See discussions, stats, and author profiles for this publication at: [Link]

net/publication/378035783

Web Application Security: A Pragmatic Exposé

Article in Digital Threats Research and Practice · January 2024

DOI: 10.1145/3644394

CITATION READS

1 190

1 author:

Clement Aladi
California University of Management and Sciences
5 PUBLICATIONS 2 CITATIONS

SEE PROFILE

All content following this page was uploaded by Clement Aladi on 07 June 2024.

The user has requested enhancement of the downloaded file.

Web Application Security: A Pragmatic Exposé
CLEMENT C. ALADI
Centre of Information Systems and Technology Claremont Graduate University, Claremont USA.
[Link]@[Link]
Many individuals, organizations, and industries rely on web applications for the daily operations of their businesses. With the increasing deployment and
dependence on these applications, significant attention has been directed towards developing more accurate and secure mechanisms to safeguard them from
malicious web-based attacks. The slow adoption of the latest security protocols, coupled with the utilization of inaccurate and inadequately tested security measures,
has hindered the establishment of efficient and effective security measures for web apps. This paper reviews recent research and their recommendations for web
security over the last four years. It identifies code injection as one of the recent most prevalent web-based attacks. The recommendations presented in this paper
offer a practical guide, enabling individuals and security personnel across various industries and organizations to implement tested and proven security measures for
web applications. Furthermore, it serves as a roadmap for security developers, aiding them in creating more accurate and quantifiable measures and mechanisms for
web security.

CCS CONCEPTS • Security and privacy → Web application security.

Additional Keywords and Phrases: Web application, Web security, Web attacks, Vulnerabilities Web Defense.

1 INTRODUCTION
Security in web applications is an issue that warrants significant attention. Multiple solutions exist for implementing security
measures in web applications, although these measures are not entirely flawless. Nevertheless, they serve as preventive measures
against potential compromises in critical security considerations. Web applications typically comprise a client, a web server, an
application server, and a database. This paper aims to address the following research question: What are the most recent and
effective web security mechanisms for web application security?
To address concerns in web application security, delving into the realm of Transport Layer Security (TLS) proves
indispensable. Discussions on TLS within web application security underscore its pivotal role in preserving data integrity,
confidentiality, and user privacy. The implementation of TLS ensures compliance with regulatory standards, thereby minimizing
legal liabilities. TLS authentication mechanisms verify server identities, reducing the likelihood of phishing attacks, serving as a
protective shield for sensitive information, thwarting unauthorized access and mitigating risks associated with data interception and
eavesdropping during transmission over the internet, and enhancing user confidence in legitimate web interactions. Profound
comprehension of TLS vulnerabilities facilitates swift mitigation and patching, ultimately fortifying the security of web
environments, cultivating user trust, and upholding the positive reputation of web applications and websites. I initially examined
some of the conceptual weaknesses and issues within SSL/TSL, preceding the exploration of other related works on web
application security [1]. TLS, a cryptographic protocol designed to ensure secure communications over computer networks, plays a
pivotal role in establishing secure communication between web browsers, end-user-facing applications, and servers by encrypting
transmitted data, thus preventing eavesdropping or tampering attacks. Weaknesses in TLS primarily pertain to its earlier versions,
such as 1.0, 1.1, and 1.2, largely because these versions retained backward compatibility with SSL 3.0. This vulnerability stemmed
from the continued support of an outdated cryptographic method known as cipher block-chaining (CBC) within TLS 1.2. Another
vulnerability, known as 'FREAK,' allowed attackers to intercept HTTPS connections between vulnerable clients and servers and
compel them to utilize 'export-grade' cryptography. This export-grade cryptography featured outdated encryption key lengths that
were susceptible to decryption. Despite the obsolescence of export-grade cryptography, servers supporting RSA export cipher suites
could enable a man-in-the-middle (MITM) attacker to deceive both the client and server into adopting older and weaker 40- and/or
56-bit export cipher suites, thereby downgrading their connection.

TLS 1.3 has now become the de facto standard. The paper does not delve into other TLS-related attacks and implementation
issues. Some of the vulnerabilities discussed here are attributable to backward compatibility, weaker algorithms, and the two-trip
handshake, all of which have been addressed in the current TLS 1.3 version. However, to safeguard against all known and unknown
TLS downgrade attacks, the recommended best practice is to update information systems to the latest version of TLS 1.3.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or
distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work
owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to
lists, requires prior specific permission and/or a fee. Request permissions from permissions@[Link].
© 2024 Copyright held by the owner/author(s). Publication rights licensed to ACM.
ACM 2692-1626/2024/02-ART
[Link]
Digit. Threat.: Res. Pract.
 Research conducted by Gigamon Threatinsight [2] revealed that 20% of corporate traffic employs TLS 1.3. Prominent web
services such as Google and Facebook, as well as content delivery networks (CDNs), have transitioned to TLS 1.3, and major web
browsers like Chrome, Firefox, Microsoft Edge, and Safari also support it. However, a significant portion, approximately 77.38%,
continues to rely on TLS1.2, with only 0.09% on TLS 1.1, 2.47% on TLS 1.0, and 0.04% exclusively using SSL. Notably, 56% of
East-West Traffic is encrypted, while 44% remains unencrypted. Consequently, owing to the slow adoption of TLS 1.3, numerous
websites may still be susceptible to man-in-the-middle attacks and other security threats stemming from vulnerabilities in previous
TLS versions. The implementation of TLS 1.3 is fundamental to enhancing the effectiveness of the recommendations made by other
researchers, as discussed in subsequent sections of this paper. These sections explore various proposals put forth by researchers to
enhance web application security.

2 RELATED WORKS
Fu et al. [3] emphasize the significance of secure communication channels in web applications such as online banking, email, and
e-commerce, which heavily rely on X.509 public-key certificate authentication among users. SSL/TLS protocols employ X.509 for
authentication purposes. However, the use of expired or self-signed certificates poses a potential threat to web security, making
these applications susceptible to exploitation by cyber attackers.
An analysis conducted by [3] regarding the lifecycle of leaf certificates reveals noteworthy findings. Typically, standard
certificates have a shorter validity period, with approximately 86% having a duration of less than three years. In contrast, self-
signed certificates exhibit a longer validity period, with around 70% extending beyond three years. Furthermore, the study identifies
instances where certificates are employed before their designated issuing time, indicating potential misconfiguration or malicious
behavior. Certificates with a commencement date earlier than 1950 are identified as counterfeit, as they cannot be issued by a
trusted Certificate Authority (CA). Notably, most certificates have an actual usage period of no more than one day. Additionally, a
significant number of certificates continue to be used even after their expiration.

To mitigate the malicious use of expired certificates, users should enhance their awareness of security practices and regularly
assess the effectiveness of their certificates during usage. Shortening the validity period of certificates is a practical approach to
bolstering web security, as it compels administrators to frequently update and validate their certificates. Web service applications
should prioritize the use of certificates issued by reputable CAs. In cases where self-signed certificates are employed for economic
or convenience reasons, it is advisable to set shorter validity periods to enhance security.

Mukazi et al. [4] introduced a web application firewall (WAF) utilizing the ModSecurity and Reverse Proxy Method. This
WAF concept serves as a security measure to safeguard web applications against various threats and attacks. WAFs are capable of
packet filtering, blocking hazardous HTTP requests, and performing logging functions. The authors conducted testing on the WAF
by launching attacks against a web application. The test attacks included cross-site scripting (XSS), SQL injection, and
unauthorized vulnerability scanning on the web application's web pages.

The results demonstrated that, in the absence of ModSecurity and the reverse proxy, the XSS attack on the webpage
succeeded. However, with ModSecurity configured, the XSS attack was thwarted. This study underscores the critical vulnerability
that exists when a web server lacks a WAF, as it fails to filter or validate inputs from clients, leaving it susceptible to exploitation.
Implementing a WAF and a proxy server, such as a reverse proxy, becomes imperative to filter and validate requests before they
reach the server. As demonstrated in this research, this implementation is instrumental in enhancing the security of web
applications.

Yadav et al. [5] propose several strategies to enhance database security. They advise against creating a database on the
server where the application is installed with administrative privileges. Instead, they suggest encrypting files and backup data, and
the implementation of firewalls.

Regarding Operating System security, their recommendations encompass meticulous and secure installation practices,
appropriate system configuration, and the installation of intrusion detection systems.

In the context of mobile applications, they advocate for the adoption of various security evaluation methods. These methods
encompass validation, controlled access, session monitoring, encryption, error management, and data security.

Digit. Threat.: Res. Pract.

 Liang et al. [6] introduce a secure and user-controlled framework called SecureWeb, which addresses the issue of sensitive
data leakage on web servers. Their paper focuses on safeguarding user passwords and offers a comprehensive solution for
protecting various types of sensitive data.

In their approach to password security, they utilize a U-disk as a security token for user authentication, significantly
enhancing security by storing the authentication key on the U-disk rather than on the computer or server. Additionally, SecureWeb
establishes a secure environment through a browser extension, with encryption and decryption processes managed by a local
computer's stub program. A password manager called SecurePWD, combined with a Document Object Model (DOM), ensures both
security and accessibility.

One crucial aspect addressed by SecureWeb is the isolation of the secure environment module from the application code,
preventing malicious client-side code from stealing user data. They achieve this through a technique called "Shadow DOM," which
isolates the application DOM.

To protect sensitive data beyond passwords, SecureData is implemented as an extension of SecurePWD within the
SecureWeb framework. SecureData empowers users to have control over their sensitive data and offers a unified protection solution
for various types of sensitive information.

While SecureWeb is deemed a highly secure approach to password management, it relies on the assumption that users do not
lose their U-disk to attackers. The interfaces between the key management module, encryption module, and secure environment
module are also proven to be secure against potential attacks.

In summary, Liang et al.'s SecureWeb framework provides a robust and user-centric solution for mitigating sensitive data
leakage on web servers, with a focus on password security and the protection of diverse sensitive data types. Their approach
emphasizes user control and security, with specific measures such as U-disk-based authentication and the use of Shadow DOM to
isolate the secure environment module.

Mitropoulos et al. [7] conducted an in-depth analysis of defense mechanisms aimed at countering web code injection
attacks, with a strong focus on the precision of detection. In addition to this, they introduced a classification system for web
application defenses against injection attacks, categorizing them into three broad groups: etiological, symptomatic, and hybrid.

The etiological category encompasses mechanisms designed to thwart attacks by addressing their causes and origins. Within
this category, three distinct approaches were identified: Parse tree validation, policy enforcement, and instruction set randomization.

The symptomatic category encompasses various strategies that scrutinize application behavior to detect attacks based on
their undesirable characteristics. Two primary approaches are used in this category: taint tracking and training.

Hybrid mechanisms combine elements from both etiological and symptomatic categories.

Throughout their evaluation of these security mechanisms, the authors noted that some of them could be bypassed by
attackers with knowledge of their inner workings. However, certain mechanisms, such as SQLCheck, Amnesia, and libAnomaly,
were highlighted as having undergone extensive testing and demonstrating greater accuracy in their performance regarding
computational cost and the impact on the server and client systems. The accuracy of the mechanisms in detecting code injection
attacks, such as SQL injection and Cross-Site Scripting (XSS), is also mentioned as an important aspect of their performance.

The authors recommend enhancing the precision of experimental testing for new mechanisms and providing access to code.
They stress the importance of researchers reporting results on false positives and false negatives for their mechanisms, as it allows
for a better understanding of their effectiveness and aids in addressing circumvention vulnerabilities.

Ibarra-Fiallos et al. [8] have devised an effective design and implementation for safeguarding web applications against
injection attacks. Injection attacks pose a significant threat to web applications, but most existing security measures against them
lack a high level of accuracy. In response to this challenge, the authors propose a security solution that boasts a remarkable
accuracy rate of 98.9%.

Digit. Threat.: Res. Pract.

 Their security measure hinges on input field filtering, which is based on OWASP Stinger and a set of regular expressions,
coupled with a sanitization process. This implementation rigorously validates all incoming data in an HTTP request, including
headers and parameters. Each field is subjected to a specific regular expression to ensure that only expected input is accepted, and
common terms utilized in injection attacks are sanitized. Notably, this filtering mechanism demonstrates superior accuracy
compared to Web Application Firewalls (WAFs).

Agereindra Helmiawan et al. [9] conducted a comprehensive analysis of a website through penetration testing, employing
the Open Web Application Security Project (OWASP) framework. This assessment involved reconnaissance, scanning, and the
exploitation of the target website. The findings revealed a few minor security vulnerabilities, including potential exposure to
sensitive data, injection risks, and the presence of eight open ports.

The authors propose several security enhancements to address these issues. These include the implementation of security
measures like closing unnecessary ports or enhancing Secure Shell (SSH) security on open ports. Additionally, they recommend
the incorporation of logging and monitoring mechanisms to enable the tracking of access history and activities occurring on the
website.

Conde Camillo da Silva et al [10] proposed an intrusion detection system using the IBM LGBM algorithm. They used
machine learning algorithms to train models to classify different attack requests made to the webserver to increase the security of
web systems. The data set used for carrying out the training came from CSIC 2000. The algorithms tested were: J48, Naive Bayes,
OneR, Random Forest, and IBM LGBM algorithms were tested. The paper reveals that IBM was the best in all metrics when
compared to others in the literature.

Kambourakis et al. [11] introduced MECSA, an open-source web application service designed for individuals who wish to
promptly evaluate their email provider's security status of their email provider's security status in terms of the adoption rate of email
security extensions, such as transport layer security (STARTTLS), Sender policy framework (SPF), Domain keys Identified Mail
(DKIM), Domain-based Message Authentication, Reporting and Conformance ( DMARC) and Strict Transport Security” and is a
security mechanism for SMTP servers (MTA-STS). This assessment covers both inbound and outbound communication channels in
a voluntary, privacy-preserving, and non-intrusive manner. The research primarily focuses on the communication between SMTP
servers (MTA-to-MTA) and email security concerns such as the need for confidentiality, integrity, and authenticity of email
messages.

On the other hand, Kubota et al. [12] presented a framework that scrutinizes callback functions to identify vulnerable
sections when an application is in execution. Unlike Web Application Firewalls (WAFs), this framework has the capability to
pinpoint vulnerabilities in callback functions. This is significant because even if countermeasures are applied to a specific attack
request, there's a possibility of attacks bypassing the WAF. With this proposed framework, it's possible to detect vulnerable source
code and subsequently implement measures to fortify it or substitute it with a secure version. The framework has demonstrated
effectiveness in addressing two critical vulnerabilities: authentication leaks and SQL injection vulnerability.

3 METHOD
This paper analyzed recent research papers spanning the last four years in web application security, aiming to provide a
comprehensive guide for security administrators and individuals involved in safeguarding web browsers and applications. It
categorized these papers by web attacks and consolidated valuable recommendations for reference. The examination encompassed
emerging trends and recommended practices from recent papers focused on web application security, with the primary goal of
offering an informative and applicable resource for security administrators and those responsible for web browser and application
security. Papers were categorized into web attacks and defense strategies, extracting valuable recommendations for practical
implementation.
The following characteristics were used for inclusion and exclusion criteria in the literature search on major Information
Systems and Technology databases including but not limited to Google Scholar, ACM Digital Library, and IEEE Xplore.

The inclusion and exclusion criteria were devised to refine the literature search and ensure that selected papers aligned with
the specific objectives of this analysis on web application security. These criteria aimed to identify papers offering a comprehensive
exploration of attack classifications, vulnerabilities, and practical recommendations for mitigating web attacks. The background for
inclusion and exclusion criteria is outlined below.

Digit. Threat.: Res. Pract.

 For inclusion criteria, papers were selected if they had an attack classification, mentioned the type of vulnerabilities
addressed, provided recommendations for mitigating attacks, focused on essential security properties of web applications,
structured the body of knowledge related to web application security testing, covered recent attacks against web applications,
explored new security measures and technologies for protecting web applications, and were published in the last four years (2018-
2022).

Exclusion criteria were applied to papers that did not address the security properties of web applications, did not review web
application security testing methods, did not address common attacks against web applications, and did not explore security
measures for web applications. An initial search using the search terms 'web application security,' 'web security,' and 'security of
web application' between 2018-2022 revealed more than 200k pieces of literature. After a review of over 50 papers, the selection
was narrowed to these eight insightful papers. These eight papers were chosen based on their alignment with these inclusion
criteria, ensuring a focus on recent and relevant research within the defined timeframe but not exhausting the list of other literature
that meets the inclusion criteria. The exclusion criteria further filtered out papers that did not meet the specified criteria.

However, it's important to note that the reviewed papers may not provide a representative sampling of all classifications of
web attacks, as illustrated in Figure 1. This limitation arises because the inclusion criteria were designed to prioritize certain aspects
of web application security, such as attack classifications, vulnerabilities, and practical recommendations for mitigating attacks. The
sample papers reviewed were also chosen as a convenient sample. The inclusion criteria, while comprehensive, might lead to a bias
towards specific aspects of web application security, potentially overlooking other classifications. Researchers should acknowledge
this limitation and consider it when interpreting the findings, recognizing the need for future studies to address potential gaps in
representation.

Fig. 1. Classification of web attacks [8]

I recommend M. Khari, “Comprehensive study of web application attacks and classification,” 2016. For a more
comprehensive overview of the classification of Web Application Security.

Digit. Threat.: Res. Pract.

Fig. 2. Defenses against Web Application Attacks [7]

4 RESULTS
Table 1. shows a review of some journal/conference articles in the last 4 years (2018- 2022) and their recommendations on
web security.

Table 1: Results

Table 1: Literature and recommendations for defense

Authors Attack Vulnerability Recommendations for Defense

classification

Fu, Z. et al., (2018) Authentication Expired certificates and or self- Shortening the validity period will greatly improve web security
based attack signed can lead to compromises by requiring administrators to update and verify their certificates
on web security leading to more often. Web service applications should use a certificate
potential vulnerabilities that can insisted by a trusted CA. Self-assigned certificates when they are
be exploited by cyberattackers. used for economy or convenience should have a shorter validity
period.

Muzaki, O. et al., (2020) Client-side attack/ Implement WAF through MOD security with reverse proxy
command Cross-site scripting (XSS) SQL
execution attack injection on the webpage of the
web application and
unauthorized vulnerability web
scanning

Yadav, D. et al, (2018) Client-side attack/ Web applications are unable to

Parameters inputted be checked for their validity based on their
command check the appropriate inputs for
data types, and length of fields. The legality of the parameters is
execution attack the request. Due to this
checked by patterns and values for the presence of null values,
vulnerability attackers can take
duplicate values, etc. For database security, they recommend
undue advantage by entering
avoiding creating a database on the server in which the
malicious information in the
application is installed as administrator, storing files and backup
application bypassing the
information in an encrypted format, and implementing firewalls.
security of the website

Digit. Threat.: Res. Pract.

 Liang et al., (2018) Authentication Secure, practical, and user- A U- disk is used as a security token used to authenticate users
based attack / controlled framework for and enhance security. The key is stored in the U-disk rather than
information mitigating the leakage of on the computer or server. In addition, secure web builds a secure
disclosure sensitive data. secure web environment through the browser extension. The encryption and
protects users' passwords and decryption process are implemented by a stub program on the
aims to provide a unified user's local computer. A password manager (SecurePWD)
protection solution to diverse combined with a Document Object Model (DOM) is used to
sensitive data achieve security and ensure availability. The malicious client-
side code can steal a user's data if the secure environment module
is not isolated from the application code. So SecureWeb handles
this by a technique called " Shadow DOM" which can isolate the
application DOM.

Client-side Vulnerabilities leading to web The SQLCHECK, Amnesia, and libAnomaly were mentioned as
attack/ command code injection attacks having been extensively tested and are more accurate. The
execution attack authors recommend improving the accuracy of the experimental
Mitropoulos, P. et al.
testing of new mechanisms and code availability because in
(2019)
many cases researchers do not provide results on false positives
and false negatives for their mechanisms and worse still do not
quantify them.
Ibarra-Fiallos et al. (2021) Client-side Weaknesses in web They proposed a security measure offering 98.4% accuracy that
attack/ command applications that make them will filter of input fields based on OWASP stinger, a set of
execution attack susceptible to injection regular expressions, and a sanitization process. This
attacks. implementation validates all the data that comes in an HTTP
request (headers and parameters) with a fair regular expression
for each field (only what is expected) and sanitized common
words used in injection attacks. This filter has better accuracy
than WAF.
Agreindra Helmiawan et Information Weaknesses resulting in
al. (2020) disclosure/ exposure to sensitive data,
authorization-based injection, and open ports.
attack
The authors recommend implementing security such as closing
ports or adding SSH security and logging on open ports. And also,
to add logging and monitoring to be able to view the history
access and activities that occur on the website

Conde Camillo da Silva et Command and Vulnerabilities that can be

al. (2022) execution exploited by normal and The paper reveals that IBM LGBM algorithm was the best in all
attacks. All abnormal attack requests metrics when compared to algorithms used to model attack
attacks listed in request for instruction detection in the literature.
the classification
of web attacks

5 OBSERVATION/ ANALYSIS
Scholarly analysis reveals that a substantial focus has been directed towards addressing client-side command and execution attacks
on web applications, as illustrated in Figure 1. This concentration stems largely from the prevalence of web code injection attacks
among various types of attacks over the past four years. Despite the development of numerous mechanisms aimed at mitigating
these attacks, particularly those falling under the etiological category as shown in Figure 2, it is noteworthy that many of these
mechanisms still possess vulnerabilities that allow for bypassing.
Therefore, there should be a heightened emphasis on the precision of detection methods and the adoption of multiple
security measures, alongside intrusion detection systems like Web Application Firewalls (WAFs) and other strategies proposed by
the authors reviewed in this paper. With the continuous proliferation of web applications and the growing imperative to secure them
against malicious attacks, researchers must redouble their efforts to devise more efficient and effective methods for web application
security.

This concise review of recent literature has highlighted some well-established, accurate, and robust security mechanisms that
can be effectively combined to protect web applications. Industries and organizations should proactively adopt modern security
protocols like TLS 1.3 and implement a comprehensive suite of security measures as outlined in this paper, along with routine
security patch updates.

Digit. Threat.: Res. Pract.

6 CONCLUSION
As technology continues to advance in the realm of web application security, it is evident that attackers are also evolving their
methods. Consequently, the imperative before us is to implement well-established and quantifiable security defense measures to
safeguard web applications.
The primary contribution of this paper lies in its provision of recent research recommendations, offering valuable insights to
web security researchers and practitioners seeking the most accurate security mechanisms for web applications. Furthermore, it puts
forth suggestions for further research, both in the etiological domain and concerning client-side/command and execution attacks.
Ultimately, this paper contributes to the ongoing pursuit of effective web security measures for the protection of web applications.
All limitation arising from the small sample of literature reviewed is acknowledged. Future research will review more literature to
update the list until a comprehensive framework of recommendation is achieved.

REFERENCES
[1] [Link] Feb. 6, 2023).
[2] [Link] (accessed Feb. 6, 2023
[3] P. Fu, Z. Li, G. Xiong, Z. Cao, and C. Kang, “SSL/TLS Security Exploration Through X.509 Certificate’s Life Cycle Measurement,” in 2018 IEEE Symposium on Computers and
Communications (ISCC), Jun. 2018, pp. 00652– 00655. doi: 10.1109/ISCC.2018.8538533.
[4] R. A. Muzaki, O. C. Briliyant, M. A. Hasditama, and H. Ritchi, “Improving Security of Web-Based Application Using ModSecurity and Reverse Proxy in Web Application
Firewall,” in 2020 International Workshop on Big Data and Information Security (IWBIS), Oct. 2020, pp. 85–90. doi: 10.1109/IWBIS50925.2020.9255601.
[5] D. Yadav, D. Gupta, D. Singh, D. Kumar, and U. Sharma, “Vulnerabilities and Security of Web Applications,” in 2018 4th International Conference on Computing Communication
and Automation (ICCCA), Greater Noida, India, Dec. 2018, pp. 1–5. doi:10.1109/CCAA.2018.8777558.
[6] S. Liang, Y. Zhang, B. Li, X. Guo, C. Jia, and Z. Liu, “Secureweb: Protecting sensitive information through the web browser extension with a security token,” Tsinghua Sci.
Technol., vol. 23, no. 5, pp. 526–538, Oct. 2018, doi: 10.26599/TST.2018.9010015.
[7] D. Mitropoulos, P. Louridas, M. Polychronakis, and A. D. Keromytis, “Defending Against
[8] Web Application Attacks: Approaches, Challenges and Implications,” IEEE Trans. Dependable Secure Comput., vol. 16, no. 2, pp. 188–203, Mar. 2019, doi:
10.1109/TDSC.2017.2665620.
[9] S. Ibarra-Fiallos, J. B. Higuera, M. Intriago-Pazmino, J. R. B. Higuera, J. A. S. Montalvo, and J. Cubo, “Effective Filter for Common Injection Attacks in Online Web Applications,”
IEEE Access, vol. 9, pp. 10378–10391, 2021, doi: 10.1109/ACCESS.2021.3050566.
[10] M. Agreindra Helmiawan, E. Firmansyah, I. Fadil, Y. Sofivan, F. Mahardika, and A. Guntara, “Analysis of Web Security Using Open Web Application Security Project 10,” in 2020
8th International Conference on Cyber and IT Service Management (CITSM), Pangkal Pinang, Indonesia, Oct. 2020, pp. 1–5. doi:10.1109/CITSM50537.2020.9268856.
[11] R. Conde Camillo da Silva, M. P. Oliveira Camargo, M. Sanches Quessada, A. Claiton Lopes, J. Diassala Monteiro Ernesto, and K. A. Pontara da Costa, “An Intrusion Detection
System for Web-Based Attacks Using IBM Watson,” IEEE Lat. Am. Trans., vol. 20, no. 2, pp. 191– 197, Feb. 2022, doi: 10.1109/TLA.2022.9661457.
[12] G. Kambourakis, G. D. Gil, and I. Sanchez, “What Email Servers Can Tell To Johnny: An Empirical Study of Provider-to-Provider Email Security,” IEEE Access, vol. 8, pp.
130066–130081, 2020, doi: 10.1109/ACCESS.2020.3009122.
[13] K. Kubota, W. K. K. Oo, and H. Koide, “A New Feature to Secure Web Applications,” in 2020 Eighth International Symposium on Computing and Networking Workshops
(CANDARW), Naha, Japan, Nov. 2020, pp. 334–340. doi: 10.1109/CANDARW51189.2020.00071.

Digit. Threat.: Res. Pract.

View publication stats