HMMPayl: an application of HMM to the analysis of the HTTP Payload

TitleHMMPayl: an application of HMM to the analysis of the HTTP Payload
Publication TypeConference Paper
Year of Publication2010
AuthorsAriu, D, Giacinto, G
Conference NameWorkshop on Applications of Pattern Analysis
Date Published09/2010
Keywordsids00, mcs00
Zero-days attacks are one of the most dangerous threats against computer networks. These, by definition, are attacks never seen before. Thus, defense tools based on a database of rules (usually referred as “signatures”) that describe known attacks cannot do anything against them. Recently, defense tools based on machine learning algorithms have gained an increasing popularity as they offer the possibility to fight off also zero-days attacks. In this paper we propose HMMPayl, an anomaly based Intrusion Detection System for the protection of a web server and of the applications the server hosts. HMMPayl analyzes the network traffic toward the web server and it is based on Hidden Markov Models. With this paper we provide for several contributions. First, the algorithm implemented by HMMPayl allows to carefully model the payload increasing the classification accuracy with respect to previously proposed solutions. Second, we show that an approach based on multiple classifiers leads to an increased classification accuracy with respect to the case where a single classifier is used. Third, exploiting the redundancy within the information extracted from the payload we propose a solution to reduce the computational cost of the algorithm.

Video - The spotlight session at the WAPA 2010 Workshop

Citation Key AriuWAPA2010
Ariu_WAPA2010.pdf273.18 KB