Research and Implementation of Cross-site Scripting Defense Method Based on Moving Target Defense Technology

2018 ◽  
Author(s):  
Ping Chen ◽  
Han Yu ◽  
Min Zhao ◽  
Jinshuang Wang
Keyword(s):  
Moving Target ◽  
Moving Target Defense ◽  
Defense Technology ◽  
Cross Site

scholarly journals WebMTD: Defeating Cross-Site Scripting Attacks Using Moving Target Defense

2019 ◽  
Vol 2019 ◽  
pp. 1-13 ◽  
Author(s):  
Amirreza Niakanlahiji ◽  
Jafar Haadi Jafarian
Keyword(s):  
Web Applications ◽  
Defense Mechanism ◽  
Moving Target ◽  
Web Browsers ◽  
Random Mutation ◽  
Moving Target Defense ◽  
Backward Compatibility ◽  
Low Performance ◽  
Cross Site ◽  
Code Modification

Existing mitigation techniques for cross-site scripting attacks have not been widely adopted, primarily due to imposing impractical overheads on developers, Web servers, or Web browsers. They either enforce restrictive coding practices on developers, fail to support legacy Web applications, demand browser code modification, or fail to provide browser backward compatibility. Moving target defense (MTD) is a novel proactive class of techniques that aim to defeat attacks by imposing uncertainty in attack reconnaissance and planning. This uncertainty is achieved by frequent and random mutation (randomization) of system configuration in a manner that is not traceable (predictable) by attackers. In this paper, we present WebMTD, a proactive moving target defense mechanism that thwarts various kinds of cross-site scripting (XSS) attacks on Web applications. Relying on built-in features of modern Web browsers, WebMTD randomizes values of certain attributes of Web elements to differentiate the application code from the injected code and disallow its execution; this is done without requiring Web developer involvement or browser code modification. Through rigorous evaluation, we show that WebMTD has very a low performance overhead. Also, we argue that our technique outperforms all competing approaches due to its broad effectiveness, transparency, backward compatibility, and low overhead.

TOTP Moving Target Defense for sensitive network services

2021 ◽  
pp. 101412
Author(s):  
Vitor A. Cunha ◽  
Daniel Corujo ◽  
Joao P. Barraca ◽  
Rui L. Aguiar
Keyword(s):  
Network Services ◽  
Moving Target ◽  
Moving Target Defense

scholarly journals On Event-Triggered Implementation of Moving Target Defense Control

2020 ◽  
Vol 53 (2) ◽  
pp. 3539-3544
Author(s):  
Tua A. Tamba ◽  
Bin Hu ◽  
Yul Y. Nazaruddin
Keyword(s):  
Moving Target ◽  
Moving Target Defense ◽  
Event Triggered
Sign in / Sign up

Export Citation Format

Share Document