HAL - INRIA :: [inria-00406450, version 1] Self-adaptive web intrusion detection system

inria-00406450, version 1

Self-adaptive web intrusion detection system

Thomas Guyet ( Auteur à contacter de préférence )^a^, 1, 2, René Quiniou^b^, 1, Wei Wang ³, Marie-Odile Cordier ()^c^, 1

N° RR-6989 (2009)

Résumé : The evolution of the web server contents and the emergence of new kinds of intrusions make necessary the adaptation of the intrusion detection systems (IDS). Nowadays, the adaptation of the IDS requires manual -- tedious and unreactive -- actions from system administrators. In this paper, we present a self-adaptive intrusion detection system which relies on a set of local model-based diagnosers. The redundancy of diagnoses is exploited, online, by a meta-diagnoser to check the consistency of computed partial diagnoses, and to trigger the adaptation of defective diagnoser models (or signatures) in case of inconsistency. This system is applied to the intrusion detection from a stream of HTTP requests. Our results show that our system 1) detects intrusion occurrences sensitively and precisely, 2) accurately self-adapts diagnoser model, thus improving its detection accuracy.

a – Agrocampus Ouest
b – INRIA
c – Université Rennes I
1 : DREAM (INRIA - IRISA)
CNRS : UMR6074 – INRIA – INSA Rennes – Université de Rennes 1
2 : Laboratoire d'Informatique - Agrocampus Ouest
Institut supérieur des sciences agronomiques, agroalimentaires, horticoles et du paysage – Ministère de l'Alimentation, de l'Agriculture et de la Pêche
3 : Centre for Quantifiable Quality of Service in Communication Systems (Q2S)
Norwegian University of Science and Technology

inria-00406450, version 1
http://hal.inria.fr/inria-00406450
oai:hal.inria.fr:inria-00406450
Contributeur : Thomas Guyet <>
Soumis le : Mercredi 22 Juillet 2009, 12:34:28
Dernière modification le : Vendredi 5 Mars 2010, 12:51:34

Voir la fiche détaillée

Documents associés

PDF :

PS :

arXiv : 0907.3819

Exporter

Bibtex EndNote TEI RefWorks

<?xml version="1.0" encoding="UTF-8"?>
<listBibl xmlns="http://www.tei-c.org/ns/1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:mml="http://www.w3.org/1998/Math/MathML">
<listBibl type="report"><head>Rapports</head>
<biblStruct type="report" xml:id="inria-00406450"><monogr>
<author><persName><forename>Thomas</forename><surname>Guyet</surname></persName>
<affiliation>
<orgName type="laboratory">INRIA - IRISA</orgName>
<orgName type="team">DREAM</orgName>
<country>FR</country>
<orgName type="institution">CNRS : UMR6074</orgName>
<orgName type="institution">INRIA</orgName>
<orgName type="institution">INSA Rennes</orgName>
<orgName type="institution">Université de Rennes 1</orgName>
</affiliation>
<affiliation>
<orgName type="team">Laboratoire d'Informatique - Agrocampus Ouest</orgName>
<country>FR</country>
<orgName type="institution">Institut supérieur des sciences agronomiques, agroalimentaires, horticoles et du paysage</orgName>
<orgName type="institution">Ministère de l'Alimentation, de l'Agriculture et de la Pêche</orgName>
</affiliation>
</author>
<author><persName><forename>René</forename><surname>Quiniou</surname></persName>
<affiliation>
<orgName type="laboratory">INRIA - IRISA</orgName>
<orgName type="team">DREAM</orgName>
<country>FR</country>
<orgName type="institution">CNRS : UMR6074</orgName>
<orgName type="institution">INRIA</orgName>
<orgName type="institution">INSA Rennes</orgName>
<orgName type="institution">Université de Rennes 1</orgName>
</affiliation>
</author>
<author><persName><forename>Wei</forename><surname>Wang</surname></persName>
<affiliation>
<orgName type="laboratory">Q2S</orgName>
<orgName type="team">Centre for Quantifiable Quality of Service in Communication Systems</orgName>
<country>NO</country>
<orgName type="institution">Norwegian University of Science and Technology</orgName>
</affiliation>
</author>
<author><persName><forename>Marie-Odile</forename><surname>Cordier</surname></persName>
<affiliation>
<orgName type="laboratory">INRIA - IRISA</orgName>
<orgName type="team">DREAM</orgName>
<country>FR</country>
<orgName type="institution">CNRS : UMR6074</orgName>
<orgName type="institution">INRIA</orgName>
<orgName type="institution">INSA Rennes</orgName>
<orgName type="institution">Université de Rennes 1</orgName>
</affiliation>
</author>
<title type="main" level="m">Self-adaptive web intrusion detection system</title><title type="main" level="m">Self-adaptive web intrusion detection system</title><imprint><biblScope type="publicationDate">2009-00-00</biblScope><biblScope type="pp">24</biblScope></imprint></monogr><idno type="HALid">http://hal.inria.fr/inria-00406450</idno><idno type="HALFile">http://hal.inria.fr/inria-00406450/PDF/RR-6989.pdf</idno></biblStruct>
</listBibl>
</listBibl>