View in EDS

Anomaly detection for web server based on smooth support vector machine.

Saved in:
Bibliographic Details
Title: Anomaly detection for web server based on smooth support vector machine.
Authors: Shi-Jinn Horng1,2 horngsj@yahoo.com.tw, Pingzhi Fan3 p.fan@ieee.org, Ming-Yang Su4 minysu@mcu.edu.tw, Yuan-Hsin Chen2 yschen@nuu.edu.tw, Cheng-Ling Lee5 cherry@nuu.edu.tw, Shao-Wei Lan1 x_sk2@yahoo.com.tw
Source: Computer Systems Science & Engineering. May2008, Vol. 23 Issue 3, p209-218. 10p. 3 Diagrams, 4 Charts, 1 Graph.
Subjects: Web server software, Computer network security, False alarms, Microsoft software, Client/server computing, Computer security
Abstract: A network-based intrusion detection system (NIDS) for detecting attacks on Microsoft IIS web server was proposed. The classifier used in the system is based on smooth support vector machine (SSVM). SSVM is a variation of support vector machine (SVM) with higher detection rate and shorter training lime. Since SSVM is a binary classifier, for the sake of recognizing different attacks, we constructed hierarchical SSVMs to do it. The NIDS captures HTTP request packet, and derives features from payload but header information. By experiments, the NIDS captured 55,308 HTTP request packets on-line, consisting of 31,034 normal and 24,274 abnormal packets, the true positive rate is 99.40% and the false alarm is 6.85%. The proposed NID has another merit; that is, it has the ability to detect unknown or even novel attacks, ranging from 65.13% to 97.33%, depending on different signatures missed in training phase. Moreover, our NIDS takes only 7.2 x 10-4 second in average for processing an incoming packet in a PC with 2.4GHZ CPU and 256MB RAM. The high accuracy and speed make our NIDS more practicable in the real world. [ABSTRACT FROM AUTHOR]
Copyright of Computer Systems Science & Engineering is the property of Tech Science Press and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Database: Engineering Source
Description
Abstract:A network-based intrusion detection system (NIDS) for detecting attacks on Microsoft IIS web server was proposed. The classifier used in the system is based on smooth support vector machine (SSVM). SSVM is a variation of support vector machine (SVM) with higher detection rate and shorter training lime. Since SSVM is a binary classifier, for the sake of recognizing different attacks, we constructed hierarchical SSVMs to do it. The NIDS captures HTTP request packet, and derives features from payload but header information. By experiments, the NIDS captured 55,308 HTTP request packets on-line, consisting of 31,034 normal and 24,274 abnormal packets, the true positive rate is 99.40% and the false alarm is 6.85%. The proposed NID has another merit; that is, it has the ability to detect unknown or even novel attacks, ranging from 65.13% to 97.33%, depending on different signatures missed in training phase. Moreover, our NIDS takes only 7.2 x 10-4 second in average for processing an incoming packet in a PC with 2.4GHZ CPU and 256MB RAM. The high accuracy and speed make our NIDS more practicable in the real world. [ABSTRACT FROM AUTHOR]
ISSN:02676192