SAD: web session anomaly detection based on parameter estimation

摘要: Web attacks are too numerous in numbers and serious potential consequences for modern society to tolerate. Unfortunately, current generation signature-based intrusion detection systems (IDS) inadequate, security techniques such as firewalls or access control mechanisms do not work well when trying secure web services. In this paper, we empirically demonstrate that the Bayesian parameter estimation method is effective analyzing logs detecting anomalous sessions. When were simulated with Whisker software, Snort, a well-known IDS based on misuse detection, caught only slightly more than one third of attacks. Our technique, session anomaly (SAD), other hand, detected nearly all without having rely attack signatures at all. SAD works by first developing normal usage profile comparing logs, they generated, against expected frequencies. research indicates has previously unknown proposed approach would play key role an integrated environment provide reliable