Architecting Web Service Attack Detection Handlers

There is a wealth of research on web service attack types and different techniques to mitigate them. However, there is little discussion on reusable methods for implementing these known techniques. In this paper, we introduce two handler architectures that can be reused to implement a broad set of known attack countermeasures. While structurally similar, the architectures differ in the information they require for attack detection, in the needed changes to or restructuring of the message and its content, and in their invocation order among other handlers deployed on the application server and used by the web service. We present the handler architecture designs and how they address the specific web service attack types. We discuss the benefits of their attachment to the Web service. Also, we cover their implementation and deployment details on a JBoss application server and provide a case study to document the results of test runs.