A Two-Tier System for Web Attack Detection Using Linear Discriminant Method

Tan, Zhiyuan; Jamdagni, Aruna; He, Xiangjian; Nanda, Priyadarsi; Liu, Ren Ping; Jia, Wenjing; Yeh, Wei-chang

Abstract

The reliability and availability of network services are being threatened by the growing number of Denial-of-Service (DoS) attacks. Effective mechanisms for DoS attack detection are demanded. Therefore, we propose a multivariate correlation analysis approach to investigate and extract second-order statistics from the observed network traffic records. These second-order statistics extracted by the proposed analysis approach can provide important correlative information hiding among the features. By making use of this hidden information, the detection accuracy can be significantly enhanced. The effectiveness of the proposed multivariate correlation analysis approach is evaluated on the KDD CUP 99 dataset. The evaluation shows encouraging results with average 99.96% detection rate and 2.08% false positive rate. Comparisons also show that our multivariate correlation analysis based detection approach outperforms some other current researches in detecting DoS attacks.

Citation

Tan, Z., Jamdagni, A., He, X., Nanda, P., Liu, R. P., Jia, W., & Yeh, W.-C. (2010, December). A Two-Tier System for Web Attack Detection Using Linear Discriminant Method. Presented at 12th International Conference, ICICS 2010, Barcelona, Spain

• Presentation Conference Type: Conference Paper (published)
• Conference Name: 12th International Conference, ICICS 2010
• Start Date: Dec 15, 2010
• End Date: Dec 17, 2010
• Publication Date: 2010
• Deposit Date: Jun 16, 2017
• Electronic ISSN: 1611-3349
• Publisher: Springer
• Pages: 459-471
• Series Title: Lecture Notes in Computer Science
• Series Number: 6476
• Book Title: Information and Communications Security
• ISBN: 9783642176494
• DOI: https://doi.org/10.1007/978-3-642-17650-0_32
• Keywords: Denial-of-Service Attack, Euclidean Distance Map, Multivariate Correlations, Anomaly Detection
• Public URL: http://researchrepository.napier.ac.uk/Output/948478