Boosting Web Intrusion Detection Systems by Inferring Positive Signatures

Authors:
Damiano Bolzoni;Sandro Etalle
Affiliations:
University of Twente, Enschede, The Netherlands;University of Twente, Enschede, The Netherlands and Eindhoven Technical University, The Netherlands
Venue:
OTM '08 Proceedings of the OTM 2008 Confederated International Conferences, CoopIS, DOA, GADA, IS, and ODBASE 2008. Part II on On the Move to Meaningful Internet Systems
Year:
2008

Citing 15
Cited 1

The base-rate fallacy and the difficulty of intrusion detection

ACM Transactions on Information and System Security (TISSEC)
The 1999 DARPA off-line intrusion detection evaluation

Computer Networks: The International Journal of Computer and Telecommunications Networking - Special issue on recent advances in intrusion detection systems
Testing Intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory

ACM Transactions on Information and System Security (TISSEC)
Application-Integrated Data Collection for Security Monitoring

RAID '00 Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection
Anomaly detection of web-based attacks

Proceedings of the 10th ACM conference on Computer and communications security
Testing network-based intrusion detection signatures using mutant exploits

Proceedings of the 11th ACM conference on Computer and communications security
POSEIDON: a 2-tier Anomaly-based Network Intrusion Detection System

IWIA '06 Proceedings of the Fourth IEEE International Workshop on Information Assurance
Pixy: A Static Analysis Tool for Detecting Web Application Vulnerabilities (Short Paper)

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Learning DFA representations of HTTP for protecting web applications

Computer Networks: The International Journal of Computer and Telecommunications Networking
Multi-module vulnerability analysis of web-based applications

Proceedings of the 14th ACM conference on Computer and communications security
ATLANTIDES: an architecture for alert verification in network intrusion detection systems

LISA'07 Proceedings of the 21st conference on Large Installation System Administration Conference
A multi-model approach to the detection of web-based attacks

Computer Networks: The International Journal of Computer and Telecommunications Networking - Web security
Comparing anomaly detection techniques for HTTP

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
Algorithms for learning regular expressions

ALT'05 Proceedings of the 16th international conference on Algorithmic Learning Theory
Anagram: a content anomaly detector resistant to mimicry attack

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection

Panacea: Automating Attack Classification for Anomaly-Based Network Intrusion Detection Systems

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present a new approach to anomaly-based network intrusion detection for web applications. This approach is based on dividing the input parameters of the monitored web application in two groups: the "regular" and the "irregular" ones, and applying a new method for anomaly detection on the "regular" ones based on the inference of a regular language. We support our proposal by realizing Sphinx, an anomaly-based intrusion detection system based on it. Thorough benchmarks show that Sphinx performs better than current state-of-the-art systems, both in terms of false positives/false negatives as well as needing a shorter training period.