good messages /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  13. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M2 M3 Mn M1 /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Example of models /<component1>/<par1>/<par1-val> — parameter string length /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> — numeric range /<component1>/<par1>/<par1-val> — probabilistic grammar of strings /<component1>/<par1>/<par1-val> — string character distribution /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  14. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Models of good sessions /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> C7 C1 C3 /<component1>/<par1>/<par1-val> C2 /<component1>/<par1>/<par1-val> C1 C2 C3 C10 C7 /<component1>/<par1>/<par1-val> M1 M2 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  15. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> C1 C7 C1 C2 C3 /<component1>/<par1>/<par1-val> C2 C5 /<component1>/<par1>/<par1-val> C1 C3 C3 C10 C7 /<component1>/<par1>/<par1-val> M1 M2 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  16. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> C1 C7 C1 C2 C3 /<component1>/<par1>/<par1-val> C2 C5 /<component1>/<par1>/<par1-val> C1 C3 C3 C10 C7 /<component1>/<par1>/<par1-val> M1 M2 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  17. Modeling benign HTTP interactions Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Detection of bad messages /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> M1 M2 M3 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver

  18. Modeling benign HTTP interactions Client Client /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Detection of bad sessions /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> C1 C7 C1 C2 C3 /<component1>/<par1>/<par1-val> C2 C5 /<component1>/<par1>/<par1-val> C1 C3 C3 C10 C7 /<component1>/<par1>/<par1-val> M1 M2 Mn /<component1>/<par1>/<par1-val> /<component1>/<par1>/<par1-val> Webserver Webserver

  19. What if the modeled features change? Note that this is the common problem of anomaly detection, per sé

  20. What if the modeled features change? Note that this is the common problem of anomaly detection, per sé In practice, what if the protected website suddenly changes?

  21. What if the modeled features change? Note that this is the common problem of anomaly detection, per sé In practice, what if the protected website suddenly changes? ◮ site changes means changes in the good behavior,

Recommend

Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target

Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target

Cyber Moving Targets Yashar Dehkan Asl Introduction An overview of different cyber moving target techniques, their threat models, and their technical details. Cyber moving target technique: Defend a system Increase the complexity of cyber

442 views • 40 slides
Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber

Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber

Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber moving target technique refers to any technique that attempts to defend a system and increase the complexity of cyber attacks by making the system

728 views • 27 slides
Pwned: Protecting Yourself in the 2019 By Dallin Warne 1 Why are you a target? 99% Money

Pwned: Protecting Yourself in the 2019 By Dallin Warne 1 Why are you a target? 99% Money

Pwned: Protecting Yourself in the 2019 By Dallin Warne 1 Why are you a target? 99% Money 1% Everything else (revenge, activism, hate, espionage, etc) Why do they do it? Because it works. 3% 5% clicks on phishing links, down

581 views • 23 slides
Moving HPC into the Mainstream Addressing the challenges of Mainstream HPC WHOS ON THE PANEL

Moving HPC into the Mainstream Addressing the challenges of Mainstream HPC WHOS ON THE PANEL

Moving HPC into the Mainstream Addressing the challenges of Mainstream HPC WHOS ON THE PANEL Jon Collins / The Register Nick Curcuru / MasterCard Onur Celebioglu / Dell EMC Bryan Betts / Freeform Dynamics AGENDA HPC coming into the mainstream

478 views • 14 slides
Understanding the Uncertainty in 1D Unidirectional Moving Target Selection Jin Huang , Feng Tian,

Understanding the Uncertainty in 1D Unidirectional Moving Target Selection Jin Huang , Feng Tian,

Understanding the Uncertainty in 1D Unidirectional Moving Target Selection Jin Huang , Feng Tian, Xiangmin Fan, Xiaolong(Luke) Zhang, Shumin Zhai CHI 2018 April 26 th , 2018 INTRODUCTION MOVING TARGETS EVERYWHERE Screenshot of StarCraft II

430 views • 39 slides
ARM Assembler Addressing Modes Addressing Modes p. 1/14 op1 : Data Addressing Mode

ARM Assembler Addressing Modes Addressing Modes p. 1/14 op1 : Data Addressing Mode

Systems Architecture ARM Assembler Addressing Modes Addressing Modes p. 1/14 op1 : Data Addressing Mode Used when processing data Moving data from one register to another: D ESTINATION S OURCE D ESTINATION must be a

444 views • 17 slides
MOVING TOWARD Addressing MEANINGFUL PUBLIC Rider 42 Requirements ENGAGEMENT Tim Lomax, TTI A

MOVING TOWARD Addressing MEANINGFUL PUBLIC Rider 42 Requirements ENGAGEMENT Tim Lomax, TTI A

MOVING TOWARD Addressing MEANINGFUL PUBLIC Rider 42 Requirements ENGAGEMENT Tim Lomax, TTI A Member of The Texas A&amp;M University System 1 PUBLIC ENGAGEMENT PROGRESSION Inform Consult Provide Involve information to Obtain assist

242 views • 11 slides
Runtime Considerations Were moving towards actually producing target code. This means we need

Runtime Considerations Were moving towards actually producing target code. This means we need

10/29/2012 Runtime Considerations Were moving towards actually producing target code. This means we need to consider the runtime actions of the program. CS 1622: Runtime support: Functions and local variable storage Activation

160 views • 4 slides
A moving target: Assessing the process and progress of learning Shane Sutherland, Yangama

A moving target: Assessing the process and progress of learning Shane Sutherland, Yangama

#THETA2015 A moving target: Assessing the process and progress of learning Shane Sutherland, Yangama Jokwiro, Kath Fisher, Terri Downer, Christine Slade, Richard Bostwick, Alison Poot This work is licensed under a

348 views • 33 slides
OF-RHM: Transparent Moving Target Defense using Software Defined Networking Haadi Jafarian, Qi

OF-RHM: Transparent Moving Target Defense using Software Defined Networking Haadi Jafarian, Qi

OF-RHM: Transparent Moving Target Defense using Software Defined Networking Haadi Jafarian, Qi Duan and Ehab Al-Shaer ACM SIGCOMM HotSDN Workshop August 2012 Helsinki, Finland CyberDNA lab, UNC Charlotte Why IP Mutation Static assignment

571 views • 28 slides
Introduction to: Moving Target Indicator Radar (DRAFT) Armin Doerry This presentation is an

Introduction to: Moving Target Indicator Radar (DRAFT) Armin Doerry This presentation is an

10/24/2017 Introduction to: Moving Target Indicator Radar (DRAFT) Armin Doerry This presentation is an informal communication intended for a limited audience comprised of attendees to the Institute for Computational and Experimental Research

807 views • 39 slides
Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik

Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik

Moving Target Defense for the Placement of Intrusion Detection Systems in the Cloud Sailik Sengupta, Ankur Chowdhary, Subbarao Kambhampati Dijiang Huang SNAC Secure Networking and Yochan AI Lab Computing Lab Intrusion Detection Systems?

681 views • 38 slides
MCMC for Cut Models or Chasing a Moving Target with MCMC Martyn Plummer International Agency

MCMC for Cut Models or Chasing a Moving Target with MCMC Martyn Plummer International Agency

MCMC for Cut Models or Chasing a Moving Target with MCMC Martyn Plummer International Agency for Research on Cancer MCMSki Chamonix, 6 Jan 2014 Cut models What do we want to do? 1. Generate some random variables under one model 2. Analyze

1.24k views • 24 slides
Application of the Lattice Boltzmann method with moving boundaries in a coarse-grained suspension

Application of the Lattice Boltzmann method with moving boundaries in a coarse-grained suspension

Basics Moving particles Coarse-grained blood model Application of the Lattice Boltzmann method with moving boundaries in a coarse-grained suspension model for hemodynamics Florian Janoschek Jens Harting Department of Applied Physics,

725 views • 27 slides
The Transmission Control Protocol (TCP) June 6, 1998 TCP 2 What are transmission protocols

The Transmission Control Protocol (TCP) June 6, 1998 TCP 2 What are transmission protocols

TCP 1 The Transmission Control Protocol (TCP) June 6, 1998 TCP 2 What are transmission protocols needed for? Addressing: application-to-application addressing Reliable delivery: the receiver application should receive the same data stream

624 views • 40 slides
CAFE: A Virtualization-Based Approach to Protecting Sensitive Cloud Application Logic

CAFE: A Virtualization-Based Approach to Protecting Sensitive Cloud Application Logic

CAFE: A Virtualization-Based Approach to Protecting Sensitive Cloud Application Logic Confidentiality Chung Hwan Kim Sungjin Park Junghwan Rhee Taisook Han Dongyan Xu Jong-jin Won Purdue University The Attached NEC Laboratories KAIST

305 views • 29 slides
Protecting Divorced Womens Rights by the Application of Islamic Principle of Mataa : A Case

Protecting Divorced Womens Rights by the Application of Islamic Principle of Mataa : A Case

Protecting Divorced Womens Rights by the Application of Islamic Principle of Mataa : A Case Study of India, Pakistan and Bangladesh Ayesha Shahid Law School University of Hull Quranic verses 236, 240, 241 in Chapter II and verse

276 views • 15 slides
Network Layer Where we are in the Course Moving on up to the Network Layer! Application

Network Layer Where we are in the Course Moving on up to the Network Layer! Application

Network Layer Where we are in the Course Moving on up to the Network Layer! Application Transport Network Link Physical CSE 461 University of Washington 2 Topics Network service models Datagrams (packets), virtual circuits

840 views • 42 slides
Network Layer Where we are in the Course Moving on up to the Network Layer! Application

Network Layer Where we are in the Course Moving on up to the Network Layer! Application

Network Layer Where we are in the Course Moving on up to the Network Layer! Application Transport Network Link Physical CSE 461 University of Washington 2 Topics Network service models Datagrams (packets), virtual circuits

524 views • 28 slides
A 1 Moving-target Defense Strategy for Cloud-based Services with Heterogeneous and Dynamic Attack

A 1 Moving-target Defense Strategy for Cloud-based Services with Heterogeneous and Dynamic Attack

A 1 Moving-target Defense Strategy for Cloud-based Services with Heterogeneous and Dynamic Attack Surfaces Wei Peng 1 Feng Li 1 Chin-Tser Huang 2 Xukai Zou 1 1 Indiana University-Purdue University Indianapolis (IUPUI.edu) 2 University of South

857 views • 22 slides
chasing a moving target Stockholm, March 9, 2018 Ari Kokko Copenhagen Business School and

chasing a moving target Stockholm, March 9, 2018 Ari Kokko Copenhagen Business School and

Structural change and growth: chasing a moving target Stockholm, March 9, 2018 Ari Kokko Copenhagen Business School and School of Business, Economics, and Law, Gothenburg University Introduction Many fields of research have studied

536 views • 24 slides
Addressing in the TCP/IP model Layer 4 Address Resolution: Ports and more Transport Layer

Addressing in the TCP/IP model Layer 4 Address Resolution: Ports and more Transport Layer

IN2140: Introduction to Operating Systems and Data Communication Addressing in the TCP/IP model Layer 4 Address Resolution: Ports and more Transport Layer Function Transport layer tasks 5 5 Application Application Application 1.

140 views • 11 slides
Overview Introduction Background Target Application Vulnerability Scanners Test

Overview Introduction Background Target Application Vulnerability Scanners Test

niversiteit van Amsterdam System and Network Engineering E ffectiveness of A utomated A pplication P enetration T esting T ools A LEXANDRE F ERREIRA H ARALD K LEPPE Overview Introduction Background Target Application Vulnerability

335 views • 16 slides
Triple-S alternatives, possibilities, choices Steve Jenkins Dimensions of change Moving Target

Triple-S alternatives, possibilities, choices Steve Jenkins Dimensions of change Moving Target

Triple-S alternatives, possibilities, choices Steve Jenkins Dimensions of change Moving Target Scope Including exotic Many versions make elements can make life a standard non- difficult for some (all) standard Features or Delivery

635 views • 17 slides

More recommend