10th IEEE Symposium on Computers and Communications (ISCC'05) (2005)
Cartagena, Murcia, Spain
June 27, 2005 to June 30, 2005
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ISCC.2005.51
Juan M. Est?vez-Tapiador , University Carlos III Madrid
Pedro Garc?a-Teodoro , University of Granada
Jes?s E. D?az-Verdejo , University of Granada
This paper presents a novel approach based on the monitoring of incoming HTTP requests to detect attacks against web servers. The detection is accomplished through a Markovian model whose states and transitions between them are determined from the specification of the HTTP protocol, while the probabilities of the symbols associated to the Markovian source are obtained during a training stage according to a set of attack-free requests for the target server. The experiments carried out show a high detection capability with low false positive rates at reasonable computation requirements.
J. E. D?az-Verdejo, P. Garc?a-Teodoro and J. M. Est?vez-Tapiador, "Detection of Web-Based Attacks through Markovian Protocol Parsing," 10th IEEE Symposium on Computers and Communications (ISCC'05)(ISCC), Cartagena, Murcia, Spain, 2005, pp. 457-462.