A Study of Gaps in Defensive Countermeasures for Web Security

Abstract

Traditionally, simple defenses against web-based attacks, such as input sanitization, provide little protection against a motivated attacker with simple evasion capabilities and often have impractically high false positive and false negative rates. More effective defenses in this domain often either require significant modifications to servers and infrastructures, thus violating the federated model of such networks, or they impose high computational or operator overheads. As a result, the domain of web-based attacks requires significant research and development efforts to provide practical, effective defenses. In this report, we highlight some of the most important deployment challenges and gaps related to web-based defenses, which can be used to guide future research and development in this area.

Open PDF

Document Details

Document Type
Technical Report
Publication Date
Oct 14, 2016
Accession Number
AD1021692

Entities

People

  • Hamad Okhravi
  • Kevin S. Bauer
  • S. C. Roberts
  • T. Hobson
  • William W. Streilein

Organizations

  • MIT Lincoln Laboratory

Tags

Communities of Interest

  • Cyber

DTIC Thesaurus Topics

  • Code Injection
  • Computer Access Control
  • Computer Programming
  • Computer Programs
  • Computers
  • Cyberattacks
  • Cybersecurity
  • Deployment
  • Detection
  • Infrastructure
  • Internet
  • Network Architecture
  • Social Media
  • Social Networking Services
  • Web Applications
  • Web Browsers
  • Web Service

Fields of Study

  • Computer science

Readers

  • Applied Combinatorial Optimization and Logic Circuit Design.
  • Cybersecurity.
  • Systems Analysis and Design