An improved payload-based anomaly detector for web applications. (15th March 2018)

• Record Type: Journal Article
• Authors: Jin, Xiaohui; Cui, Baojiang; Li, Dong; Cheng, Zishuai; Yin, Congxian
• Is Part Of: Journal of network and computer applications. Volume 106(2018)
• Page Start: 111
• Page End: 116
• Publication Date: 2018-03-15
• Subjects: Payload-based -- Anomaly detection -- Web applications; Microcomputers -- Periodicals; Computer networks -- Periodicals; Application software -- Periodicals; Micro-ordinateurs -- Périodiques; Réseaux d'ordinateurs -- Périodiques; Logiciels d'application -- Périodiques; Application software; Computer networks; Microcomputers; Periodicals; 004.05; 004
• DOI: 10.1016/j.jnca.2018.01.002
• Languages: English
• ISSNs: 1084-8045

Abstract

Abstract: Payload-based anomaly detection can find out the malicious behavior hidden in network packets rather efficiently. It is quite suitable for securing web applications, which are used widely and a major concern of cyber security nowadays. Our research is based on McPAD. We argue that the assumption about the probability distribution of features in outlier class is not appropriate and figure out a more suitable distribution by analyzing the common types of web attacks. Furthermore, we propose a new mapping algorithm for dimensionality reduction in order to improve the performance of the original one. Finally, we try to speed up the training process without significantly affect the detection performance. The experimental results show that the training time can be reduced by an average of 24.75%.