XML中基于语法推理的异常检测方法
A Grammatical Inference Approach to Language-Based Anomaly Detection in XML
摘要：
误报是基于异常的入侵检测系统中的一个问题。针对这个问题，我们讨论了异常检测的可扩展置标语言（XML）的语言理论的观点。我们认为，许多基于XML的攻击目标的语法水平，即树结构或元素的内容，和XML文档的语法验证减少了攻击面。XML提供了所谓的模式来进行验证，但在现实世界中，模式通常不可用、被忽略或过于通用。在这篇正在进行的论文中，我们描述了一种语法推理方法，从示例XML文档中学习自动机，用于检测具有异常语法的文档。我们讨论了XML的属性和表达能力，以理解可学习性的局限性。我们的贡献是一个XML模式兼容的词汇数据类型系统抽象的XML内容和学习算法明显下推自动机（VPA）直接从一组例子。该算法不需要XML的树表示，因此可以处理大型文档或流。然后，所得到的确定性VPA允许文档的流验证，以识别底层树结构或数据库中的偏差。
英文摘要：
False-positives are a problem in anomaly-based intrusion detection systems. To counter this issue, we discuss anomaly detection for the eXtensible Markup Language (XML) in a language-theoretic view. We argue that many XML-based attacks target the syntactic level, i.e. the tree structure or element content, and syntax validation of XML documents reduces the attack surface. XML offers so-called schemas for validation, but in real world, schemas are often unavailable, ignored or too general. In this work-in-progress paper we describe a grammatical inference approach to learn an automaton from example XML documents for detecting documents with anomalous syntax. We discuss properties and expressiveness of XML to understand limits of learnability. Our contributions are an XML Schema compatible lexical datatype system to abstract content in XML and an algorithm to learn visibly pushdown automata (VPA) directly from a set of examples. The proposed algorithm does not require the tree representation of XML, so it can process large documents or streams. The resulting deterministic VPA then allows stream validation of documents to recognize deviations in the underlying tree structure or datatypes.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
