ライブラリ登録: Guest
Begell Digital Portal Begellデジタルライブラリー 電子書籍 ジャーナル 参考文献と会報 リサーチ集
Journal of Automation and Information Sciences
SJR: 0.275 SNIP: 0.59 CiteScore™: 0.8

ISSN 印刷: 1064-2315
ISSN オンライン: 2163-9337

巻:
巻 52, 2020 巻 51, 2019 巻 50, 2018 巻 49, 2017 巻 48, 2016 巻 47, 2015 巻 46, 2014 巻 45, 2013 巻 44, 2012 巻 43, 2011 巻 42, 2010 巻 41, 2009 巻 40, 2008 巻 39, 2007 巻 38, 2006 巻 37, 2005 巻 36, 2004 巻 35, 2003 巻 34, 2002 巻 33, 2001 巻 32, 2000 巻 31, 1999 巻 30, 1998 巻 29, 1997 巻 28, 1996

Journal of Automation and Information Sciences

DOI: 10.1615/JAutomatInfScien.v51.i6.60
pages 61-65

Method of Developing a Web-Application Firewall

Rustam Kh. Khamdamov
Scientific Innovation Center of Information and Communication Technologies of Muhammad al-Khwarizmi Tashkent University of Information Technologies, Uzbekistan
Komil F. Kerimov
Muhammad al-Khwarizmi Tashkent University of Information Technologies, Tashkent (Uzbekistan)
Jalol Oybek ugli Ibrahimov
Muhammad al-Khwarizmi Tashkent University of Information Technologies, Uzbekistan

要約

The development of web-resources indicates that there are no uniform standards for the development of secure web-applications, which may lead to bugs and vulnerabilities in web-applications. A vulnerable web-application can be easily hacked without using specialized tools, only using a browser. In the world there is a huge number of web-applications running PHP. Information security threats are so diverse that traditional remedies are not always effective. Based on a comprehensive analysis of security threats for web-applications, a PHP-based web-application firewall has been proposed. The developed web-application firewall consists of four subsystems: a threat detection subsystem, an audit subsystem, a configuration subsystem, and an interactive subsystem. Each subsystem performs certain functions to protect the web-application from information security threats. The proposed solution works as a proxy server and checks all incoming traffic to the web-application, which allows one to control fully all incoming requests. If destructive requests are detected, they are blocked, and the administrator is notified of the current attack on the web-application. Test results show that the firewall can effectively block various malicious attacks at the application level, such as SQL injection, remote code execution (RCE), cross-site scripting (CSS), cross-site request forgery (CSRF); remote file inclusion (RFI); local file inclusion (LFI); Auth Bypass−bypass authorization, Brute Force−selection of passwords, etc., as well as comprehensively protect web-applications.

参考

  1. Pazizin S.V., Fundamentals of information security in computer systems [in Russian], TVP-OpiPM, Moscow, 2003. .

  2. Petrenko S.A., Petrenko A.A., Intranet security audit, DMK Press, Moscow, 2002. .

  3. Rzhavskiy K.V., Information security: practical protection of information technologies and telecommunication systems: Tutorial [in Russian], VolGU, Volgograd, 2002. .

  4. SemkinS.N., Belyakov E.V., Grebenev S.V., etal., Fundamentals of organizational support of information security of informatization objects, [in Russian], Gelios ARV, Moscow, 2005. .

  5. KhorevP.B., Methods and means of information protection in computer systems [in Russian], Gelios, Moscow, 2006. .

  6. Kondrashova N.V., Matching of external criterion and method of sample partitioning for solving problem of structural-parametric identification by group method of data handling, Mezhdunarodnyi nauchno-tekhnicheskiy zhurnal "Problemy upravleniya i informatiki", 2015, No. 5, 20-33. .

  7. Opanasenko V.N., Kryvyi S.L., Synthesis of adaptive logical networks on the basis of Zhegalkin polynomials, Cybernetics and Systems Analysis, 2015, 51, No. 6, 969-977, DOI: 10.1007/s10559-015-9790-1. .


Articles with similar content:

Comprehensive Review on Magnetic Resonance Imaging in Alzheimer's Disease
Critical Reviews™ in Biomedical Engineering, Vol.44, 2016, issue 3
Olga Dona, Cheryl Druchok, Jeff Thompson
A Scale-Consistent Approach to Image Completion
International Journal for Multiscale Computational Engineering, Vol.6, 2008, issue 6
Michal Holtzman-Gazit, Irad Yavneh
Methods of Blocking Vulnerabilities of XSS Type Based on the Service Oriented Architecture
Journal of Automation and Information Sciences, Vol.51, 2019, issue 12
Rustam Kh. Khamdamov , Komil F. Kerimov
ANALYSIS OF ICI CANCELLATION IN MC-CDMA SYSTEM USING SELF-CANCELLATION AND EXTENDED KALMAN FILTER METHOD
Telecommunications and Radio Engineering, Vol.76, 2017, issue 7
S. Nandakumar, V. Noor Mohammed, S. K. Jayanth Prabu, M. Lakshmanan, M. Palanivelan, T. Velmurugan
Mathematical Model of a Digital Image in the JPEG Format
Telecommunications and Radio Engineering, Vol.65, 2006, issue 11-15
V. A. Baranov, O. V. Gatilov