An enhanced deep learning based framework for web attacks detection, mitigation and attacker profiling

Deep Learning (DL) and Natural Language Processing (NLP) techniques are improving and enriching with a rapid pace. Furthermore, we witness that the use of web applications is increasing in almost every direction in parallel with the related technologies. Web applications encompass a wide array of use cases utilizing personal, financial, defense, and political information (e.g., wikileaks incident). Indeed, to access and to manipulate such information are among the primary goals of attackers. Thus, vulnerability of the information targeted by adversaries is a vital problem and if such information is captured then the consequences can be devastating, which can, potentially, become national security risks in the extreme cases. In this study, as a remedy to this problem, we propose a novel model that is capable of distinguishing normal HTTP requests and anomalous HTTP requests. Our model employs NLP techniques, Bidirectional Encoder Representations from Transformers (BERT) model, and DL techniques. Our experimental results reveal that the proposed approach achieves a success rate over 99.98% and an F1 score over 98.70% in the classification of anomalous and normal requests. Furthermore, web attack detection time of our model is significantly lower (i.e., 0.4 ms) than the other approaches presented in the literature.

show abstract

“…They created a large dataset and trained CNN-based deep learning models. The accuracy of the model was reported to be 99.94% [17].…”

Section: A ML Based Web Attack Detection Using Synthetic Datasetsmentioning

confidence: 98%

“…In fact, a successfully trained model can determine that the sentence chosen randomly is not related to the first sentence. BERT architecture, which includes pretraining and fine-tuning procedures, is presented in Figure 2 [17].…”

Section: Bertmentioning

confidence: 99%

An Attack Detection Framework Based on BERT and Deep Learning

2022

View full text Add to dashboard Cite

show abstract

“…A CNN comprises one or more convolutional layers, which are further linked by one or more fully connected layers (Shahid et al 2022). Here the input and output layers are combined through multiple hidden layers, which generally contain a sequence of convolutional layers.…”

Section: Convolutional Neural Network (Cnn)mentioning

confidence: 99%

An ensemble deep learning based IDS for IoT using Lambda architecture

Alghamdi

Bellaïche

2023

Cybersecurity

View full text Add to dashboard Cite

The Internet of Things (IoT) has revolutionized our world today by providing greater levels of accessibility, connectivity and ease to our everyday lives. It enables massive amounts of data to be traversed across multiple heterogeneous devices that are all interconnected. This phenomenon makes IoT networks vulnerable to various network attacks and intrusions. Building an Intrusion Detection System (IDS) for IoT networks is challenging as they enable a massive amount of data to be aggregated, which is difficult to handle and analyze in real time mainly because of the heterogeneous nature of IoT devices. This inefficient, traditional IDS approach accentuates the need to develop advanced IDS techniques by employing Machine or Deep Learning. This paper presents a deep ensemble-based IDS using Lambda architecture by following a multi-pronged classification approach. Binary classification uses Long Short Term Memory (LSTM) to differentiate between malicious and benign traffic, while the multi-class classifier uses an ensemble of LSTM, Convolutional Neural Network and Artificial Neural Network classifiers to detect the type of attacks. The model training is performed in the batch layer, while real-time evaluation is carried out through model inferences in the speed layer of the Lambda architecture. The proposed approach gives high accuracy of over 99.93% and saves useful processing time due to the multi-pronged classification strategy and using the lambda architecture.

show abstract

“…These simulations identify vulnerabilities in security environments by mimicking the likely attack patterns and techniques used by malicious actors. A breach attack simulation can simulate malware attacks on endpoints, data exfiltration, malware attacks and sophisticated APT (Advanced Persistent Threat) [Shahid et al 2022] attacks that move laterally through a network, targeting the most valuable assets.…”

Section: Breach Attack Simulationsmentioning

confidence: 99%

A Multi-criteria Approach to Improve the Cyber Security Visibility Through Breach Attack Simulations

Neto

Filho

Marinho

2022

Anais Do XXII Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais (SBSeg 2022)

View full text Add to dashboard Cite

Cyber threats are increasingly present in our daily lives and represent a great risk for companies. In this sense, organisations run breach attack simulations to generate an action plan and recommendations that must be followed. However, these action plans are the result of the tacit knowledge of specialists. Upon this issue, this research proposes a formal and automatic method to generate prioritized action plans to improve the visibility of the environment. The method proposed here is demonstrated through an experiment, in which the results were consistent and useful for the scenario in which it was tested.

show abstract

An enhanced deep learning based framework for web attacks detection, mitigation and attacker profiling

Cited by 25 publications

References 49 publications

An Attack Detection Framework Based on BERT and Deep Learning

An Attack Detection Framework Based on BERT and Deep Learning

An ensemble deep learning based IDS for IoT using Lambda architecture

A Multi-criteria Approach to Improve the Cyber Security Visibility Through Breach Attack Simulations

Contact Info

Product

Resources

About