Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> Cross Site Request Forgery (CSRF) has emerged as a potent threat to Web 2.0 applications. Because of the stateless nature of the HTTP protocol, a malicious website can force the user's browser to send unauthorized requests to a trusted site. This demo provides hands on exposure of the various ways in which some popular web applications are exploited using CSRF, in addition to demonstrating techniques by which CSRF signatures can be detected and attacks effectively resisted even before initiation. The user needs only to install a simple extension to get notified about potential CSRF vulnerabilities. Because validating the Referer Header is a common CSRF prevention method, a novel solution to the Referer Privacy issue will also be demonstrated. <s> BIB001 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> This essay proposes a new cross heterogeneous domain authentication model mainly based on PKI, and designs the details of authentication processes in different situations. The model achieves cross domain authentication between PKI domain and Kerberos domain effectively, and supports mutual authentications. Theoretical analysis shows that the proposed scheme has good compatibility, expansibility and reliability. Therefore, this model is suitable for using in large-scale network environment mainly based on PKI. <s> BIB002 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> Context: Cross site scripting (XSS) vulnerability is among the top web application vulnerabilities according to recent surveys. This vulnerability occurs when a web application uses inputs received from users in web pages without properly checking them. This allows an attacker to inject malicious scripts in web pages via such inputs such that the scripts perform malicious actions when a client visits the exploited web pages. Such an attack may cause serious security violations such as account hijacking and cookie theft. Current approaches to mitigate this problem mainly focus on effective detection of XSS vulnerabilities in the programs or prevention of real time XSS attacks. As more sophisticated attack vectors are being discovered, vulnerabilities if not removed could be exploited anytime. Objective: To address this issue, this paper presents an approach for removing XSS vulnerabilities in web applications. Method: Based on static analysis and pattern matching techniques, our approach identifies potential XSS vulnerabilities in program source code and secures them with appropriate escaping mechanisms which prevent input values from causing any script execution. Results: We developed a tool, saferXSS, to implement the proposed approach. Using the tool, we evaluated the applicability and effectiveness of the proposed approach based on the experiments on five Java-based web applications. Conclusion: Our evaluation has shown that the tool can be applied to real-world web applications and it automatically removed all the real XSS vulnerabilities in the test subjects. <s> BIB003 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> Cross-site scripting (XSS) vulnerabilities are among the most common and serious web application vulnerabilities. It is challenging to eliminate XSS vulnerabilities because it is difficult for web applications to sanitize all user input appropriately. We present Noncespaces, a technique that enables web clients to distinguish between trusted and untrusted content to prevent exploitation of XSS vulnerabilities. Using Noncespaces, a web application randomizes the the (X)HTML tags and attributes in each document before delivering it to the client. As long as the attacker is unable to guess the random mapping, the client can distinguish between trusted content created by the web application and untrusted content provided by an attacker. To implement Noncespaces with minimal changes to web applications, we leverage a popular web application architecture to automatically apply Noncespaces to static content processed through a popular PHP template engine. We design a policy language for Noncespaces, implement a training mode to assist policy development, and conduct extensive security testing of a generated policy for two large web applications to show the effectiveness of our technique. <s> BIB004 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> Web applications are now part of day to day life due to their user friendly environment as well as advancement of technology to provide internet facilities, but these web applications brought lot of threats with them and these threats are continuously growing, one of the these threat is Cross Site Request Forgery(CSRF). CSRF attack is immerged as serious threat to web applications which based on the vulnerabilities present in the normal request response pattern of HTTP protocol. It is difficult to detect and hence it is present in most of the existing web applications. CSRF attack occurs when a malicious web site causes a user's web browser to perform an unwanted action on a trusted site. It is listed in OWASP's top ten Web Application attacks list. In this survey paper we will study CSRF attack, CSRF vulnerabilities and its defensive measures. We have compared various defense mechanisms to analyse the best defense mechanism. This study will help us to build strong and robust CSRF protection mechanism. <s> BIB005 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> The Scripting languages (mostly JavaScript) applications in the network are heavily used to improve the user experience now. The trends make XSS (Cross-site Scripting Attacks) the most serious security problems in the current Internet. A XSS defensive scheme based on behavior certification is proposed in the paper. The website behavior model is generated based on the website logic and the user behavior. The browsing behavior certification is implemented based on the expected behavior of the resulting model, so as to offer security for the client even in the case that web server has suffered XSS attacks. <s> BIB006 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> The number of Internet users is dramatically increased every year. Most of these users are exposed to the dangers of attackers in one way or another. The reason for this lies in the presence of many weaknesses that are not known for ordinary users. In addition, the lack of user awareness is considered as the main reason for falling into the attackers' snares. Cross Site Request Forgery (CSRF) has placed in the list of the most dangerous threats to security in OWASP Top Ten for 2013. CSRF is an attack that forces the user's browser to send or perform unwanted request or action without user awareness by exploiting a valid session between the browser and the server. When CSRF attack success, it leads to many bad consequences. An attacker may reach private and personal information and modify it. This paper aims to detect and prevent a specific type of CSRF, called reflected CSRF. In a reflected CSRF, a malicious code could be injected by the attackers. This paper explores how CSRF Detection Extension prevents the reflected CSRF by checking browser specific information. Our evaluation shows that the proposed solution is successful in preventing this type of attack. <s> BIB007 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> DOM-based cross-site scripting (XSS) is a client-side vulnerability that pervades JavaScript applications on the web, and has few known practical defenses. In this paper, we introduce DEXTERJS, a testing platform for detecting and validating DOM-based XSS vulnerabilities on web applications. DEXTERJS leverages source-to source rewriting to carry out character-precise taint tracking when executing in the browser context—thus being able to identify vulnerable information flows in a web page. By scanning a web page, DEXTERJS produces working exploits that validate DOM-based XSS vulnerability on the page. DEXTERJS is robust, has been tested on Alexa’s top 1000 sites, and has found a total of 820 distinct zero-day DOM-XSS confirmed exploits automatically. <s> BIB008 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> Abstract This paper presents a context-sensitive sanitization based XSS defensive framework for the cloud environment. It discovers all the hidden injection points in HTML5-based web applications deployed on the platforms of cloud and sanitizes the XSS attack payloads injected in such points in a context sensitive manner. The identification of such injection points permits our technique to retrieve each possible web page of application, allowing a wider exploration and accelerating the process of applying the sanitizers on the untrusted variables of web application. The XSS attack mitigation capability of our framework was evaluated on web applications deployed for the cloud users in the cloud environment. The experimental results reveal that this technique detects the XSS attack payloads with minimum rate of false negatives and less runtime overhead. <s> BIB009 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR WEBSITE ATTACKS IN THE MEDICAL DOMAIN <s> Abstract To thwart the virtual machines from being a victim of XSS attacks on the cloud computing environment, this paper presents an enhanced XSS defensive methodology for the cloud platforms. This framework initially scans the HTTP requests for the embedded URI links that points towards the links of external JS files and which may contain malicious XSS payload. Our design also explores the HTTP response for extracting the script content and compares this content with the script content retrieved from the URI links. Any resemblance observed in both these extracted set of scripts would be considered as malicious XSS worm. The testing and evaluation of our framework was done on tested bed of real world web applications by injecting the XSS attack payloads on their vulnerable injection points. Evaluation results revealed that our framework detects the XSS attack vectors with fewer rates of false negatives and false positives. <s> BIB010
Several state-of-the-art solutions are provided to handle website attacks in the medical domain presented in Table 6 . Shar and Tan BIB003 developed a tool called safer XSS to detect and prevent server-side and client-side XSS attacks in real time. It uses five specific experiments to ensure the tool's effectiveness for detecting and addressing XSS attacks in real time. However, it cannot detect and prevent Document Object Model-based XSS, and it analyzes the server side. In addition, the tool targets only Java-based web applications. Van Gundy and Chen BIB004 developed a web application framework to automatically use Noncespaces managed through a PHP template engine for static content. The article explains how to prevent the misuse of XSS vulnerabilities and helps clients distinguish between legitimate content formed by untrusted content and illegitimate web applications created by attackers. However, the framework does not have a selfprotective architecture for JavaScript code when downloading content from remotely available websites. Shahriar and Zulkernine  developed a prototype to automatically add boundaries and produce policies for Java Server Page (JSP) programs. The article evaluates the method with four JSP programs, and the approach can detect XSS attacks without amending client-driven entities. However, the proposed approach consumes considerable time in the policy examinations, and thus the attack detection capability is low. A novel server-side approach was introduced for XSS attack detection by Barhoom and Kohail  . The proposed approach uses Extensible Markup Language (XML) schema definition (XSD) and XML to enforce persuasion. The proposed solution detects injected malicious JavaScript code that breaks the rules of an input schema. However, many requirements are needed from the server side, which reduces open network performance. Parameshwaran et al. BIB008 introduced the DEXTERJS testing platform for the detection and validation of DOMbased XSS web vulnerabilities. DEXTERJS can identify vulnerabilities in an information web page. It identifies zeroday DOM XSS activities in its benchmark and tests them in the real world. However, the proposed approach cannot determine the client side's original functionality, which may contain malicious code. Cross-Site Request Forgery (CSRF) vulnerabilities and protection mechanisms were introduced by Kombade and Meshram BIB005 . The approach compares several protection mechanisms to analyze the protection mechanism. This review helps create a strong and vigorous CSRF protection mechanism. However, it does not apply specific experiments to verify the effectiveness of defensive approaches. Therefore, full protection is not available for CSRF, and these approaches should be improved. Malicious websites force the browser of the user to direct unauthorized requests to legitimate sites due to the HTTP protocol's stateless nature. Therefore, BIB001 shows some technology that can detect CSRF in some web applications. It proposes an approach in which users can install a simple extension to obtain notifications about probable CSRF vulnerabilities. However, the extension does not have a method for defending against CSRF because it only notifies users of the existence of CSRF. Scripting language (mostly JavaScript) applications are widely used to enhance user experience, but they make XSS a serious problem. Xu et al. BIB006 proposed an XSS defensive schema on behavior certification that actively fortifies the user against XSS attacks. In addition, it can support different technologies on the website such as PHP and ASP. However, its capability is limited because it is based on the expected behavior of the website or browser and produces false negative alerts. Gupta and Gupta BIB009 proposed context-sensitive purification based on an XSS protection structure in the cloud computing environment. This method can be used to detect every possible web application so that it can accelerate the use of purifiers on the illegitimated variables on web applications. The method, which has been tested in the real world, has a high degree of true positives and a low degree of false negatives. It is limited in that the method does not provide support to the web application's online social network (OSN). To prevent the virtual machine from XSS attack in the cloud environment, Gupta and Gupta BIB010 proposed an improved XSS protection procedure for cloud platforms. The approach does not need the web application's browser source code and does not modify the web browser. Additionally, it has a low false-positive rate and false negative rate. However, it does not support the OSN. Batarfi et al. BIB007 introduced an approach for preventing and detecting the reflected CSRF. The approach further demonstrates that the solution is effective for attack prevention. The approach can prevent invalid sessions and end them quickly. However, the method can detect only the reflected CSRF, and it does not protect a login CSRF attack. Yao et al. BIB002 introduced the across heterogeneous authentication model and designed the authentication process details in different circumstances.