Anomaly detection for web server log reduction: a simple yet efficient crawling based approach - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

Anomaly detection for web server log reduction: a simple yet efficient crawling based approach

Résumé

Offering a secured shared hosting environment for web applications is not a trivial task. In addition to a well secured system configuration, up-to-date shared hosting are still exposed to security threats by compromised web applications that serve as spam relay, distributed denial of service actors, phishing page hosting and drive-by download page hosting to name a few. As a result, the availability of the server could suffer from a bad IP address reputation and thus, blocked access to all accounts in the server, not only the compromised account. The emergence of web application firewalls (WAF) manages to close the gap by thoroughly analysing HTTP requests in search of known vulnerabilities. However, as any misuse type mechanism, it falls short at discovering zero-day attacks or already compromised environment. In this paper, an anomaly detection model is proposed as a very helpful tool to start building an efficient intrusion detection system adapted to a specific web application or to assist a forensic analysis. The learning phase does not need past activities nor prior knowledge of the web application and its underlying architecture, making it a very simple yet powerful tool for reducing the access log entries for further analysis.
Fichier non déposé

Dates et versions

hal-03172252 , version 1 (17-03-2021)

Identifiants

Citer

Eric Asselin, Carlos Aguilar Melchor, Gentian Jakllari. Anomaly detection for web server log reduction: a simple yet efficient crawling based approach. 2nd IEEE Workshop on Security and Privacy on the Cloud (SPC 2016), IEEE, Oct 2016, Philadelphie, United States. pp.586--590, ⟨10.1109/CNS.2016.7860553⟩. ⟨hal-03172252⟩
18 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More