Intrusion Detection System (IDS) is a popular approach to detect attacks in web applications. Signature-based IDS may not know all possible attack signatures in advance, thus a complementary anomaly-based IDS is deployed to and detect new attacks. In this paper, we propose an anomaly detection approach that utilizes three measures: cross entropy for parameter, value, and data type. The measures are intended to compare the deviation between learned request profiles and a new web request. To reduce the number of incorrect detections, we consider requests accessing similar resource paths to learn entropy parameter's value. We evaluate this approach by generating log datasets from a large scale web application (Content Management System). The initial results show that the proposed approach can detect all malicious web requests and demonstrate lower false positive rates. It outperformed when comparing two other approaches: length of parameter value and Mahalanobis Distance.
['Robert Bronte', 'Hossain Shahriar', 'Hisham M. Haddad']
Information Theoretic Anomaly Detection Framework for Web Application