基于数据挖掘技术的Web应用异常检测

Anomaly Detection for Web Attacks Based on Data Mining Methods Title

本文提出的异常检测系统以Web日志文件作为输入,利用数据挖掘技术建立两种异常检测模型,分别对待测的Web请求记录输出五个异常概率,对各概率进行加权处理后得到一个最终的异常概率。

This paper presents a novel anomaly detection framework,which uses data mining technologies to build four independent detection models.In the training phase,these models mine specialty of every web program using web server log files as data source,and in the detection phase,each model takes the HI-FP requests upon detection as input and calculates at least one anomalous probability as output. All the four models totally generate eight anomalous probabilities,which are weighted and summed up to produce a final probability,and this probability is used to decide whether the reauest is malicious or not.