A Lightweight Tool for Detecting Web Server Attacks.
Magnus Almgren, Hervé Debar, Marc Daciér · 2000
We present an intrusion-detection tool focused on web server attacks, and describe why such a tool is needed. Several interesting features will be presented, such as the ability to run in real time and to keep track of suspicious hosts, which simplifies the learning of new attacks. The design is flexible and the signatures used to detect malicious behavior are not limited to simple pattern matching of dangerous cgi scripts, but also considers a history of different types of attacks on a host basis to allow detection of a wide variety of malicious behavior. The tool includes mechanisms for reducing the rate of false alarms. We conclude with a discussion of the information gained from deploying the tool at various sites. 1 1