DMCA
Advanced Mechanism for Reducing False Alarm Rate in Web Page Defacement Detection
BibTeX
@MISC{Kim_advancedmechanism,
author = {Woonyon Kim and Jeongmoon Lee and Eungki Park and Sangwook Kim},
title = {Advanced Mechanism for Reducing False Alarm Rate in Web Page Defacement Detection},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract. These days a web server has become the focal point of most organizations. For this reason, a web server is one of the main targets of an attack from a hacker. Detecting web page defacements is one of the main services for the security moni-toring and controlling system. Users request a web page from the web server via the internet, and then the web server generates and sends a page at the requested time to the user by running a server-side script or querying database. So the web page is dynamically changing its content as time passes. This is one of the difficul-ties in detecting web page defacements from a remote site. In this paper we pro-pose a mechanism for detecting web page defacements at a remote site and a method for a threshold adjustment. For a detection mechanism, we generated a fea-ture vector for each web page by using 2-gram frequency index, which calculates the similarity between the current feature vector and the previous feature vector, and decides whether the page has been defaced or not by comparing the similarity of the current threshold with the threshold of the previous page. Before starting a detection process, we run an initial threshold generation process during a certain period of time. For the threshold adjustment method, we used two types of thresh-old adjustment methods. One is the daily adjustment method and the other is the threshold trend adjustment method. The first is applied two times a day by a weighted moving average of the threshold. The latter is applied during every detec-tion process by applying the difference of the two thresholds from the recent to the current threshold. These two threshold adjustment methods can reduce the false alarm rate. 1
Keyphrases
false alarm rate advanced mechanism web page defacement web page defacement detection web server web page remote site current threshold adjustment method threshold adjustment method detection process fea-ture vector weighted moving average initial threshold generation process requested time threshold adjustment server-side script main service main target thresh-old adjustment method previous feature vector detec-tion process focal point web server generates previous page time pass threshold trend adjustment method detection mechanism current feature vector 2-gram frequency index security moni-toring certain period daily adjustment method
