SEARCH METHODS FOR ABNORMAL ACTIVITIES OF WEB APPLICATIONS
Subject of Research.The paper presents a review of existing detection methods for abnormal activities of web applications. Comparative characteristics are given. Priorities for improving information security tools in web applications are shown. Method.For evaluation of search methods for abnorma...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Saint Petersburg National Research University of Information Technologies, Mechanics and Optics (ITMO University)
2020-04-01
|
| Series: | Naučno-tehničeskij Vestnik Informacionnyh Tehnologij, Mehaniki i Optiki |
| Subjects: | |
| Online Access: | https://ntv.ifmo.ru/file/article/19540.pdf |
| _version_ | 1818942326730391552 |
|---|---|
| author | Olesia I. Mikheeva Yury A. Gatchin Sergey V. Savkov Regina M. Khammatova Anatoliy P. Nyrkov |
| author_facet | Olesia I. Mikheeva Yury A. Gatchin Sergey V. Savkov Regina M. Khammatova Anatoliy P. Nyrkov |
| author_sort | Olesia I. Mikheeva |
| collection | DOAJ |
| description | Subject of Research.The paper presents a review of existing detection methods for abnormal activities of web
applications. Comparative characteristics are given. Priorities for improving information security tools in web
applications are shown. Method.For evaluation of search methods for abnormal activities of web applications, criteria for selecting indicators were defined. Particular attention was paid to such indicators as: the launching speed of web applications after loading, web application responsiveness to user actions and the number of abnormal activities found in comparison with the number of malfunctions found. Three methods of searching for abnormal activities were compared: statistical code scanning, dynamic code scanning and network traffic monitoring. We considered advantages and disadvantages of each method and implementation examples. Main Results.It is shown that the dynamic method of searching for abnormal activities has the best characteristics. The method provides the identification of anomalies associated with traffic transfer and anomalies that occur during the local operation of web applications. The method is implemented as a code analyzer built into the browser engine. The analyzer checks all calls of the web application to the engine and detects abnormal activity based on such calls. In contrast to static scanning, dynamic scanning identifies anomalies in Web Workers, WebAssembly and in the parts of code that are downloaded over the network after the application starts. Practical Relevance. The work can be useful to information security specialists who deal with the
problems of protecting web applications, as well as programmers and system administrators at application creation and implementation stage. The results of the work can find practical use in the development of web applications, browsers, and information protection software. |
| first_indexed | 2024-12-20T07:09:40Z |
| format | Article |
| id | doaj.art-ff932f2e6c1c4b11b2da275162968421 |
| institution | Directory Open Access Journal |
| issn | 2226-1494 2500-0373 |
| language | English |
| last_indexed | 2024-12-20T07:09:40Z |
| publishDate | 2020-04-01 |
| publisher | Saint Petersburg National Research University of Information Technologies, Mechanics and Optics (ITMO University) |
| record_format | Article |
| series | Naučno-tehničeskij Vestnik Informacionnyh Tehnologij, Mehaniki i Optiki |
| spelling | doaj.art-ff932f2e6c1c4b11b2da2751629684212022-12-21T19:48:55ZengSaint Petersburg National Research University of Information Technologies, Mechanics and Optics (ITMO University)Naučno-tehničeskij Vestnik Informacionnyh Tehnologij, Mehaniki i Optiki2226-14942500-03732020-04-0120223324210.17586/2226-1494-2020-20-2-233-242SEARCH METHODS FOR ABNORMAL ACTIVITIES OF WEB APPLICATIONSOlesia I. Mikheeva0https://orcid.org/0000-0001-8370-529XYury A. Gatchin1https://orcid.org/0000-0002-1067-619XSergey V. Savkov2https://orcid.org/0000-0002-9438-4564Regina M. Khammatova3https://orcid.org/0000-0001-7236-9024Anatoliy P. Nyrkov4https://orcid.org/0000-0002-9803-6284Student, ITMO University, Saint Petersburg, 197101, Russian FederationD.Sc., Full Professor, ITMO University, Saint Petersburg, 197101, Russian FederationChief Information Officer, ZAO Mobicon, Saint Petersburg, 199178, Russian FederationEngineer, LLC Certification Authority Gazinformservice, Saint Petersburg,198096, Russian FederationD.Sc., Full Professor, Admiral Makarov State University of Maritime and Inland Shipping, Saint Petersburg, 198035, Russian FederationSubject of Research.The paper presents a review of existing detection methods for abnormal activities of web applications. Comparative characteristics are given. Priorities for improving information security tools in web applications are shown. Method.For evaluation of search methods for abnormal activities of web applications, criteria for selecting indicators were defined. Particular attention was paid to such indicators as: the launching speed of web applications after loading, web application responsiveness to user actions and the number of abnormal activities found in comparison with the number of malfunctions found. Three methods of searching for abnormal activities were compared: statistical code scanning, dynamic code scanning and network traffic monitoring. We considered advantages and disadvantages of each method and implementation examples. Main Results.It is shown that the dynamic method of searching for abnormal activities has the best characteristics. The method provides the identification of anomalies associated with traffic transfer and anomalies that occur during the local operation of web applications. The method is implemented as a code analyzer built into the browser engine. The analyzer checks all calls of the web application to the engine and detects abnormal activity based on such calls. In contrast to static scanning, dynamic scanning identifies anomalies in Web Workers, WebAssembly and in the parts of code that are downloaded over the network after the application starts. Practical Relevance. The work can be useful to information security specialists who deal with the problems of protecting web applications, as well as programmers and system administrators at application creation and implementation stage. The results of the work can find practical use in the development of web applications, browsers, and information protection software.https://ntv.ifmo.ru/file/article/19540.pdfabnormal activitybrowserbrowser engineweb applicationsjavascript enginetraffic analysis between client and serverstatic code analysisdynamic code analysis |
| spellingShingle | Olesia I. Mikheeva Yury A. Gatchin Sergey V. Savkov Regina M. Khammatova Anatoliy P. Nyrkov SEARCH METHODS FOR ABNORMAL ACTIVITIES OF WEB APPLICATIONS Naučno-tehničeskij Vestnik Informacionnyh Tehnologij, Mehaniki i Optiki abnormal activity browser browser engine web applications javascript engine traffic analysis between client and server static code analysis dynamic code analysis |
| title | SEARCH METHODS FOR ABNORMAL ACTIVITIES OF WEB APPLICATIONS |
| title_full | SEARCH METHODS FOR ABNORMAL ACTIVITIES OF WEB APPLICATIONS |
| title_fullStr | SEARCH METHODS FOR ABNORMAL ACTIVITIES OF WEB APPLICATIONS |
| title_full_unstemmed | SEARCH METHODS FOR ABNORMAL ACTIVITIES OF WEB APPLICATIONS |
| title_short | SEARCH METHODS FOR ABNORMAL ACTIVITIES OF WEB APPLICATIONS |
| title_sort | search methods for abnormal activities of web applications |
| topic | abnormal activity browser browser engine web applications javascript engine traffic analysis between client and server static code analysis dynamic code analysis |
| url | https://ntv.ifmo.ru/file/article/19540.pdf |
| work_keys_str_mv | AT olesiaimikheeva searchmethodsforabnormalactivitiesofwebapplications AT yuryagatchin searchmethodsforabnormalactivitiesofwebapplications AT sergeyvsavkov searchmethodsforabnormalactivitiesofwebapplications AT reginamkhammatova searchmethodsforabnormalactivitiesofwebapplications AT anatoliypnyrkov searchmethodsforabnormalactivitiesofwebapplications |