AIWAS: The Automatic Identification of Web Attacks System

Related Works

A-NIDS often utilize machine learning (ML) techniques. Lazarevic et al. (2005), Tavallaee et al. (2010) and Tsai et al. (2009) provide a review of existing A-NIDS. Traditional A-NIDS (Lee & Heinbuch, 2001) concentrate on low-level packet information implying that application specific information is lost (Krugel, 2002). As a result, A-NIDS often have low detection rates for attacks targeting the Web application layer. A new generation of A-NIDS has been proposed to specifically target the Web application layer; a brief overview of these A-NIDS follows.

Kruegel et al. (2003, 2005) presented one of the first A-NIDS designed specifically for Web applications. The system contains six anomaly models and six techniques for estimating the probability of an attack based upon these models. Valeur et al. (2005) present an approach that profiles normal database access performed by Web applications to detect SQL injection attacks on a DBMS. Swaddler (Cova et al., 2007a) extends Kruegel et al. (2003, 2005) by also examining the state of the Web application. Liu et al. (Liu et al., 2009) introduces the SQLProb proxy to detect and remove SQL injection attacks. SQLProb is evaluated using the AMNESA (Halfond & Orso, 2005) attack data set with excellent results.