Application attack detection system (AADS): An anomaly based behavior analysis approach

Ram Prasad Viswanathan, Youssif Al-Nashif, Salim A Hariri

Research output: Chapter in Book/Report/Conference proceedingConference contribution

3 Citations (Scopus)

Abstract

Network security, especially application layer security has gained importance with the rapid growth of web-based applications. Anomaly based approaches that profile the network traffic and look for abnormalities are effective against zero-day attacks. The complex nature of the web traffic, availability of multiple applications, privacy concerns and its own limitations make the development of such anomaly-based systems difficult. This paper proposes a framework for application layer anomaly detection. The framework uses a multiple model approach to detect anomalies. The framework encompasses a dedicated training phase to model the specific network traffic and a detection phase that can be deployed in real time. The framework has been applied to HTTP application traffic and multiple models have been developed. The experimental evaluation results of the AADS using multiple attack vectors have achieved a detection rate of almost 100%. In addition, the AADS has a false positive rate of 0.03%.

Original languageEnglish (US)
Title of host publicationProceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA
Pages150-156
Number of pages7
DOIs
StatePublished - 2011
Event9th ACS/IEEE International Conference on Computer Systems and Applications, AICCSA 2011 - Sharm El-Sheikh, Egypt
Duration: Dec 27 2011Dec 30 2011

Other

Other9th ACS/IEEE International Conference on Computer Systems and Applications, AICCSA 2011
CountryEgypt
CitySharm El-Sheikh
Period12/27/1112/30/11

Fingerprint

HTTP
Network security
Availability

Keywords

  • anomaly
  • framework
  • HTTP
  • multiple models
  • segregation

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Computer Science Applications
  • Hardware and Architecture
  • Signal Processing
  • Control and Systems Engineering
  • Electrical and Electronic Engineering

Cite this

Viswanathan, R. P., Al-Nashif, Y., & Hariri, S. A. (2011). Application attack detection system (AADS): An anomaly based behavior analysis approach. In Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA (pp. 150-156). [6126606] https://doi.org/10.1109/AICCSA.2011.6126606

Application attack detection system (AADS) : An anomaly based behavior analysis approach. / Viswanathan, Ram Prasad; Al-Nashif, Youssif; Hariri, Salim A.

Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA. 2011. p. 150-156 6126606.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Viswanathan, RP, Al-Nashif, Y & Hariri, SA 2011, Application attack detection system (AADS): An anomaly based behavior analysis approach. in Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA., 6126606, pp. 150-156, 9th ACS/IEEE International Conference on Computer Systems and Applications, AICCSA 2011, Sharm El-Sheikh, Egypt, 12/27/11. https://doi.org/10.1109/AICCSA.2011.6126606
Viswanathan RP, Al-Nashif Y, Hariri SA. Application attack detection system (AADS): An anomaly based behavior analysis approach. In Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA. 2011. p. 150-156. 6126606 https://doi.org/10.1109/AICCSA.2011.6126606
Viswanathan, Ram Prasad ; Al-Nashif, Youssif ; Hariri, Salim A. / Application attack detection system (AADS) : An anomaly based behavior analysis approach. Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA. 2011. pp. 150-156
@inproceedings{c13d0b8ffe6b429b8083577bc1c9cfd5,
title = "Application attack detection system (AADS): An anomaly based behavior analysis approach",
abstract = "Network security, especially application layer security has gained importance with the rapid growth of web-based applications. Anomaly based approaches that profile the network traffic and look for abnormalities are effective against zero-day attacks. The complex nature of the web traffic, availability of multiple applications, privacy concerns and its own limitations make the development of such anomaly-based systems difficult. This paper proposes a framework for application layer anomaly detection. The framework uses a multiple model approach to detect anomalies. The framework encompasses a dedicated training phase to model the specific network traffic and a detection phase that can be deployed in real time. The framework has been applied to HTTP application traffic and multiple models have been developed. The experimental evaluation results of the AADS using multiple attack vectors have achieved a detection rate of almost 100{\%}. In addition, the AADS has a false positive rate of 0.03{\%}.",
keywords = "anomaly, framework, HTTP, multiple models, segregation",
author = "Viswanathan, {Ram Prasad} and Youssif Al-Nashif and Hariri, {Salim A}",
year = "2011",
doi = "10.1109/AICCSA.2011.6126606",
language = "English (US)",
isbn = "9781457704741",
pages = "150--156",
booktitle = "Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA",

}

TY - GEN

T1 - Application attack detection system (AADS)

T2 - An anomaly based behavior analysis approach

AU - Viswanathan, Ram Prasad

AU - Al-Nashif, Youssif

AU - Hariri, Salim A

PY - 2011

Y1 - 2011

N2 - Network security, especially application layer security has gained importance with the rapid growth of web-based applications. Anomaly based approaches that profile the network traffic and look for abnormalities are effective against zero-day attacks. The complex nature of the web traffic, availability of multiple applications, privacy concerns and its own limitations make the development of such anomaly-based systems difficult. This paper proposes a framework for application layer anomaly detection. The framework uses a multiple model approach to detect anomalies. The framework encompasses a dedicated training phase to model the specific network traffic and a detection phase that can be deployed in real time. The framework has been applied to HTTP application traffic and multiple models have been developed. The experimental evaluation results of the AADS using multiple attack vectors have achieved a detection rate of almost 100%. In addition, the AADS has a false positive rate of 0.03%.

AB - Network security, especially application layer security has gained importance with the rapid growth of web-based applications. Anomaly based approaches that profile the network traffic and look for abnormalities are effective against zero-day attacks. The complex nature of the web traffic, availability of multiple applications, privacy concerns and its own limitations make the development of such anomaly-based systems difficult. This paper proposes a framework for application layer anomaly detection. The framework uses a multiple model approach to detect anomalies. The framework encompasses a dedicated training phase to model the specific network traffic and a detection phase that can be deployed in real time. The framework has been applied to HTTP application traffic and multiple models have been developed. The experimental evaluation results of the AADS using multiple attack vectors have achieved a detection rate of almost 100%. In addition, the AADS has a false positive rate of 0.03%.

KW - anomaly

KW - framework

KW - HTTP

KW - multiple models

KW - segregation

UR - http://www.scopus.com/inward/record.url?scp=84857698681&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84857698681&partnerID=8YFLogxK

U2 - 10.1109/AICCSA.2011.6126606

DO - 10.1109/AICCSA.2011.6126606

M3 - Conference contribution

AN - SCOPUS:84857698681

SN - 9781457704741

SP - 150

EP - 156

BT - Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA

ER -