Prevention against xss and sql injection

Aim:

The mainstay of this project is to detect application level known and unknown attacks especially XSS and SQL injection, in efficient way.

Synopsis:

Web application attacks can play havoc with the system within no time. More than 80% attacks are at application layer and almost 90% applications are vulnerable to these attacks. Traditional solutions in the form of web scanners, firewall, intrusion detection system (IDS) or web proxies are ineffective to mitigate application level attacks.

Existing System:

The security of web applications has become increasingly important and a secure web environment has become a high priority for e-businesses communities. Being used as the major platform for the flow of sensitive information there is increasing security concerns for the organizations as well as for the individuals. Due to transaction of high sensitive corporate information through the web and increase in online traffic multifold the security issue. The latest technologies like Ajax (Asynchronous JavaScript) and emergence of Web 2 have complicated the security problem.

Proposed System:

The proposed system introduced a novel approach of multiple layered defenses to the application level attacks which possess higher detection ability with low false positive rate. The System is capable to detect application level known and unknown attacks especially XSS and SQL injection, in efficient way. Our system is also helpful for the developers to find the application vulnerabilities well in time by visually observing the proper validation through validation flow graph. Over all our system approach is efficient to locate and detect the vulnerability with the help of control flow graph which avoid time consuming sequential search.

Modules:

The modules are as follows,
1. Filter.
2. Detection Module.
1. Negative security component.
2. Positive security component.
3. Anomaly detection component.
. 3. Analyzer and Validating Module.
1. Input validation.
2. Vulnerabilities checking.

Filter:

After receiving Network stream Filter, filter out the HTTP request, then it observe the special character and tags in which JavaScript functions can be embedded which is the major cause of code injection attacks.If special character exists in the input, and then the input is passed to the Detection module. Other wise the request is forwarded to the program analyzer of web application.

Detection Module:

Detection module consists of different intrusion detection techniques. It consists of three components, 1) Positive security component, 2) Negative security component and 3) Anomaly detection component. In Detection module three threads are used for parallel processing, in these components. If one of the threads found the result in any component, the other threads are interrupted and stopped from further processing the input. If there is no vulnerability detected then the input is passes to Analyzer &Validation module for further processing otherwise it generates exception for error. Parallel processing is necessary for increasing the performance of the input processing.
In Negative security component it checks different attacks for example signatures for cross–site scripting attacks like signature of attacks.
In Positive security component it the signature of allowed tags, URLs or SQL queries in the form of regular expression. For example allowed tags like, order list

, or list items
1. tags of ordered list, unordered list and a list item respectively.
   In Anomaly detection component during learning phase, the Anomaly detection component observed different attribute values of log entries. Different statistics models are used in anomaly detection component e.g. case base reasoning, character distribution, structural inference and length attribute.
   
   Analyzer and Validating Module:
   
   Analyzer & Validating Module will analyze the information getting from web crawler and develop the Control Flow Graph then Validation Flow Graph (VFG) from the source code for input validation. Input validation is carried out semantically and syntactically. The type of checking carried out by a validation node can be classified into the following types: Semantic Input Validation it includes the Control Check, Signature Check, Consistency Check, Protocol Check, Input-Database Check, Data type conversion, and Data format validation. Syntactic Input Validation it include the Length Numeric restriction, Input value restriction, Input field selection, Control flow restriction and Input transfer mode. In Vulnerable checking, Application can be check where it is vulnerable, not vulnerable or potentially vulnerable to attacks.
   
   Conclusion:
   
   Our system provides the strong fortress against web application attacks. Multi-layered defense is an effective strategy for security critical web applications. First layer, filter out the special tags from malicious input through Filter. Second layer, Detection module detects malicious input through positive, negative and anomaly components and lastly syntactical and semantically validation through Analyzer & Validation module.