Application of the generic feature selection measure in detection of web attacks

Authors:
Hai Thanh Nguyen;Carmen Torrano-Gimenez;Gonzalo Alvarez;Slobodan Petrović;Katrin Franke
Affiliations:
Norwegian Information Security Laboratory, Gjøvik University College, Norway;Instituto de Física Aplicada, Consejo Superior de Investigaciones Científicas, Madrid, Spain;Instituto de Física Aplicada, Consejo Superior de Investigaciones Científicas, Madrid, Spain;Norwegian Information Security Laboratory, Gjøvik University College, Norway;Norwegian Information Security Laboratory, Gjøvik University College, Norway
Venue:
CISIS'11 Proceedings of the 4th international conference on Computational intelligence in security for information systems
Year:
2011

Citing 6
Cited 0

Testing Intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory

ACM Transactions on Information and System Security (TISSEC)
Pattern Classification (2nd Edition)

Pattern Classification (2nd Edition)
Computational Methods of Feature Selection (Chapman & Hall/Crc Data Mining and Knowledge Discovery Series)

Computational Methods of Feature Selection (Chapman & Hall/Crc Data Mining and Knowledge Discovery Series)
Feature Extraction: Foundations and Applications (Studies in Fuzziness and Soft Computing)

Feature Extraction: Foundations and Applications (Studies in Fuzziness and Soft Computing)
Web Application Firewalls

Web Application Firewalls
Towards a Generic Feature-Selection Measure for Intrusion Detection

ICPR '10 Proceedings of the 2010 20th International Conference on Pattern Recognition

Quantified Score

Hi-index	0.00

Visualization

Abstract

Feature selection for filtering HTTP-traffic in Web application firewalls (WAFs) is an important task. We focus on the Generic-Feature-Selection (GeFS) measure [4], which was successfully tested on low-level package filters, i.e., the KDD CUP'99 dataset. However, the performance of the GeFS measure in analyzing high-level HTTP-traffic is still unknown. In this paper we study the GeFS measure for WAFs. We conduct experiments on the publicly available ECML/PKDD-2007 dataset. Since this dataset does not target any real Web application, we additionally generate our new CSIC-2010 dataset. We analyze the statistical properties of both two datasets to provide more insides of their nature and quality. Subsequently, we determine appropriate instances of the GeFS measure for feature selection. We use different classifiers to test the detection accuracies. The experiments show that we can remove 63% of irrelevant and redundant features from the original dataset, while reducing only 0.12% the detection accuracy of WAFs.