# Cyber Security of the Application Layer of Mission Critical Industrial Systems

Rafal Kozik, Michal Choraś, Rafal Renk, Witold Holubowicz

► To cite this version:

Rafal Kozik, Michal Choraś, Rafal Renk, Witold Holubowicz. Cyber Security of the Application Layer of Mission Critical Industrial Systems. 15th IFIP International Conference on Computer Information Systems and Industrial Management (CISIM), Sep 2016, Vilnius, Lithuania. pp.342-351, 10.1007/978-3-319-45378-1_31. hal-01637452

HAL Id: hal-01637452

https://inria.hal.science/hal-01637452

Submitted on 17 Nov 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Cyber Security of the Application Layer of
Mission Critical Industrial Systems

Rafał Kozik¹, Michał Choraś¹, Rafał Renk², Witold Hołubowicz¹,²

¹ Institute of Telecommunications and Computer Science, UTP University of Science and Technology in Bydgoszcz, Poland rafal.kozik@utp.edu.pl

² Adam Mickiewicz University, UAM, Poznan, Poland renk@amu.edu.pl

**Abstract.** In this paper we focus on proposing the effective methods of cyber protection of the application layer. We also discuss how this challenge is related to mission critical industrial and manufacturing systems. In this paper we propose two step HTTP request analysis method that engages request segmentation, statistical analysis of the extracted content and machine learning on the imbalanced data. In this work, we particularly addressed the segmentation technique that allows us to divide the large dataset on smaller subsets and learn the classifiers in a significantly shorter time. In our experiments we evaluated several classifiers that are popular in data mining community. The results of our experiments are obtained on a benchmark CSIC'10 HTTP dataset. The proposed approach allows us to further improve the achieved results of protecting application layer in comparison to other benchmark approaches.

**Keywords:** cyber security, anomaly detection, pattern extraction, application layer attacks, web application security

# 1 Introduction and Rationale

The problem of cyber security in the application layer is recently more severe and challenging. In fact, top-ranked network threats and attacks e.g. on the OWASP list are those targeting application layer (such as SQLIA and XSS [2]). There are many reasons for such situation such as programmers faults, software bugs but also large number of the new applications and services being launched every day, their uniqueness, lack of security standards for web applications, rapid changes in scalability etc. Another key aspect is the lack of cyber security awareness within the users and very often users are those providing access and creating security holes being the weakest link in the security chain.

On the other hand, the level of cyber security of operating systems and network protocols is constantly increasing. Therefore, for the attackers it is cheaper, easier and more effective to focus on attacks on the application layer.

In this paper we focus on the effective methods of anomaly detection in the application layer. We also discuss how cyber threats and attacks in the
application layer are related to mission critical industrial and manufacturing
systems.

This paper is structured as follows. First, we discuss the cyber security as-
pects of mission critical industrial and manufacturing systems with the focus on
the application layer. Later we provide a general overview of proposed method
 subsection 3). Then, the detailed description of request segmentation and feature
vector encoding is given (section 4). The experiments and results are given af-
terwards.

## 2 Related work

There are many solutions (called web application firewalls - WAFs), that work as
signature-based filters (e.g. set of rules) over the HTTP traffic. These signatures
usually cover common web application attacks (e.g. SQL Injection, Cross Site
Scripting, etc.). In example, the ModSecurity [3] plug-in for Apache web server
(particularly the "OWASP ModSecurity Core Rule Set – CRS") is intended to
provide defensive protection against common application layer attacks. Also the
PHPIDS [4] tool is another security measure for web applications. However,
in contrast to ModSecurity it can be integrated only with PHP-enabled web
servers. The NAXSI [5] is a third party plug-in module for high performance
Nginx [6] web server. The NAXSI stands for Nginx Anti XSS and SQL Injection
and it provides low-level rules that detect keywords (symptoms) of application
layer attacks. In contrast to ModSecurity and PHPIDS, NAXSI learns normal
application behaviour instead of attacks patterns.

In the literature there are also methods applying anomaly detection (variety
of complex schemas for learning normal/anomalous models). For instance, in [7]
authors used χ² metric and character distribution approach to detect anoma-
lous HTTP requests. In order to increase the attack detection effectiveness au-
thors used a parser that splits the request into URL address and query string
of attributes followed by values. Another approach to HTTP traffic anomaly
detection was presented in [8]. Authors applied DFA (Deterministic Finite Au-
tomaton) to compare the requests described by the means of tokens. In contrast,
in [9] authors have compared different n-grams techniques applied to application
layer anomaly detection. In the literature there are also approaches combining
n-grams with Self Organizing Maps [10], Bloom filters [11], and wide variety of
different machine-learnt classifiers [12].

## 3 Can mission critical industrial systems be targeted by
application layer cyber-attacks?

So far in computer security and critical infrastructures protection community,
the focus was on cyber protection of network protocols in the lower layers. Also,
after the successful attack on Ukrainian power system in December 2015, the
severity of such attacks is well known. Therefore, many researchers and projects
were focused on SCADA/ICS cyber protection [30–32], WSN protection etc. [33, 34].

However, mission critical cyber physical systems and critical infrastructures
can be also targeted by cyber attacks on the application layer and web ser-
vices/applications.

The cyber attacks targeting web applications are usually cross domain, mean-
ing that they are targeting information systems such as web servers or web ser-
vices, but also indirectly can impact physical infrastructures (e.g. application
controlling industrial and manufacturing processes). This happens due to the
increasing interconnectivity among different systems, but also due to the fact
that more and more institutions are adapting internet technologies to provide
new services on top of the existing infrastructure. In many cases, the legacy
systems were never expected nor designed to be connected via open network.

One example of the problems with complex interconnectivity is the Havex
worm case [1]. It used the security hole in web application of company pro-
viding software solutions for SCADA systems. The attacker was able to infect
genuine software installers that were used to manage the SCADA systems. The
infection was part of so called "water drop" attack, where the attacker wants
to remain hidden as long as possible, infecting only the interested party, in this
case electrical plants.

Another examples of the successful attacks on critical infrastructures (usually
databases and information systems) are attacks on Italian [27] and Turkish [28]
governmental databases or alleged attack that paralysed LOT Polish Airlines
[29] computer system resulting even in cancelled flights.

One of the main challenges related to the web-layer attacks is fact that those
are difficult to detect with typical signature-based approaches. Therefore, there is
a need for methods that will use the different approach. In this paper, we propose
an anomaly-based solution that analyses the content of the HTTP payload. Upon
that, data algorithm builds an model of client web browser behaviour in order
to recognize possible trials of the attack.

4 The proposed approach

The major contribution and innovation of this paper is the segmentation ap-
proach for anomaly detection in the application layer. The proposed approach is
designed to work with the typical HTTP-based, request-response web applica-
tion. In the current implementation it works as additional software supporting
web server administrator. It is an anomaly detection tool that receives HTTP
requests, analyses their content and classifies it either as normal or anomalous.
Moreover, in this approach, we do not intend to block any traffic coming from
user browser to web server. Such reaction is out of scope of our work and would
need to be realized in accordance to legal requirements and service level agree-
ments.

The general overview of information flow is presented in Fig.1.
Using the available set of HTTP requests, we apply two step segmentation.
The first step splits the large dataset into smaller pieces, so that further compu-
tations are executed in parallel. The segmentation uses a request segmentation
method described in section 4.1. It allows us to identify the possible structure of
the analysed requests. The structure is described using the sequence of tokens.

The tokens (shaded boxes in Fig.1) are used to identify clusters in our feature
space that is composed of the feature vectors extracted from the data that had
been tokenized (delimited by tokens). When each feature vector is extracted and
assigned to the appropriate cluster, we use machine-learnt classifier to assign
it to normal or anomalous class. In this research we assume that fully labelled
learning dataset is available. Therefore, we can use the supervised methods.

<figure><img src="image_2.png" /><figcaption>**Fig. 1.** The proposed two-step segmentation schema overview. The first step is a textual segmentation of similar requests. The second step is a segmentation on normal/anomalous binary class achieved with the machine-learnt classifier.</figcaption></figure>

**4.1 Request segmentation**

In our work, we have proposed the technique for HTTP request segmentation.
It engages dictionary of words to identify tokens (common character sequences)
that appear in all the analysed request sequences. In order to find such a collec-
tion of tokens we have adapted LZW compression method (Lempel-Ziv-Welch
[15, 16]) that allows us to calculate the dictionary *D* containing characters se-
quences that appear in HTTP requests. The procedure follows the algorithm 1.

This algorithm accepts a *S* set of HTTP payloads in order to produce a dictionary *D*, which will contain list of words (character sequences). The dictionary has a form of unordered list. Each position on that list can be taken only by one word. Obviously, using the dictionary *D*, one can compress the data replacing words (characters sequences) with a numbers that will correspond to the positions of that sequences in the dictionary. For efficiency reasons the *D* is implemented as a hash-table to provide *O*(1) lookup time. The algorithm for establishing dictionary iteratively scans the set *S* of payloads until all the data is processed. In each iteration a lookup string *s* is built. At the beginning, it is an "empty string" that is further extended (in each step) with a single character *ch* read from *S* set. However, the *s* lookup string is extended with *ch* only if "*s*+*ch*" is found in the dictionary. If it is not found, the dictionary *D* is updated with new word "*s* + *ch*", *s* is reduced to *ch* and the procedure starts over.

**Data:** Set of HTTP payloads *S*
**Result:** Dictionary *D*
*s* = empty string

**while** there is still data to be read in *S* **do**
> *ch* ← read a character;
> **if** (*s* + *ch*) ∈ *D* **then**
> > *s* ← *s* + *ch*;
> **else**
> > *D* ← *D* ∪ (*s* + *ch*);
> > *s* ← *ch*;
> **end**
**end**

**Algorithm 1:** Algorithm for establishing dictionary *D*.

In our experiments we only analyse the HTTP traffic. Therefore, we can
leverage two mandatory elements of the request, namely HTTP request method
(GET, POST, PUT, UPDATE, DELETE are the most frequently used ones)
and the URL address of the resources the method is executed. In result, we can
build the dictionary separately per different HTTP methods and URL addresses.

Additionally, in order to decrease the dimensionality of the feature vectors in
a given component we post-process the dictionary eliminating (removing) those
entries that are sub-sequences of other sequences. In other words, we prefer
longer tokens over shorter. Once the dictionaries are established, we identify
their positions in analysed requests. To correctly extract feature vector from
a request, we firstly must identify the correct sequence of tokens that appears
in the whole group of the analysed requests. To achieve that we use progressive
multiple sequences alignment algorithm [14]. Finally, we build the feature vectors
for each analysed HTTP request. However, we are using only those characters
that do not belong to any token.
## 4.2 Parameters encoding

In this work we have used typical approach for textual data encoding that adapts character distribution histograms (see Fig.2). However, instead of classical byte per bin association, we count the number of characters such that the decimal value in an ASCII table belongs to following ranges: < 0, 31 >, < 32, 47 >, < 48, 57 >, < 58, 64 >, < 65, 90 >, < 91, 96 >, < 97, 122 >, < 123, 127 >, < 128, 255 >. Selected ranges represent different type of symbols like numbers, quotes, letters or special characters (see Tab.1). In result our histogram will have 9 bins. This is significant dimensionality reduction in contrast to sparse 256-bin histograms (one bin per byte character).

<figure><img src="image_3.png" /><figcaption>**Fig. 2.** The high-level overview of parameter encoding approach.</figcaption></figure>

<table><caption>**Table 1.** ASCII code ranges and corresponding characters.</caption><thead><tr><th>Group</th><th>Range</th><th>Characters</th></tr></thead><tbody><tr><td>1</td><td>&lt; 0, 31 &gt;</td><td>control characters</td></tr><tr><td>2</td><td>&lt; 32, 47 &gt;</td><td>SPACE!"#$%&amp;'()*+,-./</td></tr><tr><td>3</td><td>&lt; 48, 57 &gt;</td><td>0123456789</td></tr><tr><td>4</td><td>&lt; 58, 64 &gt;</td><td>[:;&lt;=&gt;?@</td></tr><tr><td>5</td><td>&lt; 65, 90 &gt;</td><td>ABcDEFGHIJ KLMNOP QRSTUVW XYZ</td></tr><tr><td>6</td><td>&lt; 91, 96 &gt;</td><td>[\] ^_</td></tr><tr><td>7</td><td>&lt; 97, 122 &gt;</td><td>abcdefghijklmnopqrstuvwxyz</td></tr><tr><td>8</td><td>&lt; 123, 127 &gt;</td><td>{~}|</td></tr><tr><td>9</td><td>&lt; 128, 255 &gt;</td><td>special characters</td></tr></tbody></table>
<table><caption>**Table 2.** Effectiveness of the proposed approach evaluated for different classifiers</caption><thead><tr><th>Method</th><th>TP Rate</th><th>FP Rate</th><th>Precision</th><th>F-Measure</th></tr></thead><tbody><tr><td>RandomForest</td><td>0.996</td><td>0.061</td><td>0.85</td><td>0.917</td></tr><tr><td>NaiveBayes</td><td>0.944</td><td>0.037</td><td>0.899</td><td>0.921</td></tr><tr><td>AdaBoost</td><td>0.935</td><td>0.002</td><td>0.994</td><td>0.964</td></tr><tr><td>PART</td><td>0.984</td><td>0.03</td><td>0.917</td><td>0.949</td></tr><tr><td>J48</td><td>0.991</td><td>0.05</td><td>0.873</td><td>0.928</td></tr><tr><td>Our previous work</td><td>0.977</td><td>0.081</td><td>0.809</td><td>0.885</td></tr><tr><td>Nguyen (avg.) [19]</td><td>0.936</td><td>0.069</td><td>-</td><td>-</td></tr></tbody></table>

# 5 Experiments and results

For the experiments, the CSIC'10 dataset [18] was used. It contains several thousands of HTTP protocol requests which are organised in the form similar to the Apache Access Log. The dataset was developed at the Information Security Institute of CSIC (Spanish Research National Council) and it contains the generated traffic targeted to an e-Commerce web application. For convenience, the data was split into anomalous, training, and normal sets. There are over 36000 normal and 25000 anomalous requests. The anomalous requests refer to a wide range of application layer attacks, such as: SQL injection, buffer overflow, information gathering, files disclosure, CRLF injection, XSS, server side include, and parameter tampering.

Moreover, the requests targeting hidden (or unavailable) resources are also considered as anomalies. Some examples classified to this group of anomalies include client requests for: configuration files, default files or session ID in URL (symptoms of http session taking over attempt). What is more, the requests, which parameters do not have appropriate format (e.g. telephone number composed of letters), are also considered anomalous. As authors of the dataset explained, such requests may not have a malicious intention, but they do not follow the normal behaviour of the web application.

According to authors knowledge, there is no other publicly available dataset for web attack detection problem. The datasets like DARPA or KDD'99 are outdated and do not include many of the actual attacks.

The results presented in Tab.2 contain measures of the following characteristics:

- *TP Rate* - True Positive Rate indicating the percentage of detected HTTP request labelled as anomalous.

- *FP Rate* - False Positive Rate indicating the percentage of normal HTTP request labelled (wrongly) as anomalous.

- *Precision* - number of True Positives divided by sum of False Positives and True Positives.
– F-Measure - calculated according to following equation:

$$F-Measure = 2 \cdot \frac{Precision * Recall}{Precision + Recall} \qquad (1)$$

In this equation *Recall* is equivalent to *TP Rate*.

The first five rows in the Tab.2 refer to the proposed method, while the remaining two serve as a baseline for the measurements, namely our older previous approach [17] and the results reported by CSIC'10 dataset authors in [19]. For the proposed method we evaluated different classifiers. Herby we used RDomForest, NaiveBayes, AdaBoosting (with decision stumps as weak classifiers), PART, and J48 classifiers.

As it can be noticed, the proposed method allows us to achieve better precision in all cases. In case of [19] the values have not been provided by authors. In case of a PART and J48 tree classifier, we were able to improve the TPR and FPR values in comparison to our previous work and to results reported in [19].

# 6 Conclusions

In this paper we have presented the improved method of detecting attacks and anomalies in the application layer. Herby, we have proposed a two-step HTTP request segmentation. First, we apply a textual analysis of the request in order to identify the possible structure. Then, we apply feature extraction method and machine-learned classifier.

In our work we focused on HTTP request segmentation in order to obtain better effectiveness and scalability. Conducted experiments show that this approach allows us to achieve higher recognition rates of attacks while having lower rates of false positives. Moreover, the segmentation step before the classification allows us to divide dataset on smaller ones, thus decreasing the time required for learning the classifier.

The reported results have been achieved for benchmark CSIC'10 HTTP dataset. Additionally, we have compared our results with those reported by authors of the dataset. As it was presented, our modification allows us to achieve better results.

# 7 Acknowledgments

The CIPRNet project has received funding from the European Union's Seventh Framework Programme for research, technological development and demonstration under grant agreement no 312450. The European Commission's support is gratefully acknowledged.

The work is also funded by the Polish National Centre for Research and Development (NCBiR) from funds for science in the years 2013-2016, allocated for the international projects.
References

1. F-Secure. Backdoor:W32/HAVEX description https://www.f-secure.com/v-descs/backdoor_w32_havex.shtml.

2. OWASP Top 10 2013. OWASP project homepage. https://www.owasp.org/index.php/Top_10_2013-Top_10

3. ModSecurity project homepage. https://www.modsecurity.org/

4. PHPIDS project homepage. https://github.com/PHPIDS/PHPIDS

5. NAXSI project homepage. https://github.com/nbs-system/naxsi

6. NGINX project homepage. http://nginx.org/en/

7. Christopher Kruegel, Giovanni Vigna, Anomaly detection of web-based attacks, Proceedings of the 10th ACM conference on Computer and communications security, pp. 251–261, 2003

8. Ingham KL, Somayaji A, Burge J, Forrest S. Learning DFA representations of HTTP for protecting web applications. Computer Networks, 51(5), pp. 1239–1255, 2007.

9. Hadziosmanovic D, Simionato L, Bolzoni D, Zambon E, Etalle S. N-gram against the machine: On the feasibility of the n-gram network analysis for binary protocols. In Research in Attacks, Intrusions, and Defenses (pp. 354-373), 2012.

10. Bolzoni D, Zambon E, Etalle S, Hartel PH. POSEIDON: a 2-tier Anomaly-based Network Intrusion Detection System. In: IWIA 2006: Proc. 4th IEEE International Workshop on Information Assurance, pp. 144–7156, 2006.

11. Wang K, Parekh JJ, Stolfo SJ. Anagram: A content anomaly detector resistant to mimicry attack. In Recent Advances in Intrusion Detection, pp. 226–248, 2006.

12. Perdisci R, Ariu D, Fogla P, Giacinto G, Lee W. McPAD: A multiple classifier system for accurate payload-based anomaly detection. Computer networks, 53(6), pp. 864-881, 2009.

13. Lakhina A, Crovella M, Diot C. Diagnosing network-wide traffic anomalies. ACM SIGCOMM Computer Communication Review; 2004;34:357–374

14. Higgins DG, Sharp PM (1988). "CLUSTAL: a package for performing multiple sequence alignment on a microcomputer". Gene 73 (1): 237-244.

15. Welch T., A Technique for High-Performance Data Compression". In: IEEE Computer 17 69 (1984), pp. 8–19

16. Ziv J. and Lempel A., A Universal Algorithm for Sequential Data Compression. In: IEEE Transactions on Information Theory 23 (1977), pp. 337–343.

17. Kozik R., Choras M., Renk R., Holubowicz W., Patterns Extraction Method for Anomaly Detection in HTTP Traffic, in: Herrero A., Baruque B., Sedano J., Quintan H., Corchado E. (Eds), International Joint Conference CISIS’15 and ICEUTE’15, Advances in Intelligent Systems and Computing, 227-236, ISBN 978-3-319-19712-8, Springer 2015.

18. Torrano-Gimenez C., Prez-Villegas A., and lvarez G., The HTTP dataset CSIC 2010. 2010. url: http://users.aber.ac.uk/pds7/csic_dataset/csic2010http.html.

19. Nguyen H., Torrano-Gimenez C., lvarez G., Petrovic S., Franke K. Application of the Generic Feature Selection Measure in Detection of Web Attacks. In Proc. of International Workshop in Computational Intelligence in Security for Information Systems (CISIS 11 ), LNCS 6694, pp. 25–32, 2011.

20. Sharma, M., Toshniwal, D., Pre-clustering algorithm for anomaly detection and clustering that uses variable size buckets, Recent Advances in Information Technology (RAIT), 2012 1st International Conference on , vol., no., pp.515-519, 15-17 March 2012
21. Adaniya M.H.A.C., Lima M.F., Rodrigues J.J.P.C., Abrao, T., Proenca, M.L., Anomaly detection using DSNS and FireflyHarmonic Clustering Algorithm, Communications (ICC), 2012 IEEE International Conference on, vol., no., pp.1183-1187, 10-15 June 2012

22. Mazel, J., Casas, P., Labit, Y., Owezarski, P., Sub-Space clustering, Inter-Clustering Results Association and anomaly correlation for unsupervised network anomaly detection, Network and Service Management (CNSM), 2011 7th International Conference on, vol., no., pp.1-8, 24-28 Oct. 2011

23. Chun Yang, FeiqiDeng, Haidong Yang, An Unsupervised Anomaly Detection Approach using Subtractive Clustering and Hidden Markov Model, Communications and Networking in China, 2007. CHINACOM '07. Second International Conference on, vol., no., pp.313-316, 22-24 Aug. 2007

24. Hu Liang, Ren Wei-wu, Ren Fei, An Adaptive Anomaly Detection Based on Hierarchical Clustering, Information Science and Engineering (ICISE), 2009 1st International Conference on, vol., no., pp.1626-1629, 26-28 Dec. 2009

25. Pons, P., Latapy, M., Computing Communities in Large Networks Using Random Walks, Journal of Graph Algorithms and Applications, vol. 10, no.2, pp. 191-218, 2006

26. Liao, Q., Blaich, A., Van Bruggen, D., Striegel A. "Managing networks through context: Graph visualization and exploration", Computer Networks, vol. 54,pp. 2809-2824, 2010

27. Cyberattack on Italian government. http://www.lastampa.it/2015/05/19/italia/cronache/anonymous-colpisce-il-ministero-della-difesa-qlFNgswyvu20wnQiNYK1kL/pagina.html

28. Cyberattack on Turkish government. http://www.ehackingnews.com/2013/06/istanbul-special-provincial.html

29. Cyberattack on Polish Airlines LOT company http://uk.reuters.com/article/2015/06/21/uk-poland-lot-cybercrime-idUKKBNOP10WY20150621

30. Coppolino L., et al. "Enhancing SIEM technology to protect critical infrastructures." Critical Information Infrastructures Security. Springer Berlin Heidelberg, 2013. 10-21.

31. Collins S., and McCombie S. "Stuxnet: the emergence of a new cyber weapon and its implications." Journal of Policing, Intelligence and Counter Terrorism 7.1 (2012): 80-91.

32. Takagi H., et al. "Strategic security protection for industrial control systems." Society of Instrument and Control Engineers of Japan (SICE), 2015 54th Annual Conference of the. IEEE, 2015.

33. Romano L., et al. "Protecting the WSN zones of a critical infrastructure via enhanced SIEM technology." Computer Safety, Reliability, and Security. Springer Berlin Heidelberg, 2012. 222-234.

34. Formicola V., et al. "Assessing the Impact of Cyber Attacks on Wireless Sensor Nodes That Monitor Interdependent Physical Systems." Critical Infrastructure Protection VIII. Springer Berlin Heidelberg, 2014. 213-229.