Detecting Malicious Inputs of Web Application Parameters Using Character Class Sequences

Web attacks that exploit vulnerabilities of web applications are still major problems. The number of attacks that maliciously manipulate parameters of web applications such as SQL injections and command injections is increasing nowadays. Anomaly detection is effective for detecting these attacks, particularly in the case of unknown attacks. However, existing anomaly detection methods often raise false alarms with normal requests whose parameters differ slightly from those of learning data because they perform strict feature matching between characters appeared as parameter values and those of normal profiles. We propose a novel anomaly detection method using the abstract structure of parameter values as features of normal profiles in this paper. The results of experiments show that our approach reduced the false positive rate more than existing methods with a comparable detection rate.

I. Introduction

Web applications are used for a large number of services and they support social infrastructures. However, new vulnerabilities are being discovered and new attacks exploiting these vulnerabilities are launched every year. Table I lists the number of new vulnerabilities found annually in web applications. The vulnerability information is gathered from Common Vulnerabilities and Exposures (CVE)¹

https://cve.mitre.org

. Around five thousands of new vulnerabilities are discovered each year and around 30% of them relate to web applications. In particular, attacks that insert malicious payload to web applications parameters such as Structured Query Language (SQL) injections, command injections and remote code executions result in data leakages or website defacement. In fact, a vulnerability in which remote codes can be executed by sending malformed values to a parameter is found in web applications using Apache Struts²

http://struts.apache.org/docs/s2-016.html

and a massive number of scans targeting this vulnerability were observed in our web systems. Table I: The number of new vulnerabilities found annually

Year	# of total	Web realted	Web related (%)
2008	5,104	1,207	23.6%
2009	5,297	1,437	27.1%
2010	4,639	1,160	25.0%
2011	4,150	1,104	26.6%
2012	5,289	1,582	29.9%
2013	5,186	1,505	29.0%