通过行为分析实现针对规避性 Web 扫描的应用内防御
In-Application Defense Against Evasive Web Scans through Behavioral Analysis
AI总结：
本文提出低开销应用内取证引擎 WebGuard，通过多模态行为监控及监督、无监督学习实时检测并归因自动化 Web 扫描器，显著提升检测速度与准确率。
摘要：
Web 流量已经演变为同时包含人类用户和自动化代理，范围从良性网络爬虫到对抗性扫描器，例如那些能够在 Web 规模上实施撞库、命令注入和账户劫持的扫描器。据估计，这些对抗性活动在 2023 年造成的财务成本超过数百亿美元。在本工作中，我们提出 WebGuard，这是一种低开销的应用内取证引擎，用于实现对自动化 Web 扫描器的稳健识别和监控，并帮助缓解相关安全风险。WebGuard 关注以下设计准则：（i）在不更改底层软件组件或基础设施的情况下集成到 Web 应用中；（ii）最小通信开销；（iii）实时检测能力，例如在数百毫秒内完成；以及（iv）归因能力，用于识别新的行为模式并检测新兴代理类别。为此，我们为 WebGuard 配备了多模态行为监控机制，例如监控时空数据和浏览器事件。我们还设计了监督和无监督学习架构，分别用于人类与自动化代理的实时检测和离线归因。信息论分析和实证评估表明，与仅依赖鼠标移动动态的单模态分析相比，多模态数据分析显著改善了检测时间和归因准确率。本文给出了使用通过 WebGuard 收集的真实数据进行的多项数值评估，结果在数百毫秒内实现了高准确率，且通信开销低于每秒 10 KB。
英文摘要：
Web traffic has evolved to include both human users and automated agents, ranging from benign web crawlers to adversarial scanners such as those capable of credential stuffing, command injection, and account hijacking at the web scale. The estimated financial costs of these adversarial activities are estimated to exceed tens of billions of dollars in 2023. In this work, we introduce WebGuard, a low-overhead in-application forensics engine, to enable robust identification and monitoring of automated web scanners, and help mitigate the associated security risks. WebGuard focuses on the following design criteria: (i) integration into web applications without any changes to the underlying software components or infrastructure, (ii) minimal communication overhead, (iii) capability for real-time detection, e.g., within hundreds of milliseconds, and (iv) attribution capability to identify new behavioral patterns and detect emerging agent categories. To this end, we have equipped WebGuard with multi-modal behavioral monitoring mechanisms, such as monitoring spatio-temporal data and browser events. We also design supervised and unsupervised learning architectures for real-time detection and offline attribution of human and automated agents, respectively. Information theoretic analysis and empirical evaluations are provided to show that multi-modal data analysis, as opposed to uni-modal analysis which relies solely on mouse movement dynamics, significantly improves time-to-detection and attribution accuracy. Various numerical evaluations using real-world data collected via WebGuard are provided achieving high accuracy in hundreds of milliseconds, with a communication overhead below 10 KB per second.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
