Toward a Moving Target Defense for Web Applications

2015 ◽  
Author(s):  
Marthony Taguinod ◽  
Adam Doupe ◽  
Ziming Zhao ◽  
Gail-Joon Ahn
Keyword(s):  
Web Applications ◽  
Moving Target ◽  
Moving Target Defense

scholarly journals WebMTD: Defeating Cross-Site Scripting Attacks Using Moving Target Defense

2019 ◽  
Vol 2019 ◽  
pp. 1-13 ◽  
Author(s):  
Amirreza Niakanlahiji ◽  
Jafar Haadi Jafarian
Keyword(s):  
Web Applications ◽  
Defense Mechanism ◽  
Moving Target ◽  
Web Browsers ◽  
Random Mutation ◽  
Moving Target Defense ◽  
Backward Compatibility ◽  
Low Performance ◽  
Cross Site ◽  
Code Modification

Existing mitigation techniques for cross-site scripting attacks have not been widely adopted, primarily due to imposing impractical overheads on developers, Web servers, or Web browsers. They either enforce restrictive coding practices on developers, fail to support legacy Web applications, demand browser code modification, or fail to provide browser backward compatibility. Moving target defense (MTD) is a novel proactive class of techniques that aim to defeat attacks by imposing uncertainty in attack reconnaissance and planning. This uncertainty is achieved by frequent and random mutation (randomization) of system configuration in a manner that is not traceable (predictable) by attackers. In this paper, we present WebMTD, a proactive moving target defense mechanism that thwarts various kinds of cross-site scripting (XSS) attacks on Web applications. Relying on built-in features of modern Web browsers, WebMTD randomizes values of certain attributes of Web elements to differentiate the application code from the injected code and disallow its execution; this is done without requiring Web developer involvement or browser code modification. Through rigorous evaluation, we show that WebMTD has very a low performance overhead. Also, we argue that our technique outperforms all competing approaches due to its broad effectiveness, transparency, backward compatibility, and low overhead.

TOTP Moving Target Defense for sensitive network services

2021 ◽  
pp. 101412
Author(s):  
Vitor A. Cunha ◽  
Daniel Corujo ◽  
Joao P. Barraca ◽  
Rui L. Aguiar
Keyword(s):  
Network Services ◽  
Moving Target ◽  
Moving Target Defense

scholarly journals On Event-Triggered Implementation of Moving Target Defense Control

2020 ◽  
Vol 53 (2) ◽  
pp. 3539-3544
Author(s):  
Tua A. Tamba ◽  
Bin Hu ◽  
Yul Y. Nazaruddin
Keyword(s):  
Moving Target ◽  
Moving Target Defense ◽  
Event Triggered

scholarly journals A Moving Target Defense Strategy for Internet of Things Cybersecurity

IEEE Access ◽  
2021 ◽  
pp. 1-1
Author(s):  
Andres A. Mercado-Velazquez ◽  
Ponciano J. Escamilla-Ambrosio ◽  
Floriberto Ortiz-Rodriguez
Keyword(s):  
Internet Of Things ◽  
Moving Target ◽  
Moving Target Defense ◽  
Defense Strategy
Sign in / Sign up

Export Citation Format

Share Document