Mahalanobis distance map approach for anomaly detection of web-based attacks

Aruna Jamdagnil, Zhiyuan Tan, Priyadarsi Nanda, Xiangjian He, Ren Ping Liu

    Research output: Chapter in Book / Conference PaperConference Paperpeer-review

    Abstract

    Web servers and web-based applications are commonly used as attack targets. The main issues ar how to prevent unauthorised access and to protect web servers from the attack. Intrusion Detection Systems (IDSs) are widely used security tools to detect cyber-attacks and malicious activities in computer systems and networks. In this paper, we focus on the detection of various web-based attacks using Geometrical Structure Anomaly Detection (GSAD) model and we also propose a novel algorithm for the selection of most discriminating features to improve the computational complexity of payload-based GSAD model. Linear Discriminant method (LDA) is used for the feature reduction and classification of the incoming network traffic. GSAD model is based on a pattern recognition technique used in image processing. It analyses te correlations between various payload fetures and uses Mahalanobis Distance Map (MDM) to calculate the difference between normal and abnormal network traffic. We focus on the detection of generic attacks, shell code attacks, polymorphic attacks and polymorphic blending attacks. We evaluate accuracy of GSAD model experimentally on the real world attacks dataset created at Georgia Institute of Technology. We conducted preliminary experiments on the DARPA 99 dataset to evaluate the accuracy of feature reduction.
    Original languageEnglish
    Title of host publicationProceedings of the 8th Australian Information Security Management Conference, 30 November - 2 December 2010, Perth, Western Australia
    PublisherEdith Cowan University
    Pages8-15
    Number of pages8
    ISBN (Print)9780729806886
    Publication statusPublished - 2010
    EventAustralian Information Security Management Conference -
    Duration: 30 Nov 2010 → …

    Conference

    ConferenceAustralian Information Security Management Conference
    Period30/11/10 → …

    Fingerprint

    Dive into the research topics of 'Mahalanobis distance map approach for anomaly detection of web-based attacks'. Together they form a unique fingerprint.

    Cite this