Online Anomaly Detection Based on Web Usage Mining

HTTP-based Web applications form a universal platform for modern network services. Due to its importance, more and more network attacks migrate to this platform. Among the known application-layer attacks, the web-based Distributed Denial of Service (DDoS) attack is a typical network threat. Despite the widespread success of many methods in this field, most existing approaches are static and fail to monitor the time-varying user- and attacker-behavior. Motivated by this challenge, a new dynamic hidden semi-Markov model is proposed to model the time-varying user-behavior. An efficient algorithm is introduced to realize the online automatic update of model´s parameters. Based on the proposed dynamic behavior model, an anomaly detection scheme is proposed to detect the Web-based distributed denial of service attack. Experiments based on a real traffic data are conducted to validate our model and algorithms.