Web attacks penetrate the web applications’ security through unauthorized access to sensitive information, disrupting services, and stealing data. Conventionally, rule-based statistical methods distinguish attackers from legitimate users. However, the training through manually extracted weblog features is time-consuming and requires subject expertise. Additionally, the supervised attack classification method needs massive, labeled weblog data, which is expensive and unfeasible. Also, the unsupervised classification techniques have resolved the labeled data insufficiency problem, but their detection performance is unreliable. Recent studies focus on recognizing web attacks through deep neural network-based anomaly detection. Hence, this study proposes an anomaly detection-based Variational LSTM Autoencoder Deviation Network (VLADEN) for recognizing web attacks from weblogs. This work resolves the aforementioned issues by extracting the aberrant information encoded in weblog request data to detect web attacks. VLADEN works in three stages: data preprocessing, anomaly and reference score generation, and classification. The variational LSTM self-encoding-based reference score generation ensures that the anomaly score deviates from the normal data. The proposed model is experimentally validated on three publicly available datasets (CSIS2010, FWAF, and HTTPParams) and evaluated using AUC-ROC and AUC-PR-based evaluation metrics. The results demonstrate the models’ superior performance in detecting attack requests with minimum domain knowledge and labeled data.

中文翻译：

---

使用变分 LSTM 自动编码器偏差网络检测来自 HTTP Weblogs 的 Web 攻击


Web 攻击通过未经授权访问敏感信息、中断服务和窃取数据来渗透 Web 应用程序的安全。传统上，基于规则的统计方法将攻击者与合法用户区分开来。但是，通过手动提取的 weblog 特征进行训练非常耗时，并且需要学科专业知识。此外，监督式攻击分类方法需要大量带标签的博客数据，这既昂贵又不可行。此外，无监督分类技术解决了标记数据不足问题，但其检测性能不可靠。最近的研究侧重于通过基于深度神经网络的异常检测来识别 Web 攻击。因此，本研究提出了一种基于异常检测的变分 LSTM 自动编码器偏差网络 （VLADEN），用于识别来自网络日志的 Web 攻击。这项工作通过提取 weblog 请求数据中编码的异常信息来检测 Web 攻击，解决了上述问题。VLADEN 分为三个阶段：数据预处理、异常和参考分数生成以及分类。基于变分 LSTM 自编码的参考分数生成可确保异常分数偏离正常数据。所提出的模型在三个公开可用的数据集（CSIS2010、FWAF 和 HTTPParams）上进行了实验验证，并使用基于 AUC-ROC 和 AUC-PR 的评估指标进行评估。结果表明，这些模型在以最少的领域知识和标记数据检测攻击请求方面具有卓越的性能。