Web Anomaly Detection Based on Frequent Closed Episode Rules
Lei Wang, Shoufeng Cao, Lin Sheng Wan, Fengyu Wang · 2017
Due to the fact that web services spread around the world, new threats are increasing. The misuse intrusion detection system is not able to provide enough protection for the security of Web Services, because it only detects formerly known attacks and cannot detect new unknown attacks. Web logs contain a lot of valuable information that is useful in preventing intrusion. In this paper, we present a new web anomaly detection method which uses FCERMining(Frequent Closed Episode Rules Mining) algorithm to analyze web logs and detect new unknown web attacks. The novel FCERMining algorithm parallelly mines the frequent closed episode rules on Spark, which handles massive data rapidly. Meanwhile, it reduces a part of rules which are redundant for anomaly detection to improve the matching efficiency. Then we also propose a grouping scheme to improve the parallel efficiency of FCERMining algorithm. Finally, we use SQLMAP and WebCruiser to simulate some web attacks, our method has a detection rate of 96.67% and a false alarm rate of 3.33% for detecting abnormal users. Our experimental results also demonstrate the reduction of redundant rules improve the matching efficiency. Furthermore, we compare the efficiency of our FCERMining algorithm with other pattern mining algorithms, experimental results indicate that our FCERMining algorithm outperforms other pattern mining algorithms.