Detection of Server-side Web Attacks

Web servers and server-side applications constitute the key components of modern Internet services. We present a pattern recognition system to the detection of intrusion attempts that target such components. Our system is anomaly-based, i.e., we model the normal (legitimate) traffic and intrusion attempts are identified as anomalous traffic. In order to address the presence of attacks (noise) inside the training set we employ an ad-hoc outlier detection technique. This approach does not require supervision and allows us to accurately detect both known and unknown attacks against web services.

• Type: Journal
• Year: 2010
• Where: JMLR
• Authors: Igino Corona, Giorgio Giacinto
• Keywords: Ad-hoc Outlier Detection, JMLR 2010, Modern Internet Services, Pattern Recognition