Detection of Attacks on Web Application Using Self-Organizing Kohonen Maps

Abstract

Purpose of the article: improving the effectiveness of web application attack detection. Method: using self-organizing maps for real-time detection of attacks on web applications. The result: The self-organizing map was considered as a means of detecting anomalous data. The possibility of integrating the self-organizing map with a web application firewall system for protection against attacks and vulnerabilities was analyzed. A software tool was implemented to detect anomalies in HTTP requests and responses using the self-organizing map. Parameters for the neural network were selected, and metrics were chosen for analysis by the neural network from the HTTP requests. The implemented software tool was integrated with the NGINX web server using the NGX JavaScript module. Functional and load testing of the integrated system was conducted using the OWASP ZAP security scanner. The results obtained led to the conclusion that the self-organizing map effectively detects anomalies, but it should be used in conjunction with template-based analysis methods.Practical value: within the framework of the study, a methodology for testing web application security tools has been developed. The software that makes up the test bench is described. The metrics that allow you to objectively assess the effectiveness of the web application protection tool are listed.