A Survey of Anomaly Detection Using Data Mining Methods for Hypertext Transfer Protocol Web Services

Abstract

Abstract:In contrast to traditional Intrusion Detection Systems (IDSs), data mining anomaly detection methods/techniques has been widely used in the domain of network traffic data for intrusion detection and cyber threat. Data mining is widely recognized as popular and important intelligent and automatic tools to assist humans in big data security analysis and anomaly detection over IDSs. In this study we discuss our review in data mining anomaly detection methods for HTTP web services. Today, many online careers and actions including online shopping and banking are running through web-services. Consequently, the role of Hypertext Transfer Protocol (HTTP) in web services is crucial, since it is the standard facilitator for communication protocol. Hence, among the intruders that bound attacks, HTTP is being considered as a vital middle objective. In the recent years, an effective system that has attracted the attention of the researchers is the anomaly detection which is based on data mining methods. We provided an overview on four general data mining techniques such as classification, clustering, semi-supervised and association rule mining. These data mining anomaly detection methods can be used to computing intelligent HTTP request data, which are necessary in describing user behavior. To meet the challenges of data mining techniques, we provide challenges and issues section for intrusion detection systems in HTTP web services.

Real-time big data processing for anomaly detection: A Survey

“…Supervised anomaly detection techniques detect anomaly based on generating a set of grouping rules that aid in predicting future data. An example of supervised anomaly detection is classification-based anomaly detection (Kakavand et al, 2015).…”

“…Semi-supervised anomaly detection is an approach that models only the normal records. The other records are labelled as outliers in the testing phase (Kakavand et al, 2015).…”

“…focuses on the data that does not contain any labelling information and it does not need a separate training and testing phase. A general example is clustering based anomaly detection (Kakavand et al, 2015).…”

“…Various realtime algorithms and application for anomaly detection have been reviewed. (Kakavand , Mustapha, Mustapha, Abdullah, & Riahi, 2015) Various machine learning and data mining methods used for cyber analytics in support of intrusion detection were reviewed.…”

Prevention and Fighting against Web Attacks through Anomaly Detection Technology. A Systematic Review

“…Kakavand et al [3] provided an overview of data mining methods used by HTTP web services anomaly detection, concluding that most studies do not use public datasets that allow replication of the experiments. Those studies that do use public datasets showed high percentages of accuracy in most of the intrusion detection techniques employed, but these studies were not replicated with a different set of datasets.…”