Machine Learning based Models for Detecting HTTP Input Validation Vulnerabilities of Web Applications

Abstract

Every organization is offering their services through online web applications in recent days. Accessing the online services could be the most malevolent, as the browsers themselves can adapt in the form of attacking equipment. The problems caused by web applications attacks like SQL injection (SQLi) and Cross Site Scripting (XSS) stem from their notorious ability to blend in to the noise associated with web application traffic. Most of the web application vulnerabilities are happened due to lack of input validations. The conventional approach of dealing with the impact of web applications vulnerabilities like SQLi and XSS is the verification of code by syntax analyzers. Here, the other important confine of these syntax analyzers is dependency of programming language. This thesis explored the models based on machine learning to augment traditional methods of identifying and preventing web based attacks of input parameter vulnerabilities. newline newlineAt first a model for detecting and preventing input validation vulnerabilities such as SQL Injection and XSS attacks in web applications using a Rule Based Pattern Discovery (RPAD) is developed. The proposed algorithm deals to discover the divergent patterns of these features and their correlation with the labels called malevolent and benevolent . The proposed RPAD discovers the patterns from features for malevolent as well as benevolent records. Then a set of rules are framed. Each of these rules shall indicate the pattern is either malevolent or benevolent. These rules are stored as knowledge for the further process. Further, it extracts the test patterns of features from input parameters and their values for test records. Then, it labels a given input record as either malevolent or benevolent based on the test patterns. This model is efficiently worked on categorical web data. Our contribution on RPAD is compared to an existing model IPAAS. The detection accuracy for the SQL injection and XSS vulnerabilities are substantial when compared to IPAAS. The evaluation consider