A general framework for adaptive and online detection of web attacks

ABSTRACT

Detection of web attacks is an important issue in current defense-in-depth security framework. In this paper, we propose a novel general framework for adaptive and online detection of web attacks. The general framework can be based on any online clustering methods. A detection model based on the framework is able to learn online and deal with "concept drift" in web audit data streams. Str-DBSCAN that we extended DBSCAN to streaming data as well as StrAP are both used to validate the framework. The detection model based on the framework automatically labels the web audit data and adapts to normal behavior changes while identifies attacks through dynamical clustering of the streaming data. A very large size of real HTTP Log data collected in our institute is used to validate the framework and the model. The preliminary testing results demonstrated its effectiveness.

REFERENCES

• 1: M. Ester. A density-based algorithm for discovering clusters in large spatial databases with noise. In KDD, 1996.
• 2: K. Ingham and H. Inoue. Comparing anomaly detection techniques for http. In 10th International Symposium on Recent Advances in Intrusion Detection, 2007.
• 3: Xiangliang Zhang , Cyril Furtlehner , Michèle Sebag, Data Streaming with Affinity Propagation, Proceedings of the European conference on Machine Learning and Knowledge Discovery in Databases - Part II, September 15-19, 2008, Antwerp, Belgium [doi>10.1007/978-3-540-87481-2_41]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

General Terms:
Algorithms, Experimentation, Measurement, Security

Keywords:
anomaly detection, clustering, intrusion detection