Data mining approach to web application intrusions detection

Arkadiusz Kalicki

doi:10.1117/12.905681

6 October 2011 Data mining approach to web application intrusions detection

Arkadiusz Kalicki

Proceedings Volume 8008, Photonics Applications in Astronomy, Communications, Industry, and High-Energy Physics Experiments 2011; 800817 (2011) https://doi.org/10.1117/12.905681
Event: Photonics Applications in Astronomy, Communications, Industry, and High-Energy Physics Experiments 2011, 2011, Wilga, Poland

Abstract

Web applications became most popular medium in the Internet. Popularity, easiness of web application script languages and frameworks together with careless development results in high number of web application vulnerabilities and high number of attacks performed. There are several types of attacks possible because of improper input validation: SQL injection Cross-site scripting, Cross-Site Request Forgery (CSRF), web spam in blogs and others. In order to secure web applications intrusion detection (IDS) and intrusion prevention systems (IPS) are being used. Intrusion detection systems are divided in two groups: misuse detection (traditional IDS) and anomaly detection. This paper presents data mining based algorithm for anomaly detection. The principle of this method is the comparison of the incoming HTTP traffic with a previously built profile that contains a representation of the “normal” or expected web application usage sequence patterns. The frequent sequence patterns are found with GSP algorithm. Previously presented detection method was rewritten and improved. Some tests show that the software catches malicious requests, especially long attack sequences, results quite good with medium length sequences, for short length sequences must be complemented with other methods.

Citation Download Citation

Arkadiusz Kalicki "Data mining approach to web application intrusions detection", Proc. SPIE 8008, Photonics Applications in Astronomy, Communications, Industry, and High-Energy Physics Experiments 2011, 800817 (6 October 2011); https://doi.org/10.1117/12.905681

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available