Dynamic Monitoring of Website Content and Alerting Defacement Using Trusted Platform Module

Abstract

Web site defacement is one of the most common attacks on the Internet, the most vulnerable being those of critical government organizations such as banking and finance, oil and gas, and emergency services. In this context, website defacement is the malicious act of modifying its contents with offending data aimed at making the intrusion evident to a visitor. The defacement of an organization’s website misleads users with wrong information and can cause potential damage until the unauthorized change is noticed by the Web administrator. A wide variety of motives may exist for hackers to hack a Web server and modify the hosted website contents but it is probably safe to assume that in all cases the content provider would not prefer to present tampered content to the browsing world. Although implementation of security management policies and usage of Web security tools can avoid this kind of embarrassment, the complexity in current systems often exposes that loopholes exist. A good information protection policy addresses protection, detection of security breach, and immediate reaction to such cyberattack. This paper proposes a software system that utilizes operating systems’ kernel feature for file system monitoring to detect changes (add, delete, modify) and the system is combined with a secure hardware component called the trusted platform module (TPM) for authenticating modifications to dynamic and active website contents. The initial testing result shows that our system is effective in detecting changes and is able to classify file modification operations performed by the Web administrator and hacker without a false-positive error quotient.