Abstract
The use of web applications as a platform for providing services such as online banking, e-commerce, healthcare, education, and business processes has expanded significantly. With this expansion comes a greater opportunity for malicious activity, unauthorized access to user accounts, automated attacks, and unauthorized access to web application resources. Traditional security mechanisms used by organizations are generally based on predetermined rules, individual requests, or authentication events. While these mechanisms can detect malicious activity that occurs during a single request or authentication event, they cannot detect malicious activity that develops gradually throughout a user s entire session. This paper presents a session-level activity analysis methodology to detect suspicious user behavior in web applications. The methodology uses sequences of user interactions, request frequency, navigation patterns, length of time in a session, failed attempts to gain access, resource utilization, and deviations from normal user behavior to create session-based behavioral profiles. These profiles are then used to differentiate between legitimate use of a web application and potentially malicious use of the web application. Using statistical analysis, rule-based detection, and machine learning techniques, the methodology can identify anomalous user sessions with minimum false positives. The methodology also addresses several practical considerations including; working with highly skewed data, adapting to changing attack patterns, protecting user privacy, minimizing computational overhead, and making the methodology interpretable. Finally, the paper outlines a structured evaluation methodology that includes measuring detection accuracy, precision, recall, F1-score, and false-positive rates. Overall, the paper establishes a theoretical framework for incorporating behavioral monitoring into web application security programs. Its ultimate goal is to establish a scalable, privacy-conscious detection methodology that enables early identification of threats, improves investigations into incidents involving compromised web applications, and provides more robust protection for web-based services.
Keywords
Web Application Security, Session-Level Analysis, Suspicious User Behaviour, Anomaly Detection, Behavioural Profiling, Machine Learning, Intrusion Detection, User Activity Monitoring, Session Analytics, Cybersecurity
References
[1] Agarwal, N. and Hussain, S.Z. (2018) ‘A closer look at intrusion detection system for web applications’, Security and Communication Networks, 2018, Article 9601357.
[2] Anderson, D., Lunt, T.F., Javitz, H., Tamaru, A. and Valdes, A. (1995) Detecting unusual program behavior using the statistical component of the Next-Generation Intrusion Detection Expert System (NIDES). Technical Report SRI-CSL-95-06. Menlo Park, CA: SRI International.
[3] Breiman, L. (2001) ‘Random forests’, Machine Learning, 45, pp. 5–32.
[4] Chandola, V., Banerjee, A. and Kumar, V. (2009) ‘Anomaly detection: A survey’, ACM Computing Surveys, 41(3), Article 15.
[5] Cho, S. and Cha, S. (2004) ‘SAD: Web session anomaly detection based on parameter estimation’, Computers & Security, 23(4), pp. 312–319.
[6] Denning, D.E. (1987) ‘An intrusion-detection model’, IEEE Transactions on Software Engineering, SE-13(2), pp. 222–232.
[7] Eskin, E., Arnold, A., Prerau, M., Portnoy, L. and Stolfo, S. (2002) ‘A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data’, in Applications of Data Mining in Computer Security. Boston, MA: Kluwer Academic Publishers, pp. 77–101.
[8] Forrest, S., Hofmeyr, S.A., Somayaji, A. and Longstaff, T.A. (1996) ‘A sense of self for Unix processes’, in Proceedings of the 1996 IEEE Symposium on Security and Privacy. Los Alamitos, CA: IEEE, pp. 120–128.
[9] García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G. and Vázquez, E. (2009) ‘Anomaly-based network intrusion detection: Techniques, systems and challenges’, Computers & Security, 28(1–2), pp. 18–28.
[10] Goldstein, M. and Uchida, S. (2016) ‘A comparative evaluation of unsupervised anomaly detection algorithms for multivariate data’, PLoS ONE, 11(4), e0152173.
[11] Han, J., Kamber, M. and Pei, J. (2012) Data Mining: Concepts and Techniques. 3rd edn. Waltham, MA: Morgan Kaufmann.
[12] Ingham, K.L., Somayaji, A., Burge, J. and Forrest, S. (2007) ‘Learning DFA representations of HTTP for protecting web applications’, Computer Networks, 51(5), pp. 1239–1255.
[13] Jain, A.K., Ross, A. and Prabhakar, S. (2004) ‘An introduction to biometric recognition’, IEEE Transactions on Circuits and Systems for Video Technology, 14(1), pp. 4–20.
[14] Kent, K. and Souppaya, M. (2006) Guide to Computer Security Log Management. NIST Special Publication 800-92. Gaithersburg, MD: National Institute of Standards and Technology.
[15] Kruegel, C. and Vigna, G. (2003) ‘Anomaly detection of web-based attacks’, in Proceedings of the 10th ACM Conference on Computer and Communications Security. New York: ACM, pp. 251–261.
[16] Lakhina, A., Crovella, M. and Diot, C. (2004) ‘Diagnosing network-wide traffic anomalies’, in Proceedings of the ACM SIGCOMM Conference. New York: ACM, pp. 219–230.
[17] Liang, J. and Sun, J.W. (2011) ‘Active detection of application layer attacks based on analysis of HTTP-session’, Advanced Materials Research, 268–270, pp. 1253–1258.
[18] Liao, H.-J., Richard Lin, C.-H., Lin, Y.-C. and Tung, K.-Y. (2013) ‘Intrusion detection system: A comprehensive review’, Journal of Network and Computer Applications, 36(1), pp. 16–24.
[19] Liu, F.T., Ting, K.M. and Zhou, Z.-H. (2008) ‘Isolation forest’, in Proceedings of the 8th IEEE International Conference on Data Mining. Piscataway, NJ: IEEE, pp. 413–422.
[20] Lunt, T.F. (1993) ‘A survey of intrusion detection techniques’, Computers & Security, 12(4), pp. 405–418.
[21] Mitchell, R. and Chen, I.-R. (2014) ‘A survey of intrusion detection techniques for cyber-physical systems’, ACM Computing Surveys, 46(4), Article 55.
[22] Naiman, D.Q. (2004) ‘Statistical anomaly detection via httpd data analysis’, Computational Statistics & Data Analysis, 45(1), pp. 51–67.
[23] Oza, N.C. and Russell, S. (2001) ‘Online bagging and boosting’, in Proceedings of the IEEE International Conference on Systems, Man, and Cybernetics. Piscataway, NJ: IEEE, pp. 2340–2345.
[24] Patcha, A. and Park, J.-M. (2007) ‘An overview of anomaly detection techniques: Existing solutions and latest technological trends’, Computer Networks, 51(12), pp. 3448–3470.
[25] Portnoy, L., Eskin, E. and Stolfo, S. (2001) ‘Intrusion detection with unlabeled data using clustering’, in Proceedings of the ACM Workshop on Data Mining Applied to Security. Philadelphia, PA: ACM.
[26] Sarrouy, O., Totel, E. and Jouga, B. (2009) ‘Application data consistency checking for anomaly based intrusion detection’, in Stabilization, Safety, and Security of Distributed Systems. Lecture Notes in Computer Science, vol. 5873. Berlin: Springer, pp. 726–740.
[27] Scarfone, K. and Mell, P. (2007) Guide to Intrusion Detection and Prevention Systems (IDPS). NIST Special Publication 800-94. Gaithersburg, MD: National Institute of Standards and Technology.
[28] Sommer, R. and Paxson, V. (2010) ‘Outside the closed world: On using machine learning for network intrusion detection’, in Proceedings of the IEEE Symposium on Security and Privacy. Los Alamitos, CA: IEEE, pp. 305–316.
[29] Tavallaee, M., Bagheri, E., Lu, W. and Ghorbani, A.A. (2009) ‘A detailed analysis of the KDD CUP 99 data set’, in Proceedings of the IEEE Symposium on Computational Intelligence for Security and Defense Applications. Piscataway, NJ: IEEE, pp. 1–6.
[30] Chandola, V., Banerjee, A. and Kumar, V. (2012) ‘Anomaly detection for discrete sequences: A survey’, IEEE Transactions on Knowledge and Data Engineering, 24(5), pp. 823–839.