Detecting Web Application Injection Attacks Using One-Class SVM

Abstract

As the important component of the Internet, the Web makes it easy for us to access information anytime, anywhere. However, the widespread adoption of web applications has introduced new security risks and expanded existing attack surfaces that many organizations are not effectively protecting. Among the various threats facing the web applications, injection attacks are one of the most dangerous. In this work, we propose to use one-class Support Vector Machine (SVM) for detecting web application injection attacks. We treat the detection of injection attacks as an anomaly detection problem. In the training stage, a number of legitimate HTTP requests are used to train a one-class SVM model. In the testing stage, the trained one-class SVM is used to detect whether an HTTP request is legitimate or malicious. We adopt 2v-gram algorithm (a variant of n-gram) to extract features from HTTP requests. The experimental results show that one-class SVM achieves good performance in detecting web application injection attacks by achieving a detection rate of 94.04% and a false positive rate of 1.62%.