The Repository Mahasiswa(RAMA)is a national repository of research reports in the form of final assignments,student projects,theses,dissertations,and research reports of lecturers or researchers that have not yet been...The Repository Mahasiswa(RAMA)is a national repository of research reports in the form of final assignments,student projects,theses,dissertations,and research reports of lecturers or researchers that have not yet been published in journals,conferences,or integrated books from the scientific repository of universities and research institutes in Indonesia.The increasing popularity of the RAMA Repository leads to security issues,including the two most widespread,vulnerable attacks i.e.,Structured Query Language(SQL)injection and cross-site scripting(XSS)attacks.An attacker gaining access to data and performing unauthorized data modifications is extremely dangerous.This paper aims to provide an attack detection system for securing the repository portal from the abovementioned attacks.The proposed system combines a Long Short–Term Memory and Principal Component Analysis(LSTM-PCA)model as a classifier.This model can effectively solve the vanishing gradient problem caused by excessive positive samples.The experiment results show that the proposed system achieves an accuracy of 96.85%using an 80%:20%ratio of training data and testing data.The rationale for this best achievement is that the LSTM’s Forget Gate works very well as the PCA supplies only selected features that are significantly relevant to the attacks’patterns.The Forget Gate in LSTM is responsible for deciding which information should be kept for computing the cell state and which one is not relevant and can be discarded.In addition,the LSTM’s Input Gate assists in finding out crucial information and stores specific relevant data in the memory.展开更多
XSS(Cross Site Scripting)攻击是目前最流行的WEB攻击方式之一,随着对XSS攻击的防护提升,XSS攻击的变种也逐渐增多,最终目的为绕过防护系统进行攻击。针对上述问题,制定新的过滤规则,并基于过滤规则建立XSS过滤模型,规则的制定是基于...XSS(Cross Site Scripting)攻击是目前最流行的WEB攻击方式之一,随着对XSS攻击的防护提升,XSS攻击的变种也逐渐增多,最终目的为绕过防护系统进行攻击。针对上述问题,制定新的过滤规则,并基于过滤规则建立XSS过滤模型,规则的制定是基于可控的XSS敏感字符库来实现的。反绕过的最终实现形式为XSS过滤模型的建立,将该过滤模型集成到WEB项目中,对可能出现漏检或绕过的字符进行收集并列入敏感字符库中,应对XSS绕过攻击。实验表明,该过滤模型能够有效地应对XSS绕过攻击,并降低系统安全维护难度,同时能够有效应对未知的XSS攻击。展开更多
跨站脚本XSS(Cross Site Scripting)漏洞已经成为了大多数网站共同面对的Web安全问题,对XSS漏洞的有效预防检测有利于提高Web安全。分析XSS漏洞的攻击原理,指出现有动态分析方法在检测存储型XSS漏洞方面的不足,提出一种有效的存储型漏...跨站脚本XSS(Cross Site Scripting)漏洞已经成为了大多数网站共同面对的Web安全问题,对XSS漏洞的有效预防检测有利于提高Web安全。分析XSS漏洞的攻击原理,指出现有动态分析方法在检测存储型XSS漏洞方面的不足,提出一种有效的存储型漏洞动态检测方法。设计并实现了Stored-XSS漏洞动态检测模型,并在实际的场景下对该模型进行了测试评估,实验证明提出的方法能对存储型XSS漏洞进行有效检测。展开更多
文摘The Repository Mahasiswa(RAMA)is a national repository of research reports in the form of final assignments,student projects,theses,dissertations,and research reports of lecturers or researchers that have not yet been published in journals,conferences,or integrated books from the scientific repository of universities and research institutes in Indonesia.The increasing popularity of the RAMA Repository leads to security issues,including the two most widespread,vulnerable attacks i.e.,Structured Query Language(SQL)injection and cross-site scripting(XSS)attacks.An attacker gaining access to data and performing unauthorized data modifications is extremely dangerous.This paper aims to provide an attack detection system for securing the repository portal from the abovementioned attacks.The proposed system combines a Long Short–Term Memory and Principal Component Analysis(LSTM-PCA)model as a classifier.This model can effectively solve the vanishing gradient problem caused by excessive positive samples.The experiment results show that the proposed system achieves an accuracy of 96.85%using an 80%:20%ratio of training data and testing data.The rationale for this best achievement is that the LSTM’s Forget Gate works very well as the PCA supplies only selected features that are significantly relevant to the attacks’patterns.The Forget Gate in LSTM is responsible for deciding which information should be kept for computing the cell state and which one is not relevant and can be discarded.In addition,the LSTM’s Input Gate assists in finding out crucial information and stores specific relevant data in the memory.
文摘XSS(Cross Site Scripting)攻击是目前最流行的WEB攻击方式之一,随着对XSS攻击的防护提升,XSS攻击的变种也逐渐增多,最终目的为绕过防护系统进行攻击。针对上述问题,制定新的过滤规则,并基于过滤规则建立XSS过滤模型,规则的制定是基于可控的XSS敏感字符库来实现的。反绕过的最终实现形式为XSS过滤模型的建立,将该过滤模型集成到WEB项目中,对可能出现漏检或绕过的字符进行收集并列入敏感字符库中,应对XSS绕过攻击。实验表明,该过滤模型能够有效地应对XSS绕过攻击,并降低系统安全维护难度,同时能够有效应对未知的XSS攻击。
文摘跨站脚本XSS(Cross Site Scripting)漏洞已经成为了大多数网站共同面对的Web安全问题,对XSS漏洞的有效预防检测有利于提高Web安全。分析XSS漏洞的攻击原理,指出现有动态分析方法在检测存储型XSS漏洞方面的不足,提出一种有效的存储型漏洞动态检测方法。设计并实现了Stored-XSS漏洞动态检测模型,并在实际的场景下对该模型进行了测试评估,实验证明提出的方法能对存储型XSS漏洞进行有效检测。
