Anomaly detection of web-based attacks

By Christopher Krügel, Giovanni Vigna. Conference on Computer and Communications Security, 2003

741 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b250459298f4adaaa7920fbe76c8c117010ed14a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Comparing Anomaly Detection Techniques for HTTP (2007, neutral): “χ(2) of idealized character distribution As one of six tests, Kruegel and Vigna [28] use a measure of relative character frequency.”
Detection and analysis of drive-by-download attacks and malicious JavaScript code (2010, methodology): “For our system, we use several models provided by libAnomaly, a library to develop anomaly detection systems [16,17].”
Cross Site Scripting Prevention with Dynamic Data Tainting and Static Analysis (2007, background): “Likewise, if a property of an object is set to a tainted value, then the whole object needs to be tainted.”
A Learning-Based Approach to the Detection of SQL Attacks (2005, methodology): “This is an advantage of application-speciﬁc intrusion detection in general [11] and of web-based intrusion detection in particular [12].”
Data preprocessing for anomaly based network intrusion detection: A review (2011, methodology): “Later approaches target particular parts of the payloads, such as the parameter ﬁelds in a URI (Kruegel and Vigna, 2003).”
DÏoT: A Federated Self-learning Anomaly Detection System for IoT (2018, background): “Existing approaches rely on analysing single network packets [7], [55] or clustering large numbers of packets [8], [9] to detected intrusions or compromised services.”
Anomaly detection: A survey (2009, neutral): “2000], detecting web-based attacks [Kruegel and Vigna 2003; Kruegel et al. 2002], and anomalous topic detection in text data [Allan et al.”
Outlier Analysis (2013, methodology): “Methods for anomaly detection in web logs are discussed in [140, 275].”
Botz-4-sale: surviving organized DDoS attacks that mimic flash crowds (2005, background): “In addition, a few c ommercial filters exist such as Webscreen which uses heuristic s to detect abnormal traffic and attack patterns [31, 8, 5].”
Robust log-based anomaly detection on unstable log data (2019, neutral): “There have been a lot of studies on log-based anomaly detection[2, 4, 7, 11, 12, 14, 15, 20, 26, 28, 29, 33–35, 38, 41].”
On the infeasibility of modeling polymorphic shellcode (2007, methodology): “Blending methods such as those described in this paper are aimed primarily at exploiting IDS sensors which use feature-counting-based models that measure the existence of certain artifacts (in specific proportions) in the data such as the sensors described in Wang et al. (2005, 2006a), Kruegel and ”
GenProg: A Generic Method for Automatic Software Repair (2012, methodology): “In principle , many of those techniques , such as those of Kruegel and Vigna [ 60 ] , Tombini et al .”
Outside the Closed World: On Using Machine Learning for Network Intrusion Detection (2010, background): “A good example for the kind of mindset we deem vital for sound anomaly detection studies is the work on web-based attacks by Kruegel et al. [ 60 ].”
CSI: Novelty Detection via Contrastive Learning on Distributionally Shifted Instances (2020, neutral): “, cybersecurity [34]).”
A review of novelty detection (2014, methodology): “This has been applied to network intrusion and web-based attack detection [117,140–142].”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “Host-based intrusion detection techniques mainly fall into three categories: (1) misuse-based, which rely on specifications of bad behaviors associated with known attacks; (2) anomaly-based [19, 32, 47, 20, 30, 11, 48], which rely on learning a model of benign behavior and detecting deviations from ”
Adaptive Anomaly Detection via Self-calibration and Dynamic Updating (2009, background): “Indeed, Anomaly Detection (AD) sensors are becoming increasingly popular: host-based [24] and network-based [21, 25, 17 , 16, 30] intrusion detection systems rely heavily on AD components to maintain their high detection rates and minimize the false positives even when other, non-AD sensors are inv”