IEICE TRANSACTIONS on Communications
Design of Provider-Provisioned Website Protection Scheme against Malware Distribution
Summary :
Vulnerabilities in web applications expose computer networks to security threats, and many websites are used by attackers as hopping sites to attack other websites and user terminals. These incidents prevent service providers from constructing secure networking environments. To protect websites from attacks exploiting vulnerabilities in web applications, service providers use web application firewalls (WAFs). WAFs filter accesses from attackers by using signatures, which are generated based on the exploit codes of previous attacks. However, WAFs cannot filter unknown attacks because the signatures cannot reflect new types of attacks. In service provider environments, the number of exploit codes has recently increased rapidly because of the spread of vulnerable web applications that have been developed through cloud computing. Thus, generating signatures for all exploit codes is difficult. To solve these problems, our proposed scheme detects and filters malware downloads that are sent from websites which have already received exploit codes. In addition, to collect information for detecting malware downloads, web honeypots, which automatically extract the communication records of exploit codes, are used. According to the results of experiments using a prototype, our scheme can filter attacks automatically so that service providers can provide secure and cost-effective network environments.
- Publication
- IEICE TRANSACTIONS on Communications Vol.E93-B No.5 pp.1122-1130
- Publication Date
- 2010/05/01
- Publicized
- Online ISSN
- 1745-1345
- DOI
- 10.1587/transcom.E93.B.1122
- Type of Manuscript
- Special Section PAPER (Special Section on Technology and Architecture for Sustainable Growth of the Internet)
- Category
Authors
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Takeshi YAGI, Naoto TANIMOTO, Takeo HARIU, Mitsutaka ITOH, "Design of Provider-Provisioned Website Protection Scheme against Malware Distribution" in IEICE TRANSACTIONS on Communications,
vol. E93-B, no. 5, pp. 1122-1130, May 2010, doi: 10.1587/transcom.E93.B.1122.
Abstract: Vulnerabilities in web applications expose computer networks to security threats, and many websites are used by attackers as hopping sites to attack other websites and user terminals. These incidents prevent service providers from constructing secure networking environments. To protect websites from attacks exploiting vulnerabilities in web applications, service providers use web application firewalls (WAFs). WAFs filter accesses from attackers by using signatures, which are generated based on the exploit codes of previous attacks. However, WAFs cannot filter unknown attacks because the signatures cannot reflect new types of attacks. In service provider environments, the number of exploit codes has recently increased rapidly because of the spread of vulnerable web applications that have been developed through cloud computing. Thus, generating signatures for all exploit codes is difficult. To solve these problems, our proposed scheme detects and filters malware downloads that are sent from websites which have already received exploit codes. In addition, to collect information for detecting malware downloads, web honeypots, which automatically extract the communication records of exploit codes, are used. According to the results of experiments using a prototype, our scheme can filter attacks automatically so that service providers can provide secure and cost-effective network environments.
URL: https://global.ieice.org/en_transactions/communications/10.1587/transcom.E93.B.1122/_p
Copy
@ARTICLE{e93-b_5_1122,
author={Takeshi YAGI, Naoto TANIMOTO, Takeo HARIU, Mitsutaka ITOH, },
journal={IEICE TRANSACTIONS on Communications},
title={Design of Provider-Provisioned Website Protection Scheme against Malware Distribution},
year={2010},
volume={E93-B},
number={5},
pages={1122-1130},
abstract={Vulnerabilities in web applications expose computer networks to security threats, and many websites are used by attackers as hopping sites to attack other websites and user terminals. These incidents prevent service providers from constructing secure networking environments. To protect websites from attacks exploiting vulnerabilities in web applications, service providers use web application firewalls (WAFs). WAFs filter accesses from attackers by using signatures, which are generated based on the exploit codes of previous attacks. However, WAFs cannot filter unknown attacks because the signatures cannot reflect new types of attacks. In service provider environments, the number of exploit codes has recently increased rapidly because of the spread of vulnerable web applications that have been developed through cloud computing. Thus, generating signatures for all exploit codes is difficult. To solve these problems, our proposed scheme detects and filters malware downloads that are sent from websites which have already received exploit codes. In addition, to collect information for detecting malware downloads, web honeypots, which automatically extract the communication records of exploit codes, are used. According to the results of experiments using a prototype, our scheme can filter attacks automatically so that service providers can provide secure and cost-effective network environments.},
keywords={},
doi={10.1587/transcom.E93.B.1122},
ISSN={1745-1345},
month={May},}
Copy
TY - JOUR
TI - Design of Provider-Provisioned Website Protection Scheme against Malware Distribution
T2 - IEICE TRANSACTIONS on Communications
SP - 1122
EP - 1130
AU - Takeshi YAGI
AU - Naoto TANIMOTO
AU - Takeo HARIU
AU - Mitsutaka ITOH
PY - 2010
DO - 10.1587/transcom.E93.B.1122
JO - IEICE TRANSACTIONS on Communications
SN - 1745-1345
VL - E93-B
IS - 5
JA - IEICE TRANSACTIONS on Communications
Y1 - May 2010
AB - Vulnerabilities in web applications expose computer networks to security threats, and many websites are used by attackers as hopping sites to attack other websites and user terminals. These incidents prevent service providers from constructing secure networking environments. To protect websites from attacks exploiting vulnerabilities in web applications, service providers use web application firewalls (WAFs). WAFs filter accesses from attackers by using signatures, which are generated based on the exploit codes of previous attacks. However, WAFs cannot filter unknown attacks because the signatures cannot reflect new types of attacks. In service provider environments, the number of exploit codes has recently increased rapidly because of the spread of vulnerable web applications that have been developed through cloud computing. Thus, generating signatures for all exploit codes is difficult. To solve these problems, our proposed scheme detects and filters malware downloads that are sent from websites which have already received exploit codes. In addition, to collect information for detecting malware downloads, web honeypots, which automatically extract the communication records of exploit codes, are used. According to the results of experiments using a prototype, our scheme can filter attacks automatically so that service providers can provide secure and cost-effective network environments.
ER -
English
