在Web应用攻击检测的特征选择中捕获安全专家知识
Capturing the security expert knowledge in feature selection for web application attack detection
AI总结：
本文提出利用互信息值复制安全专家知识进行特征选择，结合监督学习与半监督One-Class SVM模型训练，有效提升了Web应用防火墙的攻击检测性能并降低了误报。
摘要：
本文提出使用互信息值来复制安全专业人员在选择检测Web攻击特征时的专业知识。目标是提升Web应用防火墙（WAFs）的有效性。Web应用经常容易受到各种安全威胁，使得WAFs对其保护至关重要。WAFs使用基于规则的方法分析HTTP流量，以识别已知的攻击模式，并检测和阻止潜在的恶意请求。然而，一个主要挑战是误报的发生，这可能导致阻止合法流量并影响应用程序的正常功能。该问题通过一种结合用于特征选择的监督学习和用于训练One-Class SVM模型的半监督学习场景的方法来解决。实验结果表明，使用所提算法选择的特征训练的模型在性能上优于基于专家的选择方法。此外，使用基础OWASP CRS规则集配置的传统基于规则的WAF ModSecurity所获得的结果也得到了改善。
英文摘要：
This article puts forward the use of mutual information values to replicate the expertise of security professionals in selecting features for detecting web attacks. The goal is to enhance the effectiveness of web application firewalls (WAFs). Web applications are frequently vulnerable to various security threats, making WAFs essential for their protection. WAFs analyze HTTP traffic using rule-based approaches to identify known attack patterns and to detect and block potential malicious requests. However, a major challenge is the occurrence of false positives, which can lead to blocking legitimate traffic and impact the normal functioning of the application. The problem is addressed as an approach that combines supervised learning for feature selection with a semi-supervised learning scenario for training a One-Class SVM model. The experimental findings show that the model trained with features selected by the proposed algorithm outperformed the expert-based selection approach in terms of performance. Additionally, the results obtained by the traditional rule-based WAF ModSecurity, configured with a vanilla set of OWASP CRS rules, were also improved.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
