OwlEye: An Advanced Detection System of Web Attacks Based on HMM
Xin Liu, Qingchen Yu, Xiaokang Zhou, Qingguo Zhou · 2018
Nowdays web services plays an important part in our daily life, and the security of web servers and applications has become one of the key topics in cyber security. Web request query strings(queries) are responsible for passing parameters to the referenced resources, thus vulnerable of being manipulated by attackers to retrive sensitive data and even losing full control of victims. In this paper, we propose OwlEye, a hybrid attack detection sensor based on Hidden Markov Model(HMM). It's designedtodefenseagainstweb-layercode-injectionattacks, such as SQL-injection and cross scripting. Its innovative bidirectory scoring architecture design offers the advantage of utilizing both benign and malicious traffic in model training, thus has acheived a satisfying detection rate at an acceptable false positive rate.