Anomaly-based intrusion detection in software as a service
Authors:
- 1 June 2011
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- No. 23256648,p. 19-24
Abstract
Anomaly-based intrusion detection systems (IDS) have the ability of detecting previously unknown attacks, which is important since new vulnerabilities and attacks are constantly appearing. Software as a service web applications are currently much targeted by attacks, so they are an obvious application for such IDSs. The paper presents a study of the use of anomaly-based IDSs with data from a production environment hosting a web application of large dimensions. It describes how challenges like processing a large number of requests and obtaining training data without attacks were solved. It also presents an evaluation comparing the accuracy obtained with the different types of models that were used to represent normal behavior.Keywords
This publication has 9 references indexed in Scilit:
- Comparing Anomaly Detection Techniques for HTTP2007
- Learning DFA representations of HTTP for protecting web applicationsComputer Networks, 2007
- An introduction to ROC analysisPattern Recognition Letters, 2006
- Anagram: A Content Anomaly Detector Resistant to Mimicry Attack2006
- A multi-model approach to the detection of web-based attacksComputer Networks, 2005
- SAD: web session anomaly detection based on parameter estimationComputers & Security, 2004
- Anomalous Payload-Based Network Intrusion Detection2004
- Anomaly detection of web-based attacks2003
- Gauging Similarity with n -Grams: Language-Independent Categorization of TextScience, 1995