Reducing errors in the anomaly-based detection of web-based attacks through the combined analysis of web requests and SQL queries

摘要: Web-based applications have become a popular means of exposing functionality to large numbers users by leveraging the services provided web servers and databases. The wide proliferation custom-developed web-based suggests that anomaly detection could be suitable approach for providing early warning real-time blocking application-level exploits. Therefore, number research prototypes commercial products learn normal usage patterns been developed. Anomaly techniques, however, are prone both false positives negatives. As result, if anomalous requests simply blocked, it is likely some legitimate would denied, resulting in decreased availability. On other hand, malicious allowed access application's data stored back-end database, security-critical information leaked an attacker. To ameliorate this situation, we propose system composed system, reverse HTTP proxy, database system. Serially composing detector SQL query increases rate our To address potential increase positive rate, leverage anomaly-driven proxy serve anomalous-but-benign do not require sensitive information. We developed prototype evaluated its applicability with respect several existing applications, showing feasible effective reducing