Evolutionary‐based packets classification for anomaly detection in web layer
Rafał Kozik, Michał Choraś, Witold Hołubowicz · Security and Communication Networks · 2016
Abstract In this paper, we propose a novel method for web layer anomaly detection. In contrast to the majority of other state of the art approaches, we do not adapt manually configured parsers or packet content type detection techniques to partition the request sent from clients to server. In our experiments, we showed that making certain assumptions about the request content types may lead to the degradation of the detection performance. Therefore, we proposed unsupervised algorithm for automated packet structure extraction. We formulate this as the optimisation problem that is solved by means of genetic algorithm. Moreover, on top of the request segmentation schema, we provide the set of algorithms that measure statistics and apply machine learning techniques to solve the classification problems. The effectiveness of our methods is proved by the results achieved on the extended benchmark database. Copyright © 2016 John Wiley & Sons, Ltd.