Abstract
A simple and effective web application firewall is presented. This system follows the anomalous approach, therefore it can detect both known and unknown web attacks. The system decides whether the incoming requests are attacks or not aided by an XML file. The XML file contains the normal behavior of the target web application statistically characterized and is built from a set of normal requests artificially generated. Any request which deviates from the normal behavior is considered anomalous. The system has been applied to protect a real web application. An increasing number of training requests have been used to train the system. Experiments show that when the XML file has enough data to closely characterize the normal behaviour of the target web application, a very high detection rate is reached while the false alarm rate ramains very low.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Alvarez, G., Petrovic, S.: A new taxonomy of Web attacks suitable for efficient encoding. Computers and Security 22(5), 453–449 (2003)
Patcha, A., Park, J.: An overview of anomaly detection techniques: Existing solutions and latest technological trends. Computer Networks 51(12), 3448–3470 (2007)
Kruegel, C., Vigna, G., Robertson, W.: A multi-model approach to the detection of web-based attacks. Computer Networks 48(5), 717–738 (2005)
Estévez-Tapiador, J., García-Teodoro, P., Díaz-Verdejo, J.: Measuring normality in HTTP traffic for anomaly-based intrusion detection. Computer Networks 45(2), 175–193 (2004)
Bolzoni, D., Zambon, E.: Sphinx: An anomaly-based web intrusion detection system. In: Workshop on Intrusion Detection Systems, Utrecht, The Netherlands, 14 pages (2007)
ModSecurity. Open Source signature-based Web Application Firewall (2009), http://www.modsecurity.org
Provost, F., Fawcett, T., Kohavi, R.: The case against accuracy estimation for comparing induction algorithms. In: Proceedings of the 15th International Conference on Machine Learning. Morgan Kaufmann, San Francisco (1998)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Torrano-Gimenez, C., Perez-Villegas, A., Alvarez, G. (2009). A Self-learning Anomaly-Based Web Application Firewall. In: Herrero, Á., Gastaldo, P., Zunino, R., Corchado, E. (eds) Computational Intelligence in Security for Information Systems. Advances in Intelligent and Soft Computing, vol 63. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-04091-7_11
Download citation
DOI: https://doi.org/10.1007/978-3-642-04091-7_11
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-04090-0
Online ISBN: 978-3-642-04091-7
eBook Packages: EngineeringEngineering (R0)