Web applications allow authenticated users to perform operations such as updating profile information, modifying account settings, and managing personal resources. These operations are commonly performed through HTTP requests sent by the user's browser to the application server.
Cross-Site Request Forgery (CSRF) is a web application attack in which an attacker attempts to cause an authenticated user's browser to send an unwanted request to an application where the user is already logged in. If the application does not adequately validate the legitimacy of state-changing requests, the server may process the forged request using the victim's existing authentication session.
Individual HTTP requests may not always provide sufficient context to distinguish legitimate user activity from suspicious request sequences. An additional detection approach is to examine the order and characteristics of requests associated with an application session.
In this use case, OWASP NodeGoat is deployed within an isolated cybersecurity laboratory using Ubuntu Linux and Kali Linux virtual machines. NodeGoat provides an intentionally vulnerable Node.js web application that can be used for controlled web security testing.
A publicly available, labelled HTTP-request or web-attack dataset is investigated as the initial data source for machine-learning development. The dataset is inspected to verify whether its labels and request attributes are suitable for the intended classification task. The selected records are preprocessed and transformed into numerical representations of HTTP-request sequences.
A Bidirectional Long Short-Term Memory (BiLSTM) model is used to learn relationships within the prepared request sequences and classify them according to the categories supported by the training data.
A controlled CSRF attack is then performed against the local OWASP NodeGoat application. Nmap is used to identify and verify the expected laboratory service exposure, while Wireshark and OWASP ZAP support traffic inspection and evidence collection. The captured HTTP activity is processed through the same feature-extraction pipeline used during model development.
The trained BiLSTM model evaluates compatible request sequences. Its predictions are compared with the known laboratory test conditions to assess whether sequential HTTP-request analysis can help identify suspicious CSRF-related activity.
Application: OWASP NodeGoat
OWASP NodeGoat is an intentionally vulnerable Node.js application designed for learning and testing web application security risks.
It provides a controlled environment for investigating web vulnerabilities, including CSRF-related scenarios supported by the deployed version.
The application is hosted on Ubuntu Linux within the authorized laboratory. Kali Linux is used as the security-testing system.
Existing Problem
Web applications commonly accept state-changing requests from authenticated users. If a server does not adequately validate whether a state-changing request was intentionally initiated by the user, an attacker may attempt to make the user's browser submit a forged request.
A CSRF request may contain ordinary HTTP methods, paths, and parameters. Consequently, examining an isolated request may not provide enough context to distinguish legitimate activity from suspicious activity.
Traditional security controls, including CSRF tokens, appropriate cookie settings, and origin validation, remain essential prevention mechanisms. Machine-learning-based detection provides an additional analysis approach rather than a replacement for these controls.
The proposed solution introduces a BiLSTM-based classification layer that evaluates request sequences, followed by controlled attack validation against the local application.
Specific Attack: Controlled Cross-Site Request Forgery (CSRF) Attack
The controlled attack evaluates whether a forged request can cause an authenticated user's browser to submit an unwanted state-changing operation to the deliberately vulnerable local OWASP NodeGoat application.
The attack is performed only inside the isolated VirtualBox laboratory using a dedicated test account and non-sensitive test data.
The test scenario uses the CSRF functionality available in the deployed NodeGoat version. The resulting request and response evidence is captured for subsequent analysis.
The known attack condition is recorded separately from the model prediction so that the detection result can be evaluated objectively.
Sequential HTTP Request Analysis Using BiLSTM
The primary security concept is sequential HTTP-request classification for CSRF-related attack detection.
The project investigates whether the order and characteristics of HTTP requests provide useful information for distinguishing normal request sequences from CSRF-related activity represented in the training and evaluation data.
HTTP Request-Sequence Representation : HTTP requests are collected from the selected dataset and the controlled laboratory application. Where the source data permits it, requests are grouped into meaningful sequences using available session identifiers, timestamps, client information, or other documented attributes.
BiLSTM-Based Classification : A Bidirectional Long Short-Term Memory model processes the numerical request sequences and learns relationships between sequence elements. The model produces predictions for the classification categories represented in its training data.
Controlled CSRF Attack Validation : The trained model is tested using traffic generated during the controlled CSRF scenario. Its predictions are compared with the known laboratory test conditions and verified labels.
The security concept defines the overall detection strategy.
The following defensive mechanisms support the implementation.
HTTP requests generated during legitimate application use and controlled testing are captured for analysis.
Compatible HTTP requests are organized into sequences using the available session and timing information.
The BiLSTM model classifies request sequences according to the categories represented in the verified training data.
The same fitted preprocessing and feature-extraction pipeline is applied to training records and compatible test traffic.
Nmap identifies the expected application service and verifies its accessibility within the authorized laboratory.
Wireshark captures and examines network traffic associated with normal activity and controlled testing.
OWASP ZAP and browser developer tools are used to inspect relevant HTTP requests and responses.
The controlled CSRF scenario is compared with the model's predictions and the observed application behavior.
The classifier is evaluated against appropriate held-out data and verified labels.
OWASP NodeGoat provides the intentionally vulnerable Node.js application used for the controlled CSRF test.
Kali Linux is used as the controlled security-testing system.
Ubuntu hosts the local application and supports the Python-based detection workflow.
VirtualBox provides the isolated laboratory infrastructure.
Nmap identifies services exposed by the authorized laboratory target.
Wireshark captures and examines network packets exchanged during laboratory testing.
OWASP ZAP supports inspection of HTTP requests and responses during authorized web application testing.
Browser developer tools provide visibility into requests generated by the application and controlled test page.
Python provides the main implementation environment.
PyTorch is used to implement and train the BiLSTM model.
Pandas is used to load, inspect, filter, and organize request records and dataset metadata.
NumPy supports numerical transformations required for sequence preparation.
Scikit-learn provides dataset-splitting utilities and classification metrics.
SQLite can store request metadata, model predictions, and evaluation results.
OWASP NodeGoat is deployed within an isolated Ubuntu and Kali Linux laboratory, providing an authorized environment for controlled CSRF security testing.
Nmap is used to identify the expected laboratory application service and verify its network accessibility.
Wireshark captures network traffic associated with normal application activity and the controlled CSRF test, providing supporting evidence for traffic analysis.
A public HTTP-request or web-attack dataset is inspected to determine whether its labels and features are suitable for the proposed classification task.
The selected data is preprocessed and transformed into numerical request sequences compatible with the BiLSTM architecture.
The BiLSTM model is trained and evaluated using verified labels, and the actual classification metrics are recorded.
A controlled CSRF attack is performed against the local NodeGoat application using a dedicated test account and non-sensitive laboratory data.
The captured traffic is processed through the established feature-extraction pipeline, and compatible request sequences are evaluated by the trained BiLSTM model.
Detection results are compared with the known laboratory conditions to identify correct classifications, false positives, false negatives, and limitations in generalization.
The complete workflow demonstrates an experimental approach to BiLSTM-based sequential HTTP-request analysis for CSRF-related attack detection, combining public-data investigation, Nmap-based service discovery, Wireshark traffic capture, controlled attack simulation, machine-learning classification, and evidence-based validation.
Research Breakthrough Possible @S-Logix