Web Attack Detection Based on User Behaviour Semantics

With the development of the Internet and the increased popularity of web applications, the web has become one of the main venues for attackers engaging in cybercrimes. While enjoying the convenience of web applications, consumers also face security problems, such as the leakage of sensitive information and Internet fraud. Security protection mechanisms, such as traditional intrusion detection systems (IDSs) and web application firewalls (WAFs), are becoming incompetent at defending against the new cyber-attacks. In this paper, we propose a web attack detection approach that takes advantage of analysing the malicious intentions hidden in user actions. First, after using the independent user behaviours to build a sequential behaviour model, the proposed approach extracts the hidden malicious intentions of attackers from normal and seemingly normal behaviours utilizing a Long Short-Term Memory (LSTM) network. Then, on the basis of the user intentions, the approach leverages ensemble learning techniques to integrate extra inherent features of abnormal behaviour, resulting in its efficient practicality. The experimental results show the effectiveness of the proposed approach on the CSIC 2010 dataset with 99.87% accuracy.