• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>Recent advances in intrusion detection >Cross-Domain Collaborative Anomaly Detection: So Far Yet So Close
【24h】

Cross-Domain Collaborative Anomaly Detection: So Far Yet So Close

机译：跨域协作异常检测：到目前为止还很近

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Web applications have emerged as the primary means of access to vital and sensitive services such as online payment systems and databases storing personally identifiable information. Unfortunately, the need for ubiquitous and often anonymous access exposes web servers to adversaries. Indeed, network-borne zero-day attacks pose a critical and widespread threat to web servers that cannot be mitigated by the use of signature-based intrusion detection systems. To detect previously unseen attacks, we correlate web requests containing user submitted content across multiple web servers that is deemed abnormal by local Content Anomaly Detection (CAD) sensors. The cross-site information exchange happens in real-time leveraging privacy preserving data structures. We filter out high entropy and rarely seen legitimate requests reducing the amount of data and time an operator has to spend sifting through alerts. Our results come from a fully working prototype using eleven weeks of real-world data from production web servers. During that period, we identify at least three application-specific attacks not belonging to an existing class of web attacks as well as a wide-range of traditional classes of attacks including SQL injection, directory traversal, and code inclusion without using human specified knowledge or input.
机译：Web应用程序已成为访问重要和敏感​​服务的主要手段，例如在线支付系统和存储个人身份信息的数据库。不幸的是，对无处不在且通常是匿名访问的需求使Web服务器容易受到攻击。实际上，网络传播的零日攻击对Web服务器构成了严重且广泛的威胁，而使用基于签名的入侵检测系统无法缓解这种威胁。为了检测以前看不见的攻击，我们将包含多个站点服务器上用户提交的内容的Web请求相关联，这些请求被本地内容异常检测（CAD）传感器视为异常。跨站点信息交换是利用隐私保护数据结构实时进行的。我们过滤掉高熵，很少见到合法请求，从而减少了操作员在警报中进行筛选所需的数据量和时间。我们的结果来自一个完全正常工作的原型，该原型使用了来自生产Web服务器的11周的真实数据。在此期间，我们识别出至少三种不属于现有Web攻击类别的特定于应用程序的攻击，以及不使用人工指定知识或不包含人类特定知识的各种传统攻击类别，包括SQL注入，目录遍历和代码包含输入。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号