Smart XSS Attack Surveillance System for OSN in Virtualized Intelligence Network of Nodes of Fog Computing

Smart XSS Attack Surveillance System for OSN in Virtualized Intelligence Network of Nodes of Fog Computing

Shashank Gupta (Department of Computer Engineering, National Institute of Technology, Kurukshetra, Haryana, 136119, India) and B. B. Gupta (Department of Computer Engineering, National Institute of Technology Kurukshtra, Kurukshtra, India)
Copyright: © 2017 |Pages: 32
DOI: 10.4018/IJWSR.2017100101
OnDemand PDF Download:
$30.00
List Price: $37.50

Abstract

This article introduces a distributed intelligence network of Fog computing nodes and Cloud data centres for smart devices against XSS vulnerabilities in Online Social Network (OSN). The cloud data centres compute the features of JavaScript, injects them in the form of comments and saved them in the script nodes of Document Object Model (DOM) tree. The network of Fog devices re-executes the feature computation and comment injection process in the HTTP response message and compares such comments with those calculated in the cloud data centres. Any divergence observed will simply alarm the signal of injection of XSS worms on the nodes of fog located at the edge of the network. The mitigation of such worms is done by executing the nested context-sensitive sanitization on the malicious variables of JavaScript code embedded in such worms. The prototype of the authors' work was developed in Java development framework and installed on the virtual machines of Cloud data centres (typically located at the core of network) and the nodes of Fog devices (exclusively positioned at the edge of network). Vulnerable OSN-based web applications were utilized for evaluating the XSS worm detection capability of the authors' framework and evaluation results revealed that their work detects the injection of XSS worms with high precision rate and less rate of false positives and false negatives.
Article Preview

1. Introduction

1.1. Fog Computing

A new virtualized platform (i.e. Fog Computing) is developed that outspreads the infrastructure of cloud platforms to the edge of the network (Bonomi et al., 2012). Fog computing performs the computation of resources in the edge of the network (very close to the ground). It generally performs its computation between the cloud data centres and the network of smart devices. Figure 1 highlights the three-way hierarchy, that clearly highlights the devices of fog computing will be act as an intermediary nodes between the cloud data centres and the network of end smart devices (Stojmenovic et al., 2014). The arrow ‘location’ highlights the location of smart devices that are positioned at an edge (close to the ground level) of an associated network. The cloud data centres and its related applications are located at the core of the network (which is very far away from the edge of network) (Almorsy et al., 2016; Mather et al., 2009; Modi et al., 2013). The fog devices (possibly a router, a remote machine, etc.) acts as an intermediary between the distributed intelligence network of cloud data centres and smart devices.

Figure 1.

A three-level hierarchy

1.2. Cross-Site Scripting (XSS) Attack

XSS vulnerabilities are considered to be the topmost threat that have turned out to be a plague for the modern web applications like facebook, twitter, linkedIn, etc. (Gupta et al., 2015a, 2015b, 2014). Such worms steal the sensitive credentials of the active users by injecting the malicious JavaScript code in the form of some posts on such web applications. The statistics of acunetix web application vulnerability report 2015 (Acunetix Web Application Vulnerability Report, 2015) clearly reveals that nearly 38% of web sites were vulnerable to XSS attacks and falls first in the list. In addition, the statistics of 2015 website security statistics report by white hat (Website Security Statistics Report, 2015) undoubtedly discloses that XSS was a significant issue across all platforms of diverse languages utilized by modern web applications. Figure 2 illustrates the simple scenario of exploitation of XSS attack on the web server installed on the backbone of Fog device.

Figure 2.

A scenario of XSS attack on fog

Here, web server is deployed on the node of Fog computing, that acts as an intermediary between the data centres of cloud platforms and the network of smart end devices (placed at the edge of the network). The malicious smart devices can also inject the vulnerable JavaScript code on this Fog device that can also be replicated to the cloud data centres. Later on, such vulnerable piece of JavaScript code will get fetched by the smart devices network. The XSS attack will get exploited on the web browsers of smart devices on the execution of this suspicious JavaScript code (Gupta et al., 2017a, 2017b). The speciality of such vulnerable strings of JavaScript is that they simply replicate themselves onto the different adjacent nodes of Fog network and data centres of Cloud computing. Figure 3 highlights the detailed pattern of exploitation of XSS attack on the OSN web server deployed at the fog computing network. The exploitation of XSS attack will get executed on the web browser of smart devices and the credentials (cookies, password, etc.) of the victim are being re-directed to the attacker’s domain.

Figure 3.

Exploitation of XSS attack on fog devices

Complete Article List

Search this Journal:
Reset
Open Access Articles
Volume 14: 4 Issues (2017)
Volume 13: 4 Issues (2016)
Volume 12: 4 Issues (2015)
Volume 11: 4 Issues (2014)
Volume 10: 4 Issues (2013)
Volume 9: 4 Issues (2012)
Volume 8: 4 Issues (2011)
Volume 7: 4 Issues (2010)
Volume 6: 4 Issues (2009)
Volume 5: 4 Issues (2008)
Volume 4: 4 Issues (2007)
Volume 3: 4 Issues (2006)
Volume 2: 4 Issues (2005)
Volume 1: 4 Issues (2004)
View Complete Journal Contents Listing