Anomaly-based intrusion detection and prevention by semantic evaluation of HTTP requests

摘要

We implemented anomaly intrusion detection/prevention system which detects semantic anomaly in HTTP requests to web servers. The system parses HTTP requests, evaluates each of the semantically separated elements by the length, or the number of included specific characters, and calculates the means and the variances of those evaluated values. To detect/prevent anomaly HTTP requests, the system discriminates anomaly by evaluated values of the syntactic elements. Experimentation shows that average true positive rate is 92%, and average false positive rate is 0.17%.