基于数据挖掘技术的Web应用异常检测  

Anomaly Detection for Web Attacks Based on Data Mining Methods Title

作　　者：程霞[1] 王晓锋[2] 

机构地区：[1]四川师范大学经济与管理学院,四川610066 [2]华中科技大学计算机科学与技术学院,湖北430074

出　　处：《网络安全技术与应用》2006年第5期82-84,95,共4页Network Security Technology & Application

摘　　要：本文提出的异常检测系统以Web日志文件作为输入,利用数据挖掘技术建立两种异常检测模型,分别对待测的Web请求记录输出五个异常概率,对各概率进行加权处理后得到一个最终的异常概率。This paper presents a novel anomaly detection framework,which uses data mining technologies to build four independent detection models.In the training phase,these models mine specialty of every web program using web server log files as data source,and in the detection phase,each model takes the HI-FP requests upon detection as input and calculates at least one anomalous probability as output. All the four models totally generate eight anomalous probabilities,which are weighted and summed up to produce a final probability,and this probability is used to decide whether the reauest is malicious or not.

关 键 词：异常检测 数据挖掘 WEB应用 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]