Authors:
Rodrigo Branco
;
Vinicius Cogo
and
Ibéria Medeiros
Affiliation:
LASIGE, Departamento de Informática, Faculdade de Ciências, Universidade de Lisboa, Portugal
Keyword(s):
Web Application Attacks, Netflows, Machine Learning, Natural Language Processing, Software Security.
Abstract:
Web applications are the preferred means of accessing online services. They have been built quickly and can be left with vulnerabilities due to human error and inexperience, making them vulnerable to attacks. As a result, security analysts must analyse and react to countless threats and alerts. Such alerts can not provide sufficient information about the attack performed on the web application, which is crucial for a correct risk assessment and remediation measures. Network Intrusion Detection Systems (NIDS) have been used as a primary defence mechanism against web attacks. However, HTTPS, a widely adopted protocol in web applications, encrypts traffic, hindering NIDS’ efficiency in searching for network security threats and attacks. To enhance web application security, we present an approach that uses natural language processing (NLP) and machine learning (ML) algorithms to detect attacks through the analysis of network traffic (including HTTPS) and log-based payload contents. The a
pproach employs anomaly detection by clustering netflows, and then NLP and supervised ML are used on the payload contents of anomalous netflows to identify attacks. Preliminary experiments have been made to detect SQL injection (SQLi), cross-site scripting (XSS), and directory traversal (DT) web attacks.
(More)