A Novel Approach for the Detection of Anomalous User Behavior in Web Applications Processes (Using Web Applications Firewall- WAF)

Abstract

The main challenges of web based systems security would be the detection of sabotage, attacks and anomalous user activities. Those activities threaten the integrity, confidentiality and the availability, of system resources. Sometimes, those activities might seem harmless and normal but considering different factors such as time, address, and the nature of applied changes and also order analysis would uncover the anomalous and malicious nature of them. Most web based systems consist of distributed characteristics and have various stages with significant order, and also use a service related user ID. In this paper, we have presented a method for detecting anomalous user activities, our method consist of analyzing the 3 factors of time, address and request order simultaneously for each user requests in order to make the best decision based on the analysis results. The suggested method works in 2 stages of training and detection. In the training stage, the system will be trained in order to create the required features for the analysis, and the analysis outcomes are used in the detection stage for the decision making process. In order to create diversity in the technology used in web bases systems and avoiding method dependency on one certain technology for easy use in every web based system, we designed our method based on the chronology of web based applications in security tools. The method was implemented on the firewall of an open text application in a web based application by means of PHP language. It is worth mentioning that we have considered different scenarios of anomalous user activities for the implementation processes