Swaddler: An Approach for the Anomaly-Based Detection of State Violations in Web Applications

In recent years, web applications have become tremendously popular, and nowadays they are routinely used in security-critical environments, such as medical, financial, and military systems. As the use of web applications for critical services has increased, the number and sophistication of attacks against these applications have grown as well. Most approaches to the detection of web-based attacks analyze the interaction of a web application with its clients and back-end servers. Even though these approaches can effectively detect and block a number of attacks, there are attacks that cannot be detected only by looking at the external behavior of a web application. In this paper, we present Swaddler, a novel approach to the anomaly-based detection of attacks against web applications. Swaddler analyzes the internal state of a web application and learns the relationships between the application’s critical execution points and the application’s internal state. By doing this, Swaddler ...

• Type: Conference
• Year: 2007
• Where: RAID
• Authors: Marco Cova, Davide Balzarotti, Viktoria Felmetsger, Giovanni Vigna
• Keywords: Internal State, RAID 2007, Web Application, Web-based Attacks