A Parameter-Free Method for the Detection of Web Attacks

Torre-Abaitua, Gonzalo de la; Lago-Fernández, Luis F.; Arroyo, David

doi:10.1007/978-3-319-67180-2_64

Cited by 3 publications

(8 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Given a text T , the main idea is to compute the distance between T and a set of k additional texts

, known as attribute generators (AGs). This provides a vector of k numbers that represents the text T in a k -dimensional attribute space, and can be used as input for a classification algorithm [ 12 ]. Although in this work we have used a SVM classifier, it is necessary to highlight that our methodology for attributes extraction can be used with any other classification algorithm.…”

Section: Methodsmentioning

confidence: 99%

“…We use the scikit-learn Python library [ 47 ] for the implementation, and measure the quality of the classifiers by using the accuracy (ACC) and the area under the receiver operating characteristic curve (AUC) metrics. The SVM model depends on two hyperparameters, the complexity C and the kernel width

, which are tuned, for each k , using a standard 5-fold cross-validation strategy as described in [ 12 ]. The results presented in Section 4 are averaged over 10 different partitions of the data into the G and I sets.…”

Section: Methodsmentioning

confidence: 99%

“…In this work, we explore and validate the use of a previous method based on compression information techniques [ 12 ] in a wider scenario that encompasses several binary classification problems in the current cybersecurity context. These include spam detection, malicious URL identification, DGA targeting and sentiment analysis in Twitter and in movie reviews.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Compression-Based Method for Detecting Anomalies in Textual Data

Torre-Abaitua

Lago-Fernández

Arroyo

2021

Entropy

Self Cite

View full text Add to dashboard Cite

Nowadays, information and communications technology systems are fundamental assets of our social and economical model, and thus they should be properly protected against the malicious activity of cybercriminals. Defence mechanisms are generally articulated around tools that trace and store information in several ways, the simplest one being the generation of plain text files coined as security logs. Such log files are usually inspected, in a semi-automatic way, by security analysts to detect events that may affect system integrity, confidentiality and availability. On this basis, we propose a parameter-free method to detect security incidents from structured text regardless its nature. We use the Normalized Compression Distance to obtain a set of features that can be used by a Support Vector Machine to classify events from a heterogeneous cybersecurity environment. In particular, we explore and validate the application of our method in four different cybersecurity domains: HTTP anomaly identification, spam detection, Domain Generation Algorithms tracking and sentiment analysis. The results obtained show the validity and flexibility of our approach in different security scenarios with a low configuration burden.

show abstract

“…Given a text T , the main idea is to compute the distance between T and a set of k additional texts

Section: Methodsmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Compression-Based Method for Detecting Anomalies in Textual Data

Torre-Abaitua

Lago-Fernández

Arroyo

2021

Entropy

Self Cite

View full text Add to dashboard Cite

show abstract

“… Software: The rapid pace of how the software is being used makes it almost impossible not to use open forums/repositories to solve our needs. This creates software security breaches that compromise user data even on data in transit [ 25 , 26 , 27 , 28 , 29 , 30 , 31 , 32 ]. Malware: In recent years, companies have been attacked with malware.…”

Section: Kolmogorov Complexity Application Scenariosmentioning

confidence: 99%

“…The possibilities of using this information have been explored by many authors with proven results [ 70 ]. A solution proposed by Gonzalo de la Torre-Abaitua et al [ 27 , 28 ], shows the possibility of using NCD to perform proper analysis of the log files of multiple services to detect anomalies at an early stage. The authors identify five main topics, but the two most important are URL identification domain generation algorithms and Domain Generation Algorithms (DGA), which are important when parsing log files.…”

Section: Kolmogorov Complexity Application Scenariosmentioning

confidence: 99%

A Survey on Using Kolmogorov Complexity in Cybersecurity

Resende

Martins

Antunes

2019

Entropy

View full text Add to dashboard Cite

Security and privacy concerns are challenging the way users interact with devices. The number of devices connected to a home or enterprise network increases every day. Nowadays, the security of information systems is relevant as user information is constantly being shared and moving in the cloud; however, there are still many problems such as, unsecured web interfaces, weak authentication, insecure networks, lack of encryption, among others, that make services insecure. The software implementations that are currently deployed in companies should have updates and control, as cybersecurity threats increasingly appearing over time. There is already some research towards solutions and methods to predict new attacks or classify variants of previous known attacks, such as (algorithmic) information theory. This survey combines all relevant applications of this topic (also known as Kolmogorov Complexity) in the security and privacy domains. The use of Kolmogorov-based approaches is resource-focused without the need for specific knowledge of the topic under analysis. We have defined a taxonomy with already existing work to classify their different application areas and open up new research questions.

show abstract

A compression based framework for the detection of anomalies in heterogeneous data sources

de la Torre-Abaitua,

Lago-Fernández,

Arroyo

2019

Preprint

Self Cite

View full text Add to dashboard Cite

Nowadays, information and communications technology systems are fundamental assets of our social and economical model, and thus they should be properly protected against the malicious activity of cybercriminals. Defence mechanisms are generally articulated around tools that trace and store information in several ways, the simplest one being the generation of plain text files coined as security logs. This log files are usually inspected, in a semi-automatic way, by security analysts to detect events that may affect system integrity. On this basis, we propose a parameterfree methodology to detect security incidents from structured text regardless its nature. We use the Normalized Compression Distance to obtain a set of features that can be used by a Support Vector Machine to classify events from a heterogeneous cybersecurity environment. In specific, we explore and validate the application of our methodology in four different cybersecurity domains: HTTP anomaly identification, spam detection, Domain Generation Algorithms tracking and sentiment analysis. The results obtained show the validity and flexibility of our approach in different security scenarios with a low configuration burden.

show abstract

A Parameter-Free Method for the Detection of Web Attacks

Cited by 3 publications

References 38 publications

A Compression-Based Method for Detecting Anomalies in Textual Data

A Compression-Based Method for Detecting Anomalies in Textual Data

A Survey on Using Kolmogorov Complexity in Cybersecurity

A compression based framework for the detection of anomalies in heterogeneous data sources

Contact Info

Product

Resources

About