Host-Based IDS for Detecting Web Application Attacks on Open Journal Systems

With the increasing number of web application attacks, there is a growing need for effective intrusion detection systems. This thesis focuses on developing a host-based IDS for detecting web application attacks on Open Journal Systems (OJS). The system utilizes machine learning algorithms to identify and classify potential threats, ensuring the security and integrity of the OJS platform.

Project Overview

This research explores the development of a passive Host-Based Intrusion Detection System (HIDS) for Open Journal Systems (OJS), designed to help identify potentially malicious web activity through server-side log analysis. The system monitors Nginx access logs, extracts relevant features from HTTP requests, and uses a machine learning model to distinguish normal activity from common web attacks such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), PHP Object Injection (POI), and Remote Code Execution (RCE). Rather than interfering with incoming requests like a WAF or IPS, the IDS operates passively after requests are processed and logged, providing security monitoring and detection without becoming part of the application's request path. This research resulted in the development of a machine learning powered prototype that can be further integrated into a web dashboard for real-time monitoring.

Technical Implementation

A dataset generation process was conducted to create a comprehensive collection of Nginx access logs representing both normal and malicious HTTP requests for Open Journal Systems. In this research, there were 5 types of attacks that were simulated, including Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), PHP Object Injection (POI), and two different Remote Code Executions (RCE). Those attacks were chosen because they are still relevant in a few of the latest Open Journal Systems versions. The attacks are simulated manually before it is turned into a script that can be used for automated request generation. Then the python scripts were executed to send requests containing payloads to the OJS server with Nginx as the web server. Nginx's access logs were then collected and labeled as either normal or malicious based on the ground truth from each of the request.

Prototype Flow Diagram

The HIDS prototype is then implemented using Python and leverages machine learning libraries such as scikit-learn for model training and evaluation using the generated dataset. The system processes Nginx access logs, extracting features such as request method, URL patterns, user-agent strings, and response codes. These features are then used to train a classification model capable of identifying normal requests versus malicious ones. The trained model and preprocessing steps are integrated into one, becoming the HIDS prototype. The prototype continuously monitors incoming log entries and flags suspicious activity for further investigation in near real-time as soon as new log entries are available.