Policy-enhanced ANFIS model to counter SOAP-related attacks

摘要

Business Intelligence or e-commerce applications are increasingly built on the Web Service platform. Thus, SOAP-related attacks have a higher chance of occurring at the Application Layer. Although active research has been on-going in Host and Network-based intrusion detection and intrusion prevention areas, they are not adequate to countermeasure the attacks occurring at the Application Layer. This is detrimental, especially for e-commerce where sensitive and huge amount of business-related information are being exposed over the Internet. Consequently, in this paper, a policy-enhanced fuzzy model with adaptive neuro-fuzzy inference system features is introduced. Transactions generated by simulation reveal that SOAP-related attacks at the Application Layer can be detected and prevented by validating input values, input field lengths, and SOAP size using our model to classify the possibilities of granting or denying access to the backend application or database. Restricting the inputs using business policies further strengthens the model to be able to achieve detection accuracy of 99% and false positive rate of only 1%. Thus, our model has significantly contributed to an added layer of security protection for Web Service-based e-commerce applications.