Journals
  Publication Years
  Keywords
Search within results Open Search
Please wait a minute...
For Selected: Toggle Thumbnails
Defense strategy against browser cache pollution
DAI Chengrui, CHEN Wei
Journal of Computer Applications    2018, 38 (3): 693-698.   DOI: 10.11772/j.issn.1001-9081.2017082139
Abstract466)      PDF (1095KB)(407)       Save
Browser cache is mainly used to speed up the user's request for network resources, however, an attacker can implement cache pollution attack via man-in-the-middle attacks. The general defense strategies against browser cache pollution cannot cover different types of network attack, therefore, a controllable browser cache pollution defense strategy was proposed. The proposed strategy was deployed between the client and the server. The strategy includes random number judgement, request-response delay judgement, resource representation judgement, hash verification and crowdsourcing strategy, by which the browser cache pollution problems were effectively defended. 200 JavaScript resource files were selected as experiment samples and 100 of them were polluted via man-in-the-middle attack. By accessing these resources, defense scripts were enabled to analyze the detection rate of contaminated samples and the false positive rate of normal samples. The experimental results show that under the loose conditions, the hit rate of contaminated samples reaches 87% and false positive rate of normal samples is 0%; while under the strict conditions, the hit rate of contaminated sample reaches 95% and false positive rate of normal samples is 4%. At the same time, the request response time difference of all experimental samples is 5277ms and 6013ms respectively, which are both less than the time difference of reloading all the resources. The proposed strategy defends most of the polluted resources and shortens the time of user access. The strategy simplifies the process of cache pollution prevention, and also makes tradeoff between the security and usability with different parameters to satisfy different users.
Reference | Related Articles | Metrics