A New Unified Intrusion Anomaly Detection in Identifying Unseen Web Attacks

Abstract

The global usage of more sophisticated web-based application systems is obviously growing very rapidly. Major usage includes the storing and transporting of sensitive data over the Internet. The growth has consequently opened up a serious need for more secured network and application security protection devices. Security experts normally equip their databases with a large number of signatures to help in the detection of known web-based threats. In reality, it is almost impossible to keep updating the database with the newly identified web vulnerabilities. As such, new attacks are invisible. This research presents a novel approach of Intrusion Detection System (IDS) in detecting unknown attacks on web servers using the Unified Intrusion Anomaly Detection (UIAD) approach. The unified approach consists of three components (preprocessing, statistical analysis, and classification). Initially, the process starts with the removal of irrelevant and redundant features using a novel hybrid feature selection method. Thereafter, the process continues with the application of a statistical approach to identifying traffic abnormality. We performed Relative Percentage Ratio (RPR) coupled with Euclidean Distance Analysis (EDA) and the Chebyshev Inequality Theorem (CIT) to calculate the normality score and generate a finest threshold. Finally, Logitboost (LB) is employed alongside Random Forest (RF) as a weak classifier, with the aim of minimising the final false alarm rate. The experiment has demonstrated that our approach has successfully identified unknown attacks with greater than a 95% detection rate and less than a 1% false alarm rate for both the DARPA 1999 and the ISCX 2012 datasets.

An adaptive anomaly request detection framework based on dynamic web application profiles

“…The classification is mainly based on the detection mechanism of the methods.  Signature-based methods [3,4]: this is a well-known approach and has been investigated by many researchers. So far, the research community of web attack detection has built up a complete Core Rule Set [9] to support network users.…”

“…In this research, he uses an encoding method which reconstructs a character into a 2-dimensional matrix. The authors of the research [14] use N-gram and Generic Feature Selection algorithms to extract features from DARPA and ECML/PKDD2007 datasets [4]. In order to detect abnormal requests, they applied some clustering algorithms like C4.5, CART, Random forest or random tree.…”

“…In [2], Mookhey presented the characteristics, compositions and operation principles of WA. Besides, some other works in [2][3][4] have shown several vulnerabilities and threats that attackers could exploit to attack the web applications. According to the surveys in [3] and [4], the vulnerabilities of the protocol hyper text transfer protocol (HTTP) or hypertext transfer protocol secure (HTTPS) are often preferable to be exploited by attackers.…”

Intrusion Detection and Classification using Decision Tree Based Key Feature Selection Classifiers

“…Discrete data can be numeric but it can also be categorical, continuous data are always numeric and are not restricted to define separate values and can take any value within a range [31]. The various types of attack with their categories are discussed in the table [32]. The severity of the attack and the classification is discussed.…”

Reactive protocols for unified user profiling for anomaly detection in mobile Ad Hoc networks

“…Most works of literature have shown that anomaly detection has already been performed using learning techniques either supervised or unsupervised, statistical methods, stream analytic engine and data-mining approaches [6]. Little has been done with regards to reactive protocols used in ad hoc network and key performance indicators to detect outliers in a network.…”