Application Layer Anomaly Detection Based on HSMM

Abstract

Today more and more network-based attacks occur at application layer. Observed from the network layer and transport layer, these attacks may not contain significant malicious activities, and generate abnormal network traffic. However, traditional security techniques usually detect attacks from those two layers. Although some security techniques can detect some application layer attacks, these techniques can only detect some known attacks, and these techniques can’t detect the unknown or novel attacks happened on application layer. In theory, application layer anomaly detection can detect the unknown and novel attacks happened on application layer, so the research of application layer anomaly detection is very important. This paper presents a new application layer anomaly detection method which based on HSMM. The experimental results show that this method has high detection accuracy and low false positive ratio.