Empirical Analysis of Attackers Activity on Multi-tier Web Systems

Goševa-Popstojanova, Katerina; Miller, Brandon; Pantev, Risto; Dimitrijevikj, Ana

doi:10.1109/aina.2010.138

Cited by 10 publications

(25 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Facing the lack of publicly available, recent data on malicious attacker activities, we developed and deployed highinteraction honeypots as a means to collect such data [10], [11]. These honeypots ran off-the shelf operating systems and applications that followed typical security guidelines and did not include user accounts with nil or weak passwords.…”

Section: Data Collection and Extractionmentioning

confidence: 99%

“…Instead of phpMyAdmin, two Web 2.0 applications were installed: the most widely used wiki software MediaWiki (version 1.9.0), which is used as an application base for Wikipedia, and the most downloaded open source blogging software Wordpress (version 2.1.1). From the honeypot with this configuration, we collected two data sets: Web sessions, each defined as a sequence of requests from the same source IP address to port 80, with a time between two successive request not exceeding a threshold of thirty minutes [10], [11], were extracted automatically from the logs of the front-end Web servers (i.e., Apache and ISS). Since honeypots could not be accessed directly by human users because of the 'transparent linking' approach used for advertising, the only non-malicious sessions in the logs consisted of system management traffic generated by our team and legitimate Web crawlers such as Google and MSNbot.…”

Section: Data Collection and Extractionmentioning

confidence: 99%

“…Two of the four datasets considered in this paper were used in our previous work [10], [11] which was focused on descriptive analysis of different types of attacks and vulnerability scans and inferential statistical analysis of characteristics of malicious TCP [10] and HTTP traffic [11]. Neither [10] nor [11] included classification of malicious traffic using machine learning methods.…”

Section: Introductionmentioning

confidence: 99%

“…Our honeypots were configured in a three-tier architecture (consisting of a front-end Web server, application server, and a backend database) and had meaningful functionality [10], [11]. Furthermore, they ran standard off-the-shelf operating system and applications which followed typical security guidelines and did not include user accounts with nil or weak passwords.…”

Section: Introductionmentioning

confidence: 99%

“…Neither [10] nor [11] included classification of malicious traffic using machine learning methods. The two additional datasets were collected since the publication of [10], [11].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Classification of Malicious Web Sessions

Goševa-Popstojanova

Anastasovski

Pantev

2012

2012 21st International Conference on Computer Communications and Networks (ICCCN)

Self Cite

View full text Add to dashboard Cite

The ever increasing number of vulnerabilities and reported attacks on Web systems clearly illustrate the need for better understanding of malicious cyber activities, which will allow better protection, detection, and service recovery in the cyberspace. In this paper we use three supervised machine learning methods, Support Vector Machines (SVM), and decision trees based J48 and PART, to classify attacker activities aimed at Web systems. The empirical analysis is based on four datasets, each in duration of four to five months, collected by high-interaction honeypots. Malicious Web sessions are characterized with forty three different features (i.e., session attributes) extracted from Web server logs. Our results show that the supervised learning methods can be used to efficiently distinguish attack sessions from vulnerability scan sessions, with very high probability of detection and very low probability of false alarms. Furthermore, we follow the principle of Occam's razor, that is, we seek for the simplest possible model that can successfully classify malicious Web sessions. Our results show that attacks differ from vulnerability scans only in a small number of features (i.e., session attributes). In particular, depending on the data set, classification of malicious activities can be performed using from four to six features without significantly affecting learners' performance compared to when all 43 features are used. Decision tree based methods J48 and PART perform better than SVM across all datasets.

show abstract

Section: Data Collection and Extractionmentioning

confidence: 99%

Section: Data Collection and Extractionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…Neither [10] nor [11] included classification of malicious traffic using machine learning methods. The two additional datasets were collected since the publication of [10], [11].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations