Data Mining Methods for Anomaly Detection of HTTP Request Exploitations

HTTP request exploitations take substantial portion of network-based attacks. This paper presents a novel anomaly detection framework, which uses data mining technologies to build four independent detection models. In the training phase, these models mine specialty of every web program using web server log files as data source, and in the detection phase, each model takes the HTTP requests upon detection as input and calculates at least one anomalous probability as output. All the four models totally generate eight anomalous probabilities, which are weighted and summed up to produce a final probability, and this probability is used to decide whether the request is malicious or not. Experiments prove that our detection framework achieves close to perfect detection rate under very few false positives.

Authors and Affiliations

1. Department of Computer Science and Technology, Huazhong University of Science and Technology, Wuhan, 430074, China

   Xiao-Feng Wang, Jing-Li Zhou, Sheng-Sheng Yu & Long-Zheng Cai

Editors and Affiliations

1. School of Electrical and Electronic Engineering, Nanyang Technological University, Block S1, Nanyang Avenue, 639798, Singapore

   Lipo Wang

2. Honda Research Institute Europe GmbH, Offenbach/Main, Germany

   Yaochu Jin

Reprints and permissions

© 2005 Springer-Verlag Berlin Heidelberg

Policies and ethics