[Submitted on 26 Mar 2024]

View a PDF of the paper titled Fingerprinting web servers through Transformer-encoded HTTP response headers, by Patrick Darwinkel

View PDF
HTML (experimental)

Abstract:We explored leveraging state-of-the-art deep learning, big data, and natural language processing to enhance the detection of vulnerable web server versions. Focusing on improving accuracy and specificity over rule-based systems, we conducted experiments by sending various ambiguous and non-standard HTTP requests to 4.77 million domains and capturing HTTP response status lines. We represented these status lines through training a BPE tokenizer and RoBERTa encoder for unsupervised masked language modeling. We then dimensionality reduced and concatenated encoded response lines to represent each domain’s web server. A Random Forest and multilayer perceptron (MLP) classified these web servers, and achieved 0.94 and 0.96 macro F1-score, respectively, on detecting the five most popular origin web servers. The MLP achieved a weighted F1-score of 0.55 on classifying 347 major type and minor version pairs. Analysis indicates that our test cases are meaningful discriminants of web server types. Our approach demonstrates promise as a powerful and flexible alternative to rule-based systems.

Submission history

From: Patrick Darwinkel BSc [view email]
[v1]
Tue, 26 Mar 2024 17:24:28 UTC (2,574 KB)



Source link