Specification-Based Intrusion Detection Using Sequence Alignment and Data Clustering
Résumé
In this paper, we present our work on specication-based intrusion detection. Our goal is to build a web application rewall which is able to learn the normal behaviour of an application (and/or the user) from the trac between a client and a server. The model learnt is used to validate future trac. We will discuss later in this paper, the interactions between the learning phase and the exploitation phase of the generated model expressed as a set of regular expressions. These regular expressions are generated after a process of sequence alignment combined to BRELA (Basic Regular Expression Learning Algorithm) or directly by the later. We also present our multiple sequence alignment algorithm called AMAA (Another multiple Alignment Algorithm) and the usage of data clustering to improve the generated regular expressions.