Leveraging Signature Patterns and Machine Learning for Detecting HTTP Header Manipulation Attacks

Abstract

Hypertext Transfer Protocol (HTTP) injection is a security vulnerability in which attackers manipulate HTTP Headers for malicious intent which facilitate various types of attacks like Downgrade-attack, Session fixation, Session hijacking, Cross-site scripting (XSS), Script injection, Referer forgery, Host header injection and Cache poisoning. These HTTP header manipulations can also be used for phishing and malware attacks. This study proposes leveraging signature attack patterns enhanced with Machine Learning (ML) and Deep Learning (DL) for detection of malicious header. HTTP request headers will be intercepted using Mitmproxy, and known attacks such as Downgrade attacks, Session fixation, Session hijacking, Token manipulation, Script injection will be detected based on their unique signatures. Malicious Internet Protocol (IP) addresses in the headers are detected using a blacklist sourced from the IPsum GitHub repository. Additionally, the malicious classifier model utilizes a hybrid approach for feature extraction based on Natural Language Processing (NLP) and traditional methods followed by generation of adversarial samples using Generative Adversarial Network (GAN). Multiple supervised ML and DL models are employed to classify URLs as phishing, malware, or benign and detect the specific attack type such as Referer forgery, Host header injection and other malware-related activities. The dataset is sourced from trusted repositories like Phishing URL dataset by Mendeley, Malicious URLs dataset from Kaggle and IPSum GitHub repository to construct a curated dataset. Adversarial samples generated using GAN are augmented in the dataset used for training the model to make it resistant to adversarial attack. The detection of Malicious HTTP headers using the proposed model is evaluated using performance metrics.