Anomaly-Based Method for Detecting Multiple Classes of Network Attacks

Abstract

The article discusses the problem of detecting network attacks on a web server. The attention is focused on two common types of attacks: “denial of service„ and “code injection„. A review and an analysis of various attack detection techniques are conducted. A new lightweight approach to detect attacks as anomalies is proposed. It is based on recognition of the dynamic response of the web server during requests processing. An autoencoder is implemented for dynamic response anomaly recognition. A case study with the MyBB web server is described. Several flood attacks and SQL injection attack are modeled and successfully detected by the proposed method. The efficiency of the detection algorithm is evaluated, and the advantages and disadvantages of the proposed approach are analyzed.

Keywords

• anomaly detection
• autoencoder
• one-class classification
• dynamic response model
• vulnerability exploitation
• lightweight intrusion detection
• web server
• SQL injection
• flood attack