HMMPayl: An intrusion detection system based on Hidden Markov Models

Abstract

Nowadays the security of Web applications is one of the key topics in Computer Security. Among all the solutions that have been proposed so far, the analysis of the HTTP payload at the byte level has proven to be effective as it does not require the detailed knowledge of the applications running on the Web server. The solutions proposed in the literature actually achieved good results for the detection rate, while there is still room for reducing the false positive rate.To this end, in this paper we propose HMMPayl, an IDS where the payload is represented as a sequence of bytes, and the analysis is performed using Hidden Markov Models (HMM). The algorithm we propose for feature extraction and the joint use of HMM guarantee the same expressive power of n−gram analysis, while allowing to overcome its computational complexity. In addition, we designed HMMPayl following the Multiple Classifiers System paradigm to provide for a better classification accuracy, to increase the difficulty of evading the IDS, and to mitigate the weaknesses due to a non optimal choice of HMM parameters. Experimental results, obtained both on public and private datasets, show that the analysis performed by HMMPayl is particularly effective against the most frequent attacks toward Web applications (such as XSS and SQL-Injection). In particular, for a fixed false positive rate, HMMPayl achieves a higher detection rate respect to previously proposed approaches it has been compared with.

Learning to control a structured-prediction decoder for detection of HTTP-layer DDoS attackers

“…Anomaly detection mechanisms employ a model of legitimate network traffic (Xie and Yu 2009)-and treat unlikely traffic patterns as attacks. For Fraction of all connections of all clients that specified HTTP header field Content-Type as any text variant the detection of SQL-injection, cross-site-scripting (XSS), and PHP file-inclusion (L/RFI), traffic can be modeled based on HTTP header and query string information using HMMs (Ariu et al 2011), n-gram models (Wressnegger et al 2013), general kernels (Düssel et al 2008), or other models (Robertson and Maggi 2010). Anomaly-detection mechanisms were investigated, from centroid anomaly-detection models (Kloft and Laskov 2012) to setting hard thresholds on the likelihood of new HTTP requests given the model, to unsupervised learning of support-vector data description (SVDD) models (Düssel et al 2008, Görnitz et al 2013.…”

Network Attack Classification and Recognition Using HMM and Improved Evidence Theory

“…HMM can also be used in network security. Ariu [8] proposed a novel solution where the HTTP payload is analyzed using hidden Markov model. The proposed system, named HMMPayl, had high classification accuracy and was very effective on most common attacks of the Web application.…”

Randomized Anagram revisited

“…Several approaches have been proposed so far to compute the model from network data [15]. Statistic-based approaches [16] define the normal model as the probabilities of appearance of certain patterns in the training data, using thresholds and basic statistical operators such as the standard deviation, mean, covariance, etc. Heuristic-based approaches automatically generate the model of normal behavior using different approaches such as machine learning algorithms [4], evolutionary systems [17] or other artificial intelligence methods [18].…”