An adaptive anomaly detection of WEB-based attacks

An adaptive model is proposed, which detect WEB-based attacks via identifying normal behaviors. By describing the structural features of Request-URL and using multiple hidden Markov model, the sample set is divided into several smaller subsets by request type. The discreteness of subset is calculated by the properties. Based on this, analyze the discreteness of each WEB requests to determine whether the request is normal, and then construct the detector based on hidden Markov model. The experimental results show that the adaptive model can effectively identify WEB-based attacks and reduce false alert.