Comparative Analysis of HTTP Anomaly Detection Algorithms: DFA vs N-Grams

Abstract

Anomaly detection techniques have the potential to secure web-based applications, although their high false positive rates and poor scalability prevent them from being deployed in practice. Most previous work has addressed part of this challenge by testing the effectiveness (accuracy) of HTTP anomaly detection algorithms, but has ignored their efficiency (or scalability). In this paper, we conduct an evaluation of the performance of anomaly detection algorithms in terms of both their accuracy and scalability. We conducted experiments for Deterministic Finite Automata (DFA) and N-Grams. The results suggest that both algorithms have limitations for practical usage, but DFA exhibit better performance than N-Grams. Several aspects of DFA are identified for further improvements.