A new system for web attack detection is presented. It follows the anomaly-based approach, therefore known and unknown attacks can be detected. The system relies on a XML file to classify the incoming requests as normal or anomalous. The XML file, which is built from only normal traffic, contains a description of the normal behavior of the target web application statistically characterized. Any request which deviates from the normal behavior is considered an attack. The system has been applied to protect a real web application. An increasing number of training requests have been used to train the system. Experiments show that when the XML file has enough information to closely characterize the normal behavior of the target web application, a very high detection rate is reached while the false alarm rate remains very low.

We would like to thank the Ministerio de Industria, Turismo y Comercio, project SEGUR@ (CENIT2007-2010), the Ministerio de Ciencia e Innovacion, project CUCO (MTM2008-02194), and the Spanish National Research Council (CSIC), programme JAE/I3P.

9 páginas, 5 figuras, 1 tabla.

Peer reviewed