{"type":"ScholarlyArticle","title":"Locate-Then-Detect: Real-time Web Attack Detection via Attention-based Deep Neural Networks","authors":[{"name":"Tianlong Liu","slug":"tianlong-liu","given":"Tianlong","family":"Liu","affiliation":"Alibaba Cloud Intelligence Business Group , Alibaba Group , China"},{"name":"Yu Qi","slug":"yu-qi","given":"Yu","family":"Qi","affiliation":"College of Computer Science and Technology , Zhejiang University , China"},{"name":"Liang Shi","slug":"liang-shi","given":"Liang","family":"Shi","affiliation":"AI&Data Department , Dingxiang Tech.Inc , China"},{"name":"Jianan Yan","slug":"jianan-yan","given":"Jianan","family":"Yan","affiliation":"Alibaba Cloud Intelligence Business Group , Alibaba Group , China"}],"abstract":"Web attacks such as Cross-Site Scripting and SQL Injection are serious Web threats that lead to catastrophic data leaking and loss. Because attack payloads are often short segments hidden in URL requests/posts that can be very long, classical machine learning approaches have difficulties in learning useful patterns from them. In this study, we propose a novel Locate-Then-Detect (LTD) system that can precisely detect Web threats in real-time by using attention-based deep neural networks. Firstly, an efficient Payload Locating Network (PLN) is employed to propose most suspicious regions from large URL requests/posts. Then a Payload Classification Network (PCN) is adopted to accurately classify malicious regions from suspicious candidates. In this way, PCN can focus more on learning malicious segments and highly increase detection accuracy. The noise induced by irrelevant background strings can be largely eliminated. Besides, LTD can greatly reduce computational costs (82.6% less) by ignoring large irrelevant URL content. Experiments are carried out on both benchmarks and real Web traffic. The LTD outperforms an HMM-based approach, the Libinjection system, and a leading commercial rule-based Web Application Firewall. Our method can be efficiently implemented on GPUs with an average detection time of about 5ms and well qualified for real-time applications.","doi":"10.24963/ijcai.2019/656","url":"https://ijcai.org/proceedings/2019/656","pdf":"https://ijcai.org/proceedings/2019/0656.pdf","markdown":"https://ijcai.org/proceedings/2019/656.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/656","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Multidisciplinary Topics and Applications","track":"Main track","number":656,"pages":{"first":4725,"last":4731},"keywords":["Multidisciplinary Topics and Applications: Security and Privacy","Machine Learning Applications: Big data ; Scalability"],"videos":[],"references":[{"position":1,"raw":"[Bau et al., 2010] Jason Bau, Elie Bursztein, Divij Gupta, and John Mitchell. State of the art: Automated black- box web application vulnerability testing. In Security and Privacy (SP), 2010 IEEE Symposium on, pages 332-345. IEEE, 2010.","title":"State of the art: Automated blackbox web application vulnerability testing","authors":"Bau","year":"2010","venue":"Security and Privacy (SP)","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Chollet, 2016] Franc ¸ois Chollet. Xception: Deep learning with depthwise separable convolutions. arXiv preprint, 2016.","title":"Franc ¸ois Chollet. Xception: Deep learning with depthwise separable convolutions","authors":"Chollet","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Collobert et al., 2011] Ronan Collobert, Jason Weston, Léon Bottou, Michael Karlen, Koray Kavukcuoglu, and Pavel Kuksa. Natural language processing (almost) from scratch. Journal of Machine Learning Research, 12(Aug):2493-2537, 2011.","title":"Natural language processing (almost) from scratch","authors":"Ronan Collobert, Jason Weston, Léon Bottou, Michael Karlen, Koray Kavukcuoglu, Pavel Kuksa","year":"2011","venue":"Journal of Machine Learning Research","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Corona et al., 2009] Igino Corona, Davide Ariu, and Gior- gio Giacinto. Hmm-web: A framework for the detection of attacks against web applications. In Communications, 2009. ICC'09. IEEE International Conference on, pages 1-6. IEEE, 2009.","title":"Hmm-web: A framework for the detection of attacks against web applications","authors":"Igino Corona, Davide Ariu, Giorgio Giacinto","year":"2009","venue":"ICC'09. IEEE International Conference on","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Galbreath, 2012] Nick Galbreath. Libinjection. Blackhat, 2012.","title":"Libinjection. Blackhat","authors":"Nick Galbreath","year":"2012","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Girshick, 2015] Ross Girshick. Fast r-cnn. In Computer Vision (ICCV), 2015 IEEE International Conference on, pages 1440-1448. IEEE, 2015.","title":"Fast r-cnn","authors":"Ross Girshick","year":"2015","venue":"Computer Vision (ICCV), 2015 IEEE International Conference on","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Gupta et al., 2014] Mukesh Kumar Gupta, MC Govil, and Girdhari Singh. Static analysis approaches to detect sql injection and cross site scripting vulnerabilities in web ap- plications: A survey. In Recent Advances and Innovations in Engineering (ICRAIE), 2014, pages 1-5. IEEE, 2014.","title":"Static analysis approaches to detect sql injection and cross site scripting vulnerabilities in web applications: A survey","authors":"Mukesh Kumar Gupta, Girdhari Mc Govil, Singh","year":"2014","venue":"Recent Advances and Innovations in Engineering (ICRAIE)","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Johari and Sharma, 2012] Rahul Johari and Pankaj Sharma. A survey on web application vulnerabilities (sqlia, xss) ex- ploitation and security engine for sql injection. In Commu- nication Systems and Network Technologies (CSNT), 2012 International Conference on, pages 453-458. IEEE, 2012.","title":"A survey on web application vulnerabilities (sqlia, xss) exploitation and security engine for sql injection","authors":"Rahul Johari, Pankaj Sharma","year":"2012","venue":"Communication Systems and Network Technologies (CSNT), 2012 International Conference on","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Kar et al., 2016] Debabrata Kar, Khushboo Agarwal, Ajit Kumar Sahoo, and Suvasini Panigrahi. Detection of sql injection attacks using hidden markov model. In Engineering and Technology (ICETECH), 2016 IEEE International Conference on, pages 1-6. IEEE, 2016.","title":"Detection of sql injection attacks using hidden markov model","authors":"Debabrata Kar, Khushboo Agarwal, Ajit Kumar Sahoo, Suvasini Panigrahi","year":"2016","venue":"Engineering and Technology (ICETECH)","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Kim et al., 2016] Yoon Kim, Yacine Jernite, David Sontag, and Alexander M Rush. Character-aware neural language models. In AAAI, pages 2741-2749, 2016.","title":"Character-aware neural language models","authors":"Yoon Kim, Yacine Jernite, David Sontag, Alexander M Rush","year":"2016","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Kim, 2014] Yoon Kim. Convolutional neural networks for sentence classification. arXiv preprint arXiv:1408.5882, 2014.","title":"Convolutional neural networks for sentence classification","authors":"Yoon Kim","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Kindy and Pathan, 2011] Diallo Abdoulaye Kindy and Al- Sakib Khan Pathan. A survey on sql injection: Vulnera- bilities, attacks, and prevention techniques. In Consumer Electronics (ISCE), 2011 IEEE 15th International Sympo- sium on, pages 468-471. IEEE, 2011.","title":"A survey on sql injection: Vulnerabilities, attacks, and prevention techniques","authors":"Abdoulaye Diallo, Al-Sakib Kindy, Khan Pathan","year":"2011","venue":"IEEE 15th International Symposium on","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Kingma and Ba, 2014] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.","title":"Adam: A method for stochastic optimization","authors":"P Diederik, Jimmy Kingma, Ba","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[LeCun et al., 2015] Yann LeCun, Yoshua Bengio, and Ge- offrey Hinton. Deep learning. nature, 521(7553):436, 2015.","title":"Deep learning","authors":"Yann Lecun, Yoshua Bengio, Geoffrey Hinton","year":"2015","venue":"nature","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Li et al., 2017] Zeming Li, Chao Peng, Gang Yu, Xiangyu Zhang, Yangdong Deng, and Jian Sun. Light-head r-cnn: In defense of two-stage object detector. arXiv preprint arXiv:1711.07264, 2017.","title":"Light-head r-cnn: In defense of two-stage object detector","authors":"Zeming Li, Chao Peng, Gang Yu, Xiangyu Zhang, Yangdong Deng, Jian Sun","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Nguyen et al., 2011] Hai Thanh Nguyen, Carmen Torrano- Gimenez, Gonzalo Alvarez, Slobodan Petrović, and Katrin Franke. Application of the generic feature selection mea- sure in detection of web attacks. In Computational Intel- ligence in Security for Information Systems, pages 25-32. Springer, 2011.","title":"Application of the generic feature selection measure in detection of web attacks","authors":"Thanh Hai, Carmen Nguyen, Gonzalo Torrano-Gimenez, Slobodan Alvarez, Katrin Petrović, Franke","year":"2011","venue":"Computational Intelligence in Security for Information Systems","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Pinzón et al., 2010] Cristian Pinzón, Juan F De Paz, Javier Bajo, Álvaro Herrero, and Emilio Corchado. Aiida-sql: An adaptive intelligent intrusion detector agent for detect- ing sql injection attacks. In Hybrid Intelligent Systems (HIS), 2010 10th International Conference on, pages 73- 78. IEEE, 2010.","title":"Aiida-sql: An adaptive intelligent intrusion detector agent for detecting sql injection attacks","authors":"Cristian Pinzón, Juan F De Paz, Javier Bajo, Álvaro Herrero, Emilio Corchado","year":"2010","venue":"Hybrid Intelligent Systems (HIS)","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Ren et al., 2015] Shaoqing Ren, Kaiming He, Ross Gir- shick, and Jian Sun. Faster r-cnn: Towards real-time ob- ject detection with region proposal networks. In Advances in neural information processing systems, pages 91-99, 2015.","title":"Faster r-cnn: Towards real-time object detection with region proposal networks","authors":"Ren","year":"2015","venue":"Advances in neural information processing systems","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Xiao and Cho, 2016] Yijun Xiao and Kyunghyun Cho. Ef- ficient character-level document classification by com- bining convolution and recurrent layers. arXiv preprint arXiv:1602.00367, 2016.","title":"Efficient character-level document classification by combining convolution and recurrent layers","authors":"Xiao, Cho, Yijun Xiao, Kyunghyun Cho","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}