DETECTION OF WEB SERVER ATTACKS USING PRINCIPLES OF IMMUNOCOMPUTING

摘要

A new approach to web server attacks detection based on the statistical analysis of HTTP requests and principles of immunocomputing is proposed. We use a set of legitimate HTTP requests to the server as the training data. Each request is represented as its byte frequency distribution. Immunocomputing is used to calculate the binding energy between the training data and sampled HTTP requests. Our system gives the fuzzy output which allows us to give different kinds of response. The proposed approach has been tested with use of the DARPA data set and the data set collected from the vulnerable web server. It is shown that the given approach detects various attacks with a high degree of accuracy.