• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>IEEE International Conference on Advanced Computing >Detecting Web Attacks Using Multi-stage Log Analysis
【24h】

Detecting Web Attacks Using Multi-stage Log Analysis

机译：使用多级日志分析检测Web攻击

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Web-based applications have gained universal acceptance in every sector of lives, including social, commercial, government, and academic communities. Even with the recent emergence of cloud technology, most of cloud applications are accessed and controlled through web interfaces. Web security has therefore continued to be fundamentally important and extremely challenging. One major security issue of web applications is SQL-injection attacks. Most existing solutions for detecting these attacks use log analysis, and employ either pattern matching or machine learning methods. Pattern matching methods can be effective, dynamic, they however cannot detect new kinds of attacks. Supervised machine learning methods can detect new attacks, yet they need to rely on an off-line training phase. This work proposes a multi-stage log analysis architecture, which combines both pattern matching and supervised machine learning methods. It uses logs generated by the application during attacks to effectively detect attacks and to help preventing future attacks. The architecture is described in detail, a proof-of-concept prototype is implemented and hosted on Amazon AWS, using Kibana for pattern matching and Bayes Net for machine learning. It is evaluated on 10,000 logs for detecting SQL injection attacks. Experiment results show that the two-stage system has combined the advantages of both systems, and has substantially improved the detection accuracy. The proposed work is significant in advancing web securities, while the multi-stage log analysis concept would be highly applicable to many intrusion detection applications.
机译：基于网络的申请在每个生命中获得了普遍的验收，包括社会，商业，政府和学术界。即使最近云技术的出现，也可以通过Web接口访问和控制大多数云应用程序。因此，网络安全性继续基本上是重要的，非常具有挑战性。 Web应用程序的一个主要安全问题是SQL注入攻击。最多现有的解决方案用于检测这些攻击使用日志分析，并采用模式匹配或机器学习方法。模式匹配方法可以有效，动态，然而，它们无法检测到新的攻击。监督机器学习方法可以检测到新的攻击，但他们需要依靠离线训练阶段。这项工作提出了一种多级日志分析架构，它结合了模式匹配和监督机器学习方法。它使用应用程序生成的日志在攻击期间有效地检测到攻击并帮助防止未来的攻击。详细描述了该架构，在Amazon AWS上实现并托管了概念验证原型，用于使用Kibana进行模式匹配和贝叶斯网络进行机器学习。它是在10,000日志中进行评估，用于检测SQL注入攻击。实验结果表明，两级系统已将两个系统的优点组合在一起，并且大大提高了检测精度。拟议的工作在推进Web证券方面具有重要意义，而多级日志分析概念将高度适用于许多入侵检测应用。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号