Machine Learning for Web Vulnerability Detection: The Case of
Cross-Site Request Forgery
ABSTRACT
In this project, we propose a methodology to leverage Machine Learning (ML) for
the detection of web application vulnerabilities. Web applications are particularly
challenging to analyses, due to their diversity and the widespread adoption of
custom programming practices. ML is thus very helpful for web application
security: it can take advantage of manually labeled data to bring the human
understanding of the web application semantics into automated analysis tools. We
use our methodology in the design of Mitch, the first ML solution for the black-
box detection of Cross-Site Request Forgery (CSRF) vulnerabilities. Mitch
allowed us to identify 35 new CSRFs on 20 major websites and 3 new CSRFs on
production software.
INTRODUCTION
Web applications are the most common interface to securitysensitive data and functionality
available nowadays. They are routinely used to file tax incomes, access the results of medical
screenings, perform financial transactions, and share opinions with our circle of friends, just to
mention a few popular use cases. On the downside, this means that web applications are
appealing targets to malicious users (attackers) who are determined to force economic losses,
unduly access confidential data or create embarrassment to their victims. Securing web
applications is well known to be hard [1]. There are several reasons for this, ranging from the
heterogeneity and complexity of the web platform to the adoption of undisciplined scripting
languages offering dubious security guarantees and not amenable for static analysis. In such a
setting, black-box vulnerability detection methods are particularly popular [2], [3], [4]. As
opposed to white-box techniques which require access to the web application source code, black-
box methods operate at the level of HTTP traffic, i.e., HTTP requests and responses. Though this
limited perspective might miss important insights, it has the key advantage of offering a
language-agnostic vulnerability detection approach, which abstracts from the complexity of
scripting languages and offers a uniform interface to the widest possible range of web
applications. This sounds appealing, yet previous work showed that such an analysis is far from
trivial [5], [6]. One of the main challenges there is how to expose to automated tools a critical
ingredient of effective vulnerability detection, i.e., an understanding of the web application
semantics.
EXISTING SYSTEM:
In the existing system Securing web applications is well known to be hard. There
are several reasons for this, ranging from the heterogeneity and complexity of the
web platform to the adoption of undisciplined scripting languages offering dubious
security guarantees and not amenable for static analysis. Though this limited
perspective might miss important insights, it has the key advantage of offering a
language-agnostic vulnerability detection approach, which abstracts from the
complexity of scripting languages and offers a uniform interface to the widest
possible range of web applications.
DISADVANTAGES OF EXISTING SYSTEM:
In white-box techniques which require access to the web application source
code.
Black-box methods operate at the level of HTTP traffic, i.e., HTTP requests
and responses.
PROPOSED SYSTEM:
Cross-Site Request Forgery (CSRF) is a well-known web attack that forces a user
into submitting unwanted, attackercontrolled HTTP requests towards a vulnerable
web application in which she is currently authenticated. The key concept of CSRF
is that the malicious requests are routed to the web application through the user’s
browser, hence they might be indistinguishable from intended benign requests
which were actually authorized by the user. The CSRF does not require the
attacker to intercept or modify user’s requests and responses: it suffices that the
victim visits the attacker’s website, from which the attack is launched. Thus, CSRF
vulnerabilities are exploitable by any malicious website on the Web.
ADVANTAGES OF PROPOSED SYSTEM:
The value of standard HTTP request headers such as Referrer and Origin,
indicating the page originating the request.
The presence of custom HTTP request headers like X-Requested-With,
which cannot be set from a cross-site position.
The presence of unpredictable anti-CSRF tokens, set by the server into
sensitive forms.
SYSTEM REQUIREMENTS:
HARDWARE REQUIREMENTS:
• System : i3 processor
• Ram : 4GB
• Hard Disk : 512 GB
SOFTWARE REQUIREMENTS:
• Operating System: Windows
• Coding Language: Python 3.7
SYSTEM ARCHITECTURE:
REFERENCES
[1] Stefano Calzavara, Riccardo Focardi, Marco Squarcina, and Mauro Tempesta. Surviving the
web: A journey into web session security. ACM Comput. Surv., 50(1):13:1–13:34, 2017.
[2] Avinash Sudhodanan, Roberto Carbone, Luca Compagna, Nicolas Dolgin, Alessandro
Armando, and Umberto Morelli. Large-scale analysis & detection of authentication cross-site
request forgeries. In 2017 IEEE European Symposium on Security and Privacy, EuroS&P 2017,
Paris, France, April 26-28, 2017, pages 350–365, 2017.
[3] Stefano Calzavara, Alvise Rabitti, Alessio Ragazzo, and Michele Bugliesi. Testing for
integrity flaws in web sessions. In Computer Security - 24rd European Symposium on Research
in Computer Security, ESORICS 2019, Luxembourg, Luxembourg, September 23-27, 2019,
pages 606–624, 2019.
[4] OWASP. OWASP Testing Guide. [Link] OWASP Testing Guide
v4 Table of Contents, 2016.
[5] Jason Bau, Elie Bursztein, Divij Gupta, and John C. Mitchell. State of the art: Automated
black-box web application vulnerability testing. In 31st IEEE Symposium on Security and
Privacy, S&P 2010, 16-19 May 2010, Berkeley/Oakland, California, USA, pages 332–345, 2010.
[6] Adam Doup´e, Marco Cova, and Giovanni Vigna. Why johnny can’t pentest: An analysis of
black-box web vulnerability scanners. In Detection of Intrusions and Malware, and Vulnerability
Assessment, 7th International Conference, DIMVA 2010, Bonn, Germany, July 8-9, 2010.
Proceedings, pages 111–131, 2010.
[7] Adam Barth, Collin Jackson, and John C. Mitchell. Robust defenses for cross-site request
forgery. In Proceedings of the 2008 ACM Conference on Computer and Communications
Security, CCS 2008, Alexandria, Virginia, USA, October 27-31, 2008, pages 75–88, 2008.
[8] Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar. Foundations of Machine
Learning. The MIT Press, 2012.
[9] Michael W. Kattan, Dennis A. Adams, and Michael S. Parks. A comparison of machine
learning with human judgment. Journal of Management Information Systems, 9(4):37–57, March
1993.
[10] D. A. Ferrucci. Introduction to “This is Watson”. IBM Journal of Research and
Development, 56(3):235–249, May 2012.
[11] David Silver, Aja Huang, Chris J. Maddison, Arthur Guez, Laurent Sifre, George van den
Driessche, Julian Schrittwieser, Ioannis Antonoglou, Veda Panneershelvam, Marc Lanctot,
Sander Dieleman, Dominik Grewe, John Nham, Nal Kalchbrenner, Ilya Sutskever, Timothy
Lillicrap, Madeleine Leach, Koray Kavukcuoglu, Thore Graepel, and Demis Hassabis. Mastering
the game of Go with deep neural networks and tree search. Nature, 529(7587):484–489, Jan
2016.
[12] Michele Bugliesi, Stefano Calzavara, Riccardo Focardi, and Wilayat Khan. Cookiext:
Patching the browser against session hijacking attacks. Journal of Computer Security, 23(4):509–
537, 2015.
[13] Stefano Calzavara, Gabriele Tolomei, Andrea Casini, Michele Bugliesi, and Salvatore
Orlando. A supervised learning approach to protect client authentication on the web. TWEB,
9(3):15:1–15:30, 2015.
[14] Stefano Calzavara, Mauro Conti, Riccardo Focardi, Alvise Rabitti, and Gabriele Tolomei.
Mitch: A machine learning approach to the blackbox detection of CSRF vulnerabilities. In IEEE
European Symposium on Security and Privacy, EuroS&P 2019, Stockholm, Sweden, June 17-19,
2019, pages 528–543, 2019.
[15] Giancarlo Pellegrino, Martin Johns, Simon Koch, Michael Backes, and Christian Rossow.
Deemon: Detecting CSRF with dynamic analysis and property graphs. In Proceedings of the
2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas,
TX, USA, October 30 - November 03, 2017, pages 1757–1771, 2017.