An Anomaly Detection Method Based on Multi-models to Detect Web Attacks
Ming Zhang, Shuaibing Lu, Boyi Xu · 2017
As Web attacks are constantly emerging and have caused enormous loss, the effective methods to protect the Web security are becoming increasingly required. We propose an anomaly detection method based on multi-models to detect Web attacks. The method is designed by inspecting the HTTP request messages to identify attacks. Three machine learning models, namely the probability distribution model, the hidden Markov model, and the one-class SVM model are employed to inspect different fields of the HTTP request messages to detect anomalies. The three models work together and the overall detection result is anomalous if at least one model reports an anomaly. The detection mechanism of each model and the corresponding feature extraction algorithm are presented. The experimental results show that the multi-model based detection method has apparent advantage on detecting Web attacks. It craftily makes each individual model to inspect the HTTP request fields that they excel at, thus achieving a high detection rate while keeping a low false alarm rate.