Usability of Software Intrusion-Detection System in Web Applications

Part of the Advances in Intelligent Systems and Computing book series (AISC, volume 189)

Abstract

This article is focused on the security solution based on intrusion detection idea, which should be independent of the web server type or configuration and do not rely on the other network hardware components. Discussed intrusion detection system solution is connected directly with the web application and is based on the real-time request analysis. The main opportunities of proposed principle are very low cost and simple implementation. Proposal is based on implementation of LGPL library PHPIDS [https://phpids.org/] into the demo application which consists of simple web form for testing. Integration of PHPIDS library was tested against the main web security flaws - SQL Injection, Cross Site Scripting, and HTTP Parameter Pollution. On this demo application, simple stress tests were performed and also level of security was evaluated. Moreover, suggestions for future improvements of this security solution are discussed.

Keywords

Security Web Application Web Attack Intrusion-Detection IDS PHPIDS SQL Injection CSS HPP 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Endorf, C., Schulz, E., Mellander, J.: Intrusion detection & prevention. McGraw-Hill Professional, Emeryville (2004) ISBN 0072229543 Google Scholar
  2. 2.
    Northcutt, S., Novak, J.: Network Intrusion Detection: An Analyst’s Handbook. New Riders Publishing, Thousand Oaks (2002)Google Scholar
  3. 3.
    Brumley, D., Newsome, J., Song, D., et al.: Towards automatic generation of vulnerability-based signatures. In: Proceedings of the IEEE Symposium on Security and Privacy, SP 2006, Washington, DC, USA, pp. 2–16 (2006)Google Scholar
  4. 4.
    Leung, K., Leckie, C.: Unsupervised anomaly detection in network intrusion detection using clusters. In: Proceedings of the 28th Australasian Conference on Computer Science, ACSC 2005, Darlinghurst, Australia, pp. 333–342 (2005)Google Scholar
  5. 5.
    Stewart, J.M., Tittel, E., Chapple, M.: CISSP: Certified Information Systems Security Professional Study Guide. Wiley Publishing, Indiana (2011)Google Scholar
  6. 6.
    PHPIDS project homepage, https://phpids.org/
  7. 7.

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  1. 1.Faculty of Applied InformaticsTomas Bata University in ZlinZlínCzech Republic

Personalised recommendations