The Experts below are selected from a list of 246 Experts worldwide ranked by ideXlab platform
Hwankuk Kim - One of the best experts on this subject based on the ideXlab platform.
-
Obfuscated Malicious Script Response Technique Deployed at Host Level
Journal of Telecommunication Electronic and Computer Engineering, 2017Co-Authors: Jonghun Jung, Hwankuk KimAbstract:JavaScript functions have been remarkably enhanced thanks to the emergence of the next generation web standard HTML5 presented by W3C. HTML5 provides powerful functions that could replace non-standard technologies such as Active X by providing functions such as media play, 3-D graphic processing and Web socket communications using JavaScript only without the installation of separate plugins. Along with these trends in the ICT environment, many studies have been done related to threats exploiting JavaScript, which comprises a core of HTML5 functions. There are, however, many limitations in detecting obfuscated Malicious Scripts since most detection techniques use signature-based pattern matching. This paper will propose a method capable of detecting obfuscated Malicious Scripts at the host level and preventing the Scripts’ execution.
-
CSA/CUTE - Behavior-Based Detection for Malicious Script-Based Attack
Advances in Computer Science and Ubiquitous Computing, 2016Co-Authors: Soojin Yoon, Hanchul Bae, Hyun Lock Choo, Hwankuk KimAbstract:Several DoS attacks have occurred through web browsers, not from Malicious executable files. Most tools used in web attacks are downloaded malware. As the dynamic functions of HTML5 can be performed on a web browser, however, the latter can be abused as an attack tool. The features of web browser-based attacks are different from those of previous attacks, so a different detection method is needed for Malicious behavior on web browsers. This paper introduces Script-based attacks made through web browsers, and proposes a detection method based on a web browser’s behavior.
-
CSA/CUTE - Code Modification and Obfuscation Detection Test Using Malicious Script Distributing Website Inspection Technology
Advances in Computer Science and Ubiquitous Computing, 2016Co-Authors: Seongmin Park, Hanchul Bae, Youngtae Cha, Hwankuk KimAbstract:The use of non-standard plug-ins has been unavoidable in existing HTML. Accordingly, the rising dependence of web content on plug-ins increased and need for additional development suited to platform incurred considerable developmental expenses and time. HTML5 was a suggested solution to this problem, but could cause new security threats through newly added technologies, meaning that web-related elements such as websites, web content, devices and others are exposed to a new type of threat. In this thesis, we suggest a technology to detect website security threats in advance that includes HTML5.
-
real time Malicious Script blocking technology at the host level
Broadband and Wireless Computing Communication and Applications, 2016Co-Authors: Hanchul Bae, Seongmin Park, Hwankuk KimAbstract:Due to the diversity of mobile devices, interests have been increased towards HTML5, the next generation’s web standard which pursues cross platform. To play media files or process 3D graphics in previous HTML environments, users had to install non-standard plug-ins such as Silverlight or Active X. On the other hand, HTML5 provides new tag functions of audio, video etc and new java Script functions of Websocket, Geolocation API etc to substitute non-standard technologies such as Active X. To use such functions of HTML5, web browser developers are competitively applying HTML5 to their browsers, making the active conversion to HTML5 a global trend of today. Along with such trend, however, the risk of new cyber attacks taking advantage of java Scripts, the key function of HTML5, is also increasing. Cyber attacks based on Scripts can trigger vicious actions when the user just accesses web pages inserted with vicious Scripts, and thus there are limits in detection using previous security technologies. This paper proposes a technology which collects and analyzes HTTP traffic generated through web browsers at host level to detect and block vicious Scripts.
-
BWCCA - Real-Time Malicious Script Blocking Technology at the Host-Level
Advances on Broad-Band Wireless Computing Communication and Applications, 2016Co-Authors: Hanchul Bae, Seongmin Park, Hwankuk KimAbstract:Due to the diversity of mobile devices, interests have been increased towards HTML5, the next generation’s web standard which pursues cross platform. To play media files or process 3D graphics in previous HTML environments, users had to install non-standard plug-ins such as Silverlight or Active X. On the other hand, HTML5 provides new tag functions of audio, video etc and new java Script functions of Websocket, Geolocation API etc to substitute non-standard technologies such as Active X. To use such functions of HTML5, web browser developers are competitively applying HTML5 to their browsers, making the active conversion to HTML5 a global trend of today. Along with such trend, however, the risk of new cyber attacks taking advantage of java Scripts, the key function of HTML5, is also increasing. Cyber attacks based on Scripts can trigger vicious actions when the user just accesses web pages inserted with vicious Scripts, and thus there are limits in detection using previous security technologies. This paper proposes a technology which collects and analyzes HTTP traffic generated through web browsers at host level to detect and block vicious Scripts.
Giovanni Vigna - One of the best experts on this subject based on the ideXlab platform.
-
prophiler a fast filter for the large scale detection of Malicious web pages
The Web Conference, 2011Co-Authors: Davide Canali, Giovanni Vigna, Marco Cova, Christopher KruegelAbstract:Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and, subsequently, for creating large-scale botnets. In a drive-by-download exploit, an attacker embeds a Malicious Script (typically written in JavaScript) into a web page. When a victim visits this page, the Script is executed and attempts to compromise the browser or one of its plugins. To detect drive-by-download exploits, researchers have developed a number of systems that analyze web pages for the presence of Malicious code. Most of these systems use dynamic analysis. That is, they run the Scripts associated with a web page either directly in a real browser (running in a virtualized environment) or in an emulated browser, and they monitor the Scripts' executions for Malicious activity. While the tools are quite precise, the analysis process is costly, often requiring in the order of tens of seconds for a single page. Therefore, performing this analysis on a large set of web pages containing hundreds of millions of samples can be prohibitive. One approach to reduce the resources required for performing large-scale analysis of Malicious web pages is to develop a fast and reliable filter that can quickly discard pages that are benign, forwarding to the costly analysis tools only the pages that are likely to contain Malicious code. In this paper, we describe the design and implementation of such a filter. Our filter, called Prophiler, uses static analysis techniques to quickly examine a web page for Malicious content. This analysis takes into account features derived from the HTML contents of a page, from the associated JavaScript code, and from the corresponding URL. We automatically derive detection models that use these features using machine-learning techniques applied to labeled datasets. To demonstrate the effectiveness and efficiency of Prophiler, we crawled and collected millions of pages, which we analyzed for Malicious behavior. Our results show that our filter is able to reduce the load on a more costly dynamic analysis tools by more than 85%, with a negligible amount of missed Malicious pages.
-
WWW - Prophiler: a fast filter for the large-scale detection of Malicious web pages
Proceedings of the 20th international conference on World wide web - WWW '11, 2011Co-Authors: Davide Canali, Giovanni Vigna, Marco Cova, Christopher KruegelAbstract:Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and, subsequently, for creating large-scale botnets. In a drive-by-download exploit, an attacker embeds a Malicious Script (typically written in JavaScript) into a web page. When a victim visits this page, the Script is executed and attempts to compromise the browser or one of its plugins. To detect drive-by-download exploits, researchers have developed a number of systems that analyze web pages for the presence of Malicious code. Most of these systems use dynamic analysis. That is, they run the Scripts associated with a web page either directly in a real browser (running in a virtualized environment) or in an emulated browser, and they monitor the Scripts' executions for Malicious activity. While the tools are quite precise, the analysis process is costly, often requiring in the order of tens of seconds for a single page. Therefore, performing this analysis on a large set of web pages containing hundreds of millions of samples can be prohibitive. One approach to reduce the resources required for performing large-scale analysis of Malicious web pages is to develop a fast and reliable filter that can quickly discard pages that are benign, forwarding to the costly analysis tools only the pages that are likely to contain Malicious code. In this paper, we describe the design and implementation of such a filter. Our filter, called Prophiler, uses static analysis techniques to quickly examine a web page for Malicious content. This analysis takes into account features derived from the HTML contents of a page, from the associated JavaScript code, and from the corresponding URL. We automatically derive detection models that use these features using machine-learning techniques applied to labeled datasets. To demonstrate the effectiveness and efficiency of Prophiler, we crawled and collected millions of pages, which we analyzed for Malicious behavior. Our results show that our filter is able to reduce the load on a more costly dynamic analysis tools by more than 85%, with a negligible amount of missed Malicious pages.
-
Client-side cross-site Scripting protection
Computers & Security, 2009Co-Authors: Engin Kirda, Christopher Kruegel, Nenad Jovanović, Giovanni VignaAbstract:Web applications are becoming the dominant way to provide access to online services. At the same time, web application vulnerabilities are being discovered and disclosed at an alarming rate. Web applications often make use of JavaScript code that is embedded into web pages to support dynamic client-side behavior. This Script code is executed in the context of the user's web browser. To protect the user's environment from Malicious JavaScript code, browsers use a sand-boxing mechanism that limits a Script to access only resources associated with its origin site. Unfortunately, these security mechanisms fail if a user can be lured into downloading Malicious JavaScript code from an intermediate, trusted site. In this case, the Malicious Script is granted full access to all resources (e.g., authentication tokens and cookies) that belong to the trusted site. Such attacks are called cross-site Scripting (XSS) attacks. In general, XSS attacks are easy to execute, but difficult to detect and prevent. One reason is the high flexibility of HTML encoding schemes, offering the attacker many possibilities for circumventing server-side input filters that should prevent Malicious Scripts from being injected into trusted sites. Also, devising a client-side solution is not easy because of the difficulty of identifying JavaScript code as being Malicious. This paper presents Noxes, which is, to the best of our knowledge, the first client-side solution to mitigate cross-site Scripting attacks. Noxes acts as a web proxy and uses both manual and automatically generated rules to mitigate possible cross-site Scripting attempts. Noxes effectively protects against information leakage from the user's environment while requiring minimal user interaction and customization effort.
-
SAC - Noxes: a client-side solution for mitigating cross-site Scripting attacks
Proceedings of the 2006 ACM symposium on Applied computing - SAC '06, 2006Co-Authors: Engin Kirda, Christopher Kruegel, Giovanni Vigna, Nenad JovanovićAbstract:Web applications are becoming the dominant way to provide access to on-line services. At the same time, web application vulnerabilities are being discovered and disclosed at an alarming rate. Web applications often make use of JavaScript code that is embedded into web pages to support dynamic client-side behavior. This Script code is executed in the context of the user's web browser. To protect the user's environment from Malicious JavaScript code, a sand-boxing mechanism is used that limits a program to access only resources associated with its origin site. Unfortunately, these security mechanisms fail if a user can be lured into downloading Malicious JavaScript code from an intermediate, trusted site. In this case, the Malicious Script is granted full access to all resources (e.g., authentication tokens and cookies) that belong to the trusted site. Such attacks are called cross-site Scripting (XSS) attacks.In general, XSS attacks are easy to execute, but difficult to detect and prevent. One reason is the high flexibility of HTML encoding schemes, offering the attacker many possibilities for circumventing server-side input filters that should prevent Malicious Scripts from being injected into trusted sites. Also, devising a client-side solution is not easy because of the difficulty of identifying JavaScript code as being Malicious. This paper presents Noxes, which is, to the best of our knowledge, the first client-side solution to mitigate cross-site Scripting attacks. Noxes acts as a web proxy and uses both manual and automatically generated rules to mitigate possible cross-site Scripting attempts. Noxes effectively protects against information leakage from the user's environment while requiring minimal user interaction and customization effort.
Christopher Kruegel - One of the best experts on this subject based on the ideXlab platform.
-
prophiler a fast filter for the large scale detection of Malicious web pages
The Web Conference, 2011Co-Authors: Davide Canali, Giovanni Vigna, Marco Cova, Christopher KruegelAbstract:Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and, subsequently, for creating large-scale botnets. In a drive-by-download exploit, an attacker embeds a Malicious Script (typically written in JavaScript) into a web page. When a victim visits this page, the Script is executed and attempts to compromise the browser or one of its plugins. To detect drive-by-download exploits, researchers have developed a number of systems that analyze web pages for the presence of Malicious code. Most of these systems use dynamic analysis. That is, they run the Scripts associated with a web page either directly in a real browser (running in a virtualized environment) or in an emulated browser, and they monitor the Scripts' executions for Malicious activity. While the tools are quite precise, the analysis process is costly, often requiring in the order of tens of seconds for a single page. Therefore, performing this analysis on a large set of web pages containing hundreds of millions of samples can be prohibitive. One approach to reduce the resources required for performing large-scale analysis of Malicious web pages is to develop a fast and reliable filter that can quickly discard pages that are benign, forwarding to the costly analysis tools only the pages that are likely to contain Malicious code. In this paper, we describe the design and implementation of such a filter. Our filter, called Prophiler, uses static analysis techniques to quickly examine a web page for Malicious content. This analysis takes into account features derived from the HTML contents of a page, from the associated JavaScript code, and from the corresponding URL. We automatically derive detection models that use these features using machine-learning techniques applied to labeled datasets. To demonstrate the effectiveness and efficiency of Prophiler, we crawled and collected millions of pages, which we analyzed for Malicious behavior. Our results show that our filter is able to reduce the load on a more costly dynamic analysis tools by more than 85%, with a negligible amount of missed Malicious pages.
-
WWW - Prophiler: a fast filter for the large-scale detection of Malicious web pages
Proceedings of the 20th international conference on World wide web - WWW '11, 2011Co-Authors: Davide Canali, Giovanni Vigna, Marco Cova, Christopher KruegelAbstract:Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and, subsequently, for creating large-scale botnets. In a drive-by-download exploit, an attacker embeds a Malicious Script (typically written in JavaScript) into a web page. When a victim visits this page, the Script is executed and attempts to compromise the browser or one of its plugins. To detect drive-by-download exploits, researchers have developed a number of systems that analyze web pages for the presence of Malicious code. Most of these systems use dynamic analysis. That is, they run the Scripts associated with a web page either directly in a real browser (running in a virtualized environment) or in an emulated browser, and they monitor the Scripts' executions for Malicious activity. While the tools are quite precise, the analysis process is costly, often requiring in the order of tens of seconds for a single page. Therefore, performing this analysis on a large set of web pages containing hundreds of millions of samples can be prohibitive. One approach to reduce the resources required for performing large-scale analysis of Malicious web pages is to develop a fast and reliable filter that can quickly discard pages that are benign, forwarding to the costly analysis tools only the pages that are likely to contain Malicious code. In this paper, we describe the design and implementation of such a filter. Our filter, called Prophiler, uses static analysis techniques to quickly examine a web page for Malicious content. This analysis takes into account features derived from the HTML contents of a page, from the associated JavaScript code, and from the corresponding URL. We automatically derive detection models that use these features using machine-learning techniques applied to labeled datasets. To demonstrate the effectiveness and efficiency of Prophiler, we crawled and collected millions of pages, which we analyzed for Malicious behavior. Our results show that our filter is able to reduce the load on a more costly dynamic analysis tools by more than 85%, with a negligible amount of missed Malicious pages.
-
Client-side cross-site Scripting protection
Computers & Security, 2009Co-Authors: Engin Kirda, Christopher Kruegel, Nenad Jovanović, Giovanni VignaAbstract:Web applications are becoming the dominant way to provide access to online services. At the same time, web application vulnerabilities are being discovered and disclosed at an alarming rate. Web applications often make use of JavaScript code that is embedded into web pages to support dynamic client-side behavior. This Script code is executed in the context of the user's web browser. To protect the user's environment from Malicious JavaScript code, browsers use a sand-boxing mechanism that limits a Script to access only resources associated with its origin site. Unfortunately, these security mechanisms fail if a user can be lured into downloading Malicious JavaScript code from an intermediate, trusted site. In this case, the Malicious Script is granted full access to all resources (e.g., authentication tokens and cookies) that belong to the trusted site. Such attacks are called cross-site Scripting (XSS) attacks. In general, XSS attacks are easy to execute, but difficult to detect and prevent. One reason is the high flexibility of HTML encoding schemes, offering the attacker many possibilities for circumventing server-side input filters that should prevent Malicious Scripts from being injected into trusted sites. Also, devising a client-side solution is not easy because of the difficulty of identifying JavaScript code as being Malicious. This paper presents Noxes, which is, to the best of our knowledge, the first client-side solution to mitigate cross-site Scripting attacks. Noxes acts as a web proxy and uses both manual and automatically generated rules to mitigate possible cross-site Scripting attempts. Noxes effectively protects against information leakage from the user's environment while requiring minimal user interaction and customization effort.
-
SAC - Noxes: a client-side solution for mitigating cross-site Scripting attacks
Proceedings of the 2006 ACM symposium on Applied computing - SAC '06, 2006Co-Authors: Engin Kirda, Christopher Kruegel, Giovanni Vigna, Nenad JovanovićAbstract:Web applications are becoming the dominant way to provide access to on-line services. At the same time, web application vulnerabilities are being discovered and disclosed at an alarming rate. Web applications often make use of JavaScript code that is embedded into web pages to support dynamic client-side behavior. This Script code is executed in the context of the user's web browser. To protect the user's environment from Malicious JavaScript code, a sand-boxing mechanism is used that limits a program to access only resources associated with its origin site. Unfortunately, these security mechanisms fail if a user can be lured into downloading Malicious JavaScript code from an intermediate, trusted site. In this case, the Malicious Script is granted full access to all resources (e.g., authentication tokens and cookies) that belong to the trusted site. Such attacks are called cross-site Scripting (XSS) attacks.In general, XSS attacks are easy to execute, but difficult to detect and prevent. One reason is the high flexibility of HTML encoding schemes, offering the attacker many possibilities for circumventing server-side input filters that should prevent Malicious Scripts from being injected into trusted sites. Also, devising a client-side solution is not easy because of the difficulty of identifying JavaScript code as being Malicious. This paper presents Noxes, which is, to the best of our knowledge, the first client-side solution to mitigate cross-site Scripting attacks. Noxes acts as a web proxy and uses both manual and automatically generated rules to mitigate possible cross-site Scripting attempts. Noxes effectively protects against information leakage from the user's environment while requiring minimal user interaction and customization effort.
Hanchul Bae - One of the best experts on this subject based on the ideXlab platform.
-
CSA/CUTE - Behavior-Based Detection for Malicious Script-Based Attack
Advances in Computer Science and Ubiquitous Computing, 2016Co-Authors: Soojin Yoon, Hanchul Bae, Hyun Lock Choo, Hwankuk KimAbstract:Several DoS attacks have occurred through web browsers, not from Malicious executable files. Most tools used in web attacks are downloaded malware. As the dynamic functions of HTML5 can be performed on a web browser, however, the latter can be abused as an attack tool. The features of web browser-based attacks are different from those of previous attacks, so a different detection method is needed for Malicious behavior on web browsers. This paper introduces Script-based attacks made through web browsers, and proposes a detection method based on a web browser’s behavior.
-
CSA/CUTE - Code Modification and Obfuscation Detection Test Using Malicious Script Distributing Website Inspection Technology
Advances in Computer Science and Ubiquitous Computing, 2016Co-Authors: Seongmin Park, Hanchul Bae, Youngtae Cha, Hwankuk KimAbstract:The use of non-standard plug-ins has been unavoidable in existing HTML. Accordingly, the rising dependence of web content on plug-ins increased and need for additional development suited to platform incurred considerable developmental expenses and time. HTML5 was a suggested solution to this problem, but could cause new security threats through newly added technologies, meaning that web-related elements such as websites, web content, devices and others are exposed to a new type of threat. In this thesis, we suggest a technology to detect website security threats in advance that includes HTML5.
-
real time Malicious Script blocking technology at the host level
Broadband and Wireless Computing Communication and Applications, 2016Co-Authors: Hanchul Bae, Seongmin Park, Hwankuk KimAbstract:Due to the diversity of mobile devices, interests have been increased towards HTML5, the next generation’s web standard which pursues cross platform. To play media files or process 3D graphics in previous HTML environments, users had to install non-standard plug-ins such as Silverlight or Active X. On the other hand, HTML5 provides new tag functions of audio, video etc and new java Script functions of Websocket, Geolocation API etc to substitute non-standard technologies such as Active X. To use such functions of HTML5, web browser developers are competitively applying HTML5 to their browsers, making the active conversion to HTML5 a global trend of today. Along with such trend, however, the risk of new cyber attacks taking advantage of java Scripts, the key function of HTML5, is also increasing. Cyber attacks based on Scripts can trigger vicious actions when the user just accesses web pages inserted with vicious Scripts, and thus there are limits in detection using previous security technologies. This paper proposes a technology which collects and analyzes HTTP traffic generated through web browsers at host level to detect and block vicious Scripts.
-
BWCCA - Real-Time Malicious Script Blocking Technology at the Host-Level
Advances on Broad-Band Wireless Computing Communication and Applications, 2016Co-Authors: Hanchul Bae, Seongmin Park, Hwankuk KimAbstract:Due to the diversity of mobile devices, interests have been increased towards HTML5, the next generation’s web standard which pursues cross platform. To play media files or process 3D graphics in previous HTML environments, users had to install non-standard plug-ins such as Silverlight or Active X. On the other hand, HTML5 provides new tag functions of audio, video etc and new java Script functions of Websocket, Geolocation API etc to substitute non-standard technologies such as Active X. To use such functions of HTML5, web browser developers are competitively applying HTML5 to their browsers, making the active conversion to HTML5 a global trend of today. Along with such trend, however, the risk of new cyber attacks taking advantage of java Scripts, the key function of HTML5, is also increasing. Cyber attacks based on Scripts can trigger vicious actions when the user just accesses web pages inserted with vicious Scripts, and thus there are limits in detection using previous security technologies. This paper proposes a technology which collects and analyzes HTTP traffic generated through web browsers at host level to detect and block vicious Scripts.
-
behavior based detection for Malicious Script based attack
CSA CUTE, 2016Co-Authors: Soojin Yoon, Hanchul Bae, Hyun Lock Choo, Hwankuk KimAbstract:Several DoS attacks have occurred through web browsers, not from Malicious executable files. Most tools used in web attacks are downloaded malware. As the dynamic functions of HTML5 can be performed on a web browser, however, the latter can be abused as an attack tool. The features of web browser-based attacks are different from those of previous attacks, so a different detection method is needed for Malicious behavior on web browsers. This paper introduces Script-based attacks made through web browsers, and proposes a detection method based on a web browser’s behavior.
Frank Piessens - One of the best experts on this subject based on the ideXlab platform.
-
Client side web session integrity as a non-interference property: Extended version with proofs
2014Co-Authors: Wilayat Khan, Stefano Calzavara, Michele Bugliesi, Willem De Groef, Frank PiessensAbstract:Sessions on the web are fragile. They have been attacked successfully in many ways, by network-level attacks, by direct attacks on session cookies (the main mechanism for implementing the session concept) and by application-level attacks where the integrity of sessions is violated by means of cross-site request forgery or Malicious Script inclusion. This paper defines a variant of non-interference – the classical security notion from information flow security – that can be used to formally define the notion of client-side application-level web session integrity. The paper also develops and proves correct an enforcement mechanism. Combined with state-of-the-art countermeasures for network-level and cookie-level attacks, this enforcement mechanism gives very strong assurance about the client-side preservation of session integrity for authenticated sessions. Client Side Web Session Integrity as a Non-Interference Property: Extended Version
-
ICISS - Client Side Web Session Integrity as a Non-interference Property
Information Systems Security, 2014Co-Authors: Wilayat Khan, Stefano Calzavara, Michele Bugliesi, Willem De Groef, Frank PiessensAbstract:Sessions on the web are fragile. They have been attacked successfully in many ways, by network-level attacks, by direct attacks on session cookies (the main mechanism for implementing the session concept) and by application-level attacks where the integrity of sessions is violated by means of cross-site request forgery or Malicious Script inclusion. This paper defines a variant of non-interference – the classical security notion from information flow security – that can be used to formally define the notion of client-side application-level web session integrity. The paper also develops and proves correct an enforcement mechanism. Combined with state-of-the-art countermeasures for network-level and cookie-level attacks, this enforcement mechanism gives very strong assurance about the client-side preservation of session integrity for authenticated sessions.