Loading...

A Machine-Learning Content and Behaviour Anomaly Detection Model For Web

Mokhtari Hesar, Pouriya | 2026

4 Viewed
  1. Type of Document: M.Sc. Thesis
  2. Language: Farsi
  3. Document No: 58899 (19)
  4. University: Sharif University of Technology
  5. Department: Computer Engineering
  6. Advisor(s): Jafari Siavoshani, Mahdi
  7. Abstract:
  8. Intrusion detection systems and firewalls for web applications serve as an important defensive layer for detecting attacks. These systems typically employ either signature- based or anomaly-based approaches. Signature-based methods require expert knowl- edge to generate signatures for malicious data and, therefore, cannot be used to detect unknown threats. In contrast, anomaly-based methods can detect unknown threats but generally with lower accuracy and precision. Detecting legitimate strings within packet content is challenging for anomaly-based models because not all legitimate patterns are observed during the training phase. In this research, a machine learning model is proposed to simultaneously analyze user behavior and transmitted content. By utilizing syntactic and semantic web features, the study explores methods for detecting anomalies and maintaining an overall view of both user and server states. By identifying anomalies in changes to this behavioral view— which represents user activity—the limitations and challenges of previous approaches are examined. The results demonstrate that incorporating a behavioral model into the decision-making process improves the model’s performance metrics. Furthermore, the accuracy and precision of the model were evaluated through implementation and practical testing on the CSE-CIC-IDS-2018 dataset and compared with other existing methods. The proposed model achieved a classification rate of 97.0% and a recall rate of 99.0%, representing a 25% improvement in classification rate and a 21% improvement in recall compared to the original content-based model
  9. Keywords:
  10. Anomaly Detection ; Web Applications Firewall (WAF) ; Anomalous Behavior Detection ; Unknown Attacks ; Intrusion Detection System

 Digital Object List

 Bookmark

...see more