Distress detection (poster abstract)

Abstract

Web attacks are a major security concern as novel attacks can be easily created by exploiting different vulnerabilities, using different attack payloads, and/or encodings (obfuscation). Intrusion detection systems (IDS) aim to correctly detect attacks. There are two main approaches to intrusion detection: misuse and anomaly detection. Despite the difference in approach, they both fail to offer adequate resilience to novel attacks due to the difficulty in generalizing beyond known attack or normal behavior. Distress Detection. The aim of distress detection (DD) is to address this problem and to provide resilience to novel attacks by generalizing beyond known attacks while controlling the false positives (FP) rate. In order to achieve this DD combines attack generalization based on attacker objectives, dynamic analysis techniques for the definition of suspicious behavior signatures, and feature-based correlation of suspicious HTTP requests and system events.