Abstract
Network security, especially application layer security has gained importance with the rapid growth of web-based applications. Anomaly based approaches that profile the network traffic and look for abnormalities are effective against zero-day attacks. The complex nature of the web traffic, availability of multiple applications, privacy concerns and its own limitations make the development of such anomaly-based systems difficult. This paper proposes a framework for application layer anomaly detection. The framework uses a multiple model approach to detect anomalies. The framework encompasses a dedicated training phase to model the specific network traffic and a detection phase that can be deployed in real time. The framework has been applied to HTTP application traffic and multiple models have been developed. The experimental evaluation results of the AADS using multiple attack vectors have achieved a detection rate of almost 100%. In addition, the AADS has a false positive rate of 0.03%.
| Original language | English (US) |
|---|---|
| Title of host publication | Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA |
| Pages | 150-156 |
| Number of pages | 7 |
| DOIs | |
| State | Published - 2011 |
| Event | 9th ACS/IEEE International Conference on Computer Systems and Applications, AICCSA 2011 - Sharm El-Sheikh, Egypt Duration: Dec 27 2011 → Dec 30 2011 |
Other
| Other | 9th ACS/IEEE International Conference on Computer Systems and Applications, AICCSA 2011 |
|---|---|
| Country | Egypt |
| City | Sharm El-Sheikh |
| Period | 12/27/11 → 12/30/11 |
Fingerprint
Keywords
- anomaly
- framework
- HTTP
- multiple models
- segregation
ASJC Scopus subject areas
- Computer Networks and Communications
- Computer Science Applications
- Hardware and Architecture
- Signal Processing
- Control and Systems Engineering
- Electrical and Electronic Engineering
Cite this
Application attack detection system (AADS) : An anomaly based behavior analysis approach. / Viswanathan, Ram Prasad; Al-Nashif, Youssif; Hariri, Salim A.
Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA. 2011. p. 150-156 6126606.Research output: Chapter in Book/Report/Conference proceeding › Conference contribution
}
TY - GEN
T1 - Application attack detection system (AADS)
T2 - An anomaly based behavior analysis approach
AU - Viswanathan, Ram Prasad
AU - Al-Nashif, Youssif
AU - Hariri, Salim A
PY - 2011
Y1 - 2011
N2 - Network security, especially application layer security has gained importance with the rapid growth of web-based applications. Anomaly based approaches that profile the network traffic and look for abnormalities are effective against zero-day attacks. The complex nature of the web traffic, availability of multiple applications, privacy concerns and its own limitations make the development of such anomaly-based systems difficult. This paper proposes a framework for application layer anomaly detection. The framework uses a multiple model approach to detect anomalies. The framework encompasses a dedicated training phase to model the specific network traffic and a detection phase that can be deployed in real time. The framework has been applied to HTTP application traffic and multiple models have been developed. The experimental evaluation results of the AADS using multiple attack vectors have achieved a detection rate of almost 100%. In addition, the AADS has a false positive rate of 0.03%.
AB - Network security, especially application layer security has gained importance with the rapid growth of web-based applications. Anomaly based approaches that profile the network traffic and look for abnormalities are effective against zero-day attacks. The complex nature of the web traffic, availability of multiple applications, privacy concerns and its own limitations make the development of such anomaly-based systems difficult. This paper proposes a framework for application layer anomaly detection. The framework uses a multiple model approach to detect anomalies. The framework encompasses a dedicated training phase to model the specific network traffic and a detection phase that can be deployed in real time. The framework has been applied to HTTP application traffic and multiple models have been developed. The experimental evaluation results of the AADS using multiple attack vectors have achieved a detection rate of almost 100%. In addition, the AADS has a false positive rate of 0.03%.
KW - anomaly
KW - framework
KW - HTTP
KW - multiple models
KW - segregation
UR - http://www.scopus.com/inward/record.url?scp=84857698681&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84857698681&partnerID=8YFLogxK
U2 - 10.1109/AICCSA.2011.6126606
DO - 10.1109/AICCSA.2011.6126606
M3 - Conference contribution
AN - SCOPUS:84857698681
SN - 9781457704741
SP - 150
EP - 156
BT - Proceedings of IEEE/ACS International Conference on Computer Systems and Applications, AICCSA
ER -