International Journal of Scientific & Engineering Research Volume 10, Issue 2, February-2019 1621

ISSN 2229-5518

Smart Firewall Using Machine Learning

S.SANDEEP, C.SHANDEEP SRINIVAS, R.MEENAKSHI, V.BHARATHWAJ, P.PRASATH

Abstract— In today’s modern world no system currently available in the world is 100% secure. In addition, we always can notice that
there are huge Attack scenarios. Generally, if a new signature is found on the database, then the behavior will be considered as an attack.
Vulnerabilities in most computer systems and, it can be exploited by either non-authorized or authorized users. We propose fuzzy based
prevention techniques. In which we have the advantage of automatic intrusion prevention system by having a trained data set of previous
attack patterns. Having said that, several tools are being designed and implemented for a variety of exploitation in the diverse range of se-
curity attacks. Among these tools firewall is the one which allow us to monitor a range of computer systems: an information system, a net-
work or a cloud computing. The objective of this- project is detecting the different types of attacks with varying parameters using predictive
learning. In addition, we will include the attacks like XSS, DNS and Cookie poisoning are used by the attackers to exploit the client-based
system, these types of attacks will be prevented using machine learning approaches.

Index Terms— Cookie Poisoning, DNS, Exploit, Firewall, Fuzzy logic, Vulnerabilities, Web application, XSS.

——————————  ——————————

1 INTRODUCTION

W eb application firewalls (WAFs) in a necessary protec-

tion mechanism for online software systems. Because of
the relentless flow of new kinds of attacks as well as
3 OBJECTIVE
their increased sophistication, WAFs have to be updated and This project contributes to fight against cybercrime attacks in
tested regularly to prevent attackers from easily circumvent- everyday life. This is done by creating more complicated fire-

IJSER
ing them. There is a need of data security in cloud computing wall rules with the use of machine-driven algorithms. This
since user data are stored on server. In our proposed system paper contributes by giving insight in how to use machine
we focus on recent cloud attacks such as Cross Site Scripting learning algorithms to create these better firewall rules. This
(XSS) attacks, Domain-Name-Server (DNS) server attacks and method is singular in the sense of how the dataset is created
Cookie poisoning attacks. on which the machine learning algorithms are applied. How
Secure computer systems should assure the following the data set is created is also characterized in this paper. The
services: integrity, authentication, non-repudiation, confiden- goal of this project is to create a model using machine learning
tiality and availability. Integrity assures that no cyber crimi- techniques that can differentiate between malicious and nor-
nals change data that is stored on computer systems or being mal network traffic, extract a set useful firewall rules from this
transmitted between computers. Confidentiality assures that set.
no information is disclosed to unauthorized people.
i. Web application vulnerability is tested
ii. XSS, DNS, Cookie Poisoning patterns are observed
2 OVERVIEW iii. Detection and prevention of XSS, DNS, Cookie Poisoning
Using machine driven algorithms to detect intrusions iv. To improve the efficiency of firewall
has several advantages; zero-day malware can be detected v. Web application security is increased
through statistical analysis. Machine learning can also help
data analysts to analyze large amounts of data by analyzing
programs or data in groups that might be malicious or not.
4 RELATED WORK
Generally, security managers observe the patterns of the IP In [1] Jason Bau, Elie Bursztein, Divij Gupta, John Mitchell
addresses with histories of intrusive behavior. However, in- “State of the Art: Automated Black-Box Web Application Vul-
trusions have become more complex. For example, intrusions nerability Testing, 2010 “Black-box web application vulnera-
can be low and slow which means that an attack consists of bility scanners are automated tools that probe web applica-
intrusive behavior over hours, days or weeks and they can tions for security vulnerabilities. In order to assess the current
have more than one network source. Complex pattern recogni- state of the art, we obtained approach to eight leading tools
tion can be done through machine learning. Through automa- and carried out a study of: (i) the class of vulnerabilities tested
tion large numbers of intrusive signatures or patterns can be by these scanners, (ii) their capability against target vulnera-
monitored. bilities, and (iii) the relevance of the target vulnerabilities to
vulnerabilities found in the wild. For testing we used a custom
web application vulnerable to known and projected vulnera-
————————————————
bilities, and previous versions of frequently used web applica-
tions containing known vulnerabilities.
• R.Meenakshi, professor, DepartmentofInformationTechnology,Valliammai
Engineering College,Kanchipuram, India.

• S.Sandeep, C.Shandeep Srinivas, V.Bharathwaj, P.Prasath is currently pursuing In [2] V. Nithya, S. Lakshmana Pandian and C. Malarvizhi “A
bachelor degree program in Information Technology in Valliammai engineering
college, Anna university, India, PH-91-7299865263.
Survey on Detection and Prevention of Cross-Site Scripting
IJSER © 2019
http://www.ijser.org
International Journal of Scientific & Engineering Research Volume 10, Issue 2, February-2019 1622
ISSN 2229-5518
Attack, 2017”. In present-day time, protecting the web applica- es and decide whether blocking or forwarding them to the
tion against hacking is a big challenge. One of the common target web application. The decision is often performed based
types of hacking method is to attack the web application via on a set of rules, which are designed to detect attack patterns
Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) vulnera- which is done manually by the security manager.
bilities are used to steal web browser’s resources such as cook-
ies, credentials etc. by injecting the malicious Script code on Disadvantages :
the user’s web applications. Since Web browsers support the i. Manual updating of attack pattern
execution of scripts, which is used to enable dynamic Web ii. New pattern can not be detected
pages attackers can make use of this feature to enforce the exe- iii. Firewalls can be useful in repelling intrusions, but they
cution of malicious code in a user’s Web browser. offer no protection against sabotage
iv. Frequent updating of new attack patterns is required.
In [3] Shinde, Prashant S., and Shrikant B. Ardhapurkar
“Cyber security analysis using vulnerability assessment and
6 PROPOSED SYSTEM
penetration testing, 2016” This paper focuses on detecting and
preventing the cross-site script attacks in web application. 80 In our proposed system we focus on recent cloud attacks such
percent of the web applications are vulnerable to security as Cross Site Scripting (XSS) attacks, Domain-Name-Server
threats, as based on the survey conducted by Open Web Ap- (DNS) server attacks and Cookie poisoning attacks. The intru-
plications Security Project (OWASP). Cross-Site Scripting sion prevention technique for XSS and Cookie poisoning is
(XSS) vulnerabilities are due to the lack of input validation been performed using domain name validation and data en-
that allow attackers to insert malicious scripts in user input cryption using advanced encryption standard. The intrusion
and the script is executed at another end. This is frequently prevention technique for DNS is been performed using vali-
found within web pages with dynamic content and it carry out dating and checking the unwanted external / internal links
different malicious operations like hijacking user sessions, using link guard, eliminating malicious IP address & automat-
ically block the IP and check for any malicious requests.

IJSER
defaces web sites, redirect the user to malicious sites, pass-
word theft etc. In this paper, we detect and prevent the cross-
site scripting attack in two phases. In first phase, user given 6.1 Methodology
URL is extracted and tested for vulnerability using concolic Web application firewalls (WAFs) are a crucial protection
testing approach. It compares concrete and symbolic values mechanism for online software systems. Because of the relent-
and as a result the vulnerable URLs are sent for prevention. In less flow of new kinds of attacks as well as their increased so-
second phase, the URLs whose vulnerability is unknown are phistication, WAFs have to be updated and tested regularly to
injected into Information Leakage Calculator and the decision prevent attackers from easily circumventing them. In our pro-
is taken based on threshold value. The detected XSS attack posed system we focus attacks such as Cross Site Scripting
URLs are prevented using pattern filtering approach. The way (XSS) attacks, Domain-Name-Server (DNS) server attacks and
of preventing the XSS attack shows the proposed solution ef- Cookie poisoning attacks. In this project we propose ML-
fectiveness and convenience. Driven, an approach based on machine learning and an evolu-
tionary algorithm to automatically detect holes in WAFs
In [4] Adam Ali.Zare Hudaib” DNS Advanced Attacks and against Cross Site Scripting (XSS), Domain-Name-Server
Analysis, 2014” Nowadays DNS is used to load balance, failo- (DNS) server and Cookie poisoning attacks. ML-Driven uses
ver, and geographically redirect connections. DNS has become machine learning to incrementally learn attack patterns and
so common it is hard to identify a modern TCP/IP connection build a classifier, i.e., that predicts combinations of attack sub-
that does not use DNS in some way. Unfortunately, due to the strings.
accuracy built into the fundamental RFC-based design of
DNS, most IT professionals don't spend much time worrying
about it. If DNS is attacked — altering the addresses it gives Advantages :
out or taken offline the damage will be enormous. Whether i. Safe and Secure connection establishment.
conducted for political motives, financial gain, or just the no- ii. Dynamic pattern recognition and updating.
toriety of the attacker, the damage from a DNS attack can be iii. New attack pattern will be detected.
calamitous for the target. In this research they have reviewed iv. Intrusion is detected and prevented.
different DNS advanced attacks and analyzed them. Also, v. Security of the system is increased.
they surveyed some of the most DNS vulnerabilities and ways
of DNS attacks protection.

5 EXISTING SYSTEM
Web application firewalls (WAFs) protect web systems from 7 SYSTEM ARCHITECTURE
malicious attacks. The WAFs inspect incoming HTTP messag-

IJSER © 2019
http://www.ijser.org
International Journal of Scientific & Engineering Research Volume 10, Issue 2, February-2019 1623
ISSN 2229-5518
8.4 Fuzzy based software defined policy
A fuzzy intrusion detection system which is host-based and
uses data mining methodology and services of the underlying
operating system calls. The result of the proposed system
shows that the performance is improved and decreases the
size of the database as well as time complexity and the rate of
false alarms. Fuzzy based software defined policy analyses the
attack patterns and software defined policies are been inte-
grated which automatically prevents the attack patterns and
block the intruder. In this we proposed fuzzy network intru-
sion detection method based on class-association-rule mining.
The proposed method is dynamic and efficient for both misuse
fig 6.1 : This is where the Fuzzy based software defined and anomaly detection in networks and it can handle mixed
policy detects and prevents the specified three attacks databases which contain both continuous and discrete attrib-
The modules specified in the above diagram are utes to mine important class-association rules needed for im-
explained as bellow. provising intrusion detection. The result of the proposed
method provides as high detection rate in analogy with other
machine learning techniques. Provides better flexibility to
8 MODULES some uncertain problems. Detection accuracy is higher
8.1 XSS
Cross Site Scripting (XSS) attacks, this attack injects malicious 8.5 Intrusion prevention techniques
scripts or code into Web contents has become much popular We have used the Dynamic encryption Generation Technique
since the beginning of Web 2.0. The website can be dynamic or on the server side, which is used to generate the ciphertext of

IJSER
static based on the types of services provided. Static websites name attribute in the cookie. The user on the web browser side
generally don’t experience the security threats while the dy- submits the password and user id to the web server of the web
namic website does because their dynamism property in application.
providing user multi-fold services. • The web server submits the corresponding data from the
Cross-site scripting (XSS) attacks are considered one of the browser and generates a cookie.
dangerous attack types. It contributes 27% to the total web • Now the web server will dynamically generate encryption
attacks in 2012 for cloud infrastructure web applications and value of the name attribute in the cookie and store both these
databases. In XSS, hackers inject malicious scripts, such as Ja- values (original as well as encrypted value) in the form of a
vaScript, VBScript and Flash into a vulnerable dynamic web table on the server side. Subsequently, the web server will
page to execute the scripts on victim’s web browser which send the encryption value of the name attribute in the cookie
later can be compromised and could conduct illegal activities to the web browser.
by tricking the victim into clicking a malicious link. • The web browser will store this encrypted value into its re-
pository. Since the cookies (encrypted version) at the browser
8.2 DNS ‘s database now is not valid for the web applications.
The Domain-Name-Server (DNS) server basically performs the Therefore, XSS attack will not be able to imitate the user using
task of translation of any domain name to corresponding IP stolen cookies which are converted into its hash form.
address. But there are many cases when having called server We proposed DNS Amplification Attacks Detector (DAAD)
by name, the client has been routed to other evil cloud in its method that is implemented in the destination side (DNS
place of the server he asked for. Even though using a DNS server). The intrusion prevention technique for DNS is been
security measures such as Domain-Name-System-Security- performed using validating and checking the unwanted exter-
Extensions (DNSSEC) always reduces the overall effects of nal / internal links using link guard, eliminating malicious IP
address & automatically block the IP and check for any mali-
DNS security threats and issues but still there are many cases
cious requests.
when these security solutions and measures are proved to be
Cookie poisoning can be avoided by either performing regular
not enough when the connection between the sender and the
cookie-cleanup or by implementing the encryption scheme for
receiver is getting rerouted by a bad connection.
the cookies data.
8.3 Cookie poisoning
It this type of attack the change and modification in the con- 9 CONCLUSION
tents of cookies is made in order to gain illegal access to any
WAFs play an important role to protect online systems. The
particular application or to a webpage by an attacker. The
rising occurrence of new kinds of attacks and their increasing
identity related credentials of the user basically contained by
sophistication require that firewalls be updated and tested
these cookies and once these cookies have accessible by at-
regularly, as otherwise attacks might remain undetected and
tacker; the integrity related content of these cookies can be
reach the systems under protection. We propose ML-Driven, a
used to impersonate any authorized user.
search-based approach that combines machine learning based

IJSER © 2019
http://www.ijser.org
International Journal of Scientific & Engineering Research Volume 10, Issue 2, February-2019 1624
ISSN 2229-5518
automatic intrusion prevention system against vulnerable at- analysis, prevention & detection." International Journal of Advanced
tacks like DNS, Cookie Poisoning and XSS attacks. Research in Computer Science and Software Engineering 6, no. 6
(2016): 264-71,IEEE.
10 FUTURE ENHANCEMENT [12] Singh, Tejinder. "Detecting and Prevention Cross–Site Scripting
Techniques." IOSR Journal of Engineering 2 (2012): 854-857,IEEE.
In our proposed system we have detected the patterns of
[13] Sumitra, B., C. R. Pethuru, and M. Misbahuddin. "A survey of cloud
Cross Site Scripting (XSS) attacks, Domain-Name-Server
authentication attacks and solution approaches." International jour-
(DNS) server attacks and Cookie poisoning attacks in future
nal of innovative research in computer and communication engineer-
work, we will investigate automated approaches to generate
ing 2, no. 10 (2014): 6245-6253,IEEE.
effective patches for the WAF under test starting from the
learned attack patterns. The above method can also be used
for generation of attack patterns other than the aforemen-
tioned three attacks. Since the ML algorithms that we use are
evolutionary approaches they can be easily adopted for vari-
ous types of attacks, for pattern generation. In future these
patterns can be adopted for enterprise firewall design.

REFERENCES
[1] Bau, Jason, Elie Bursztein, Divij Gupta, and John Mitchell. "State of
the art: Automated black-box web application vulnerability testing."
In 2010 IEEE Symposium on Security and Privacy, pp. 332-345. IEEE,
2010.
[2] Nithya, V., S. Lakshmana Pandian, and C. Malarvizhi. "A survey on

IJSER
detection and prevention of cross-site scripting attack." International
Journal of Security and Its Applications, no. 3 (2015): 139-152.
[3] Shinde, Prashant S., and Shrikant B. Ardhapurkar. "Cyber security
analysis using vulnerability assessment and penetration testing." In
2016 World Conference on Futuristic Trends in Research and Innova-
tion for Social Welfare (Startup Conclave), pp. 1-5. IEEE, 2016.
[4] Hudaib, Adam Ali Zare. "DNS advanced attacks and analysis." In-
ternational Journal of Computer Science and Security (IJCSS) 8, no. 2
(2014): 63.
[5] Bo Hang,Ruimin Hu,"A novel SYN Cookie method for TCP layer
DDoS attack" Published in: 2009 International Conference on Future
BioMedical Information Engineering (FBIE)
[6] Suphannee Sivakorn,Iasonas Polakis,Angelos D. Keromytis ,"The
Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of
Private Information" Published on: 2016 IEEE Symposium on Securi-
ty and Privacy (SP)
[7] Rui Wang; Xiaoqi Jia; Qinlei Li; Shengzhi Zhang, “Machine Learning
Based Cross-Site Scripting Detection in Online Social Network” Pub-
lished in: 2014 IEEE Intl Conf on High Performance Computing and
Communications, 2014 IEEE 11th Intl Conf on Embedded Software
and Syst (HPCC, CSS, ICESS), 2014 IEEE 6th Intl Symp on Cyber-
space Safety and Security
[8] Mukesh Kumar Gupta; Mahesh Chandra Govil ; Girdhari Singh,”
Predicting Cross-Site Scripting (XSS) security vulnerabilities in web
applications“ Published in: 2015 12th International Joint Conference
on Computer Science and Software Engineering (JCSSE).
[9] Zecheng He; Tianwei Zhang; Ruby B. Lee, “Machine Learning Based
DDoS Attack Detection from Source Side in Cloud” Published in:
2017 IEEE 4th International Conference on Cyber Security and Cloud
Computing (CSCloud).
[10] Ahmad Riza'ain Yusof; Nur Izura Udzir; Ali Selamat ; Hazlina
Hamdan , “ Adaptive feature selection for denial of services (DoS) at-
tack” Published in: 2017 IEEE Conference on Application, Infor-
mation and Network Security (AINS).
[11] Rohilla, Monika, Rakesh Kumar, and Girdhar Gopal. "XSS attacks:

IJSER © 2019
http://www.ijser.org