NDLI: A Supervised Learning Approach to Protect Client Authentication on the Web

Please wait, while we are loading the content...

A Supervised Learning Approach to Protect Client Authentication on the Web

Content Provider	ACM Digital Library
Author	Tolomei, Gabriele Calzavara, Stefano Orlando, Salvatore Casini, Andrea Bugliesi, Michele
Copyright Year	2015
Abstract	Browser-based defenses have recently been advocated as an effective mechanism to protect potentially insecure web applications against the threats of session hijacking, fixation, and related attacks. In existing approaches, all such defenses ultimately rely on client-side heuristics to automatically detect cookies containing session information, to then protect them against theft or otherwise unintended use. While clearly crucial to the effectiveness of the resulting defense mechanisms, these heuristics have not, as yet, undergone any rigorous assessment of their adequacy. In this article, we conduct the first such formal assessment, based on a ground truth of 2,464 cookies we collect from 215 popular websites of the Alexa ranking. To obtain the ground truth, we devise a semiautomatic procedure that draws on the novel notion of authentication token, which we introduce to capture multiple web authentication schemes. We test existing browser-based defenses in the literature against our ground truth, unveiling several pitfalls both in the heuristics adopted and in the methods used to assess them. We then propose a new detection method based on supervised learning, where our ground truth is used to train a set of binary classifiers, and report on experimental evidence that our method outperforms existing proposals. Interestingly, the resulting classifiers, together with our hands-on experience in the construction of the ground truth, provide new insight on how web authentication is actually implemented in practice.
Starting Page	1
Ending Page	30
Page Count	30
File Format	PDF
ISSN	15591131
e-ISSN	1559114X
DOI	10.1145/2754933
Volume Number	9
Issue Number	3
Journal	ACM Transactions on the Web (TWEB)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2015-06-12
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Web security Authentication cookies Classification
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

AA Supervised Learning Approach to Protect Client Authentication on the Web

Quite a mess in my cookie jar!: leveraging machine learning to protect web authentication

One-time cookies: Preventing session hijacking attacks with stateless authentication tokens

Remote Client Authentication

Cookies: A deployment study and the testing implications

Semi-supervised network traffic classification

Mitigating application-level denial of service attacks on Web servers: A client-transparent approach

HTTP Cookies: Standards, privacy, and politics

Using SAML to protect the session initiation protocol (SIP)

A Supervised Learning Approach to Protect Client Authentication on the Web

Similar Documents

AA Supervised Learning Approach to Protect Client Authentication on the Web

Quite a mess in my cookie jar!: leveraging machine learning to protect web authentication

One-time cookies: Preventing session hijacking attacks with stateless authentication tokens

Remote Client Authentication

Cookies: A deployment study and the testing implications

Semi-supervised network traffic classification

Mitigating application-level denial of service attacks on Web servers: A client-transparent approach

HTTP Cookies: Standards, privacy, and politics

Using SAML to protect the session initiation protocol (SIP)

A Supervised Learning Approach to Protect Client Authentication on the Web