On the usage of character distribution for the detection of web attacks

Abstract

Character distribution has been extensively used in literature to build models for the detection of web attacks. This paper explores that character distribution models should be built at attribute level in order to achieve a reasonable accuracy. However, attaching detection models to every single attribute leads to high memory and time complexities, which make attribute-specific models less practical. To remove these barriers, a simple yet effective solution has been proposed. In more details, by exploiting the language function of characters, character distribution can be reduced in size and rearranged in an intentional manner so that both time and memory complexities are reduced significantly. Detection models that use minimized and rearranged character distribution are, therefore, highly efficient and practical, especially suitable to large, high-traffic web applications.