Adaptively Detecting Malicious Queries in Web Attacks
This work addresses the challenge of adapting to changing web attacks for web security practitioners, though it appears incremental as it builds on existing detection methods with adaptive updates.
The paper tackles the problem of detecting malicious web queries in evolving attack landscapes by proposing AMODS, an adaptive system that periodically updates detection models, achieving an F-value of 94.79% and a false positive rate of 0.09% in evaluations.
Web request query strings (queries), which pass parameters to the referenced resource, are always manipulated by attackers to retrieve sensitive data and even take full control of victim web servers and web applications. However, existing malicious query detection approaches in the current literature cannot cope with changing web attacks with constant detection models. In this paper, we propose AMODS, an adaptive system that periodically updates the detection model to detect the latest unknown attacks. We also propose an adaptive learning strategy, called SVM HYBRID, leveraged by our system to minimize manual work. In the evaluation, an up-to-date detection model is trained on a ten-day query dataset collected from an academic institute's web server logs. Our system outperforms existing web attack detection methods, with an F-value of 94.79% and FP rate of 0.09%. The total number of malicious queries obtained by SVM HYBRID is 2.78 times that by the popular Support Vector Machine Adaptive Learning (SVM AL) method. The malicious queries obtained can be used to update the Web Application Firewall (WAF) signature library.