摘要
本文提出的异常检测系统以Web日志文件作为输入,利用数据挖掘技术建立两种异常检测模型,分别对待测的Web请求记录输出五个异常概率,对各概率进行加权处理后得到一个最终的异常概率。
This paper presents a novel anomaly detection framework,which uses data mining technologies to build four independent detection models.In the training phase,these models mine specialty of every web program using web server log files as data source,and in the detection phase,each model takes the HI-FP requests upon detection as input and calculates at least one anomalous probability as output. All the four models totally generate eight anomalous probabilities,which are weighted and summed up to produce a final probability,and this probability is used to decide whether the reauest is malicious or not.
出处
《网络安全技术与应用》
2006年第5期82-84,95,共4页
Network Security Technology & Application
关键词
异常检测
数据挖掘
WEB应用
anomaly detection
data mining
application level security