<abstract xmlns="http://www.w3.org/1999/xhtml">

<p>Designing a security solution should rely on having a good knowledge of the protected assets and better develop active responses rather than focus on reactive ones. We argue and prove that malicious activities such as vulnerabilities exploitation and (D)DoS on Web applications can be detected during their respective initial phases. While they may seem distinct, both attack scenarios are observable through abnormal access patterns. Following on this remark, we first analyze Web access logs using association rule mining techniques and identify these malicious traces. This new description of the historical data is then correlated with Web site structure information and mapped over <italic>trie</italic> data structures. The resulted <italic>trie</italic> is then used for every new incoming request and we thus identify whether the access pattern is legitimate or not. The results we obtained using this proactive approach show that the potential attacker is denied the required information for orchestrating successful assaults.</p>
</abstract>

Designing a security solution should rely on having a good knowledge of the protected assets and better develop active responses rather than focus on reactive ones. We argue and prove that malicious activities such as vulnerabilities exploitation and (D)DoS on Web applications can be detected during their respective initial phases. While they may seem distinct, both attack scenarios are observable through abnormal access patterns. Following on this remark, we first analyze Web access logs using association rule mining techniques and identify these malicious traces. This new description of the historical data is then correlated with Web site structure information and mapped over trie data structures. The resulted trie is then used for every new incoming request and we thus identify whether the access pattern is legitimate or not. The results we obtained using this proactive approach show that the potential attacker is denied the required information for orchestrating successful assaults.

Application of Association Rule Mining in Preventing Cyberattacks

“Gheorghe Asachi” Technical University of Iași

Bulletin of the Polytechnic Institute of Iași. Electrical Engineering, Power Engineering, Electronics Section

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

{"article-title":"Application of Association Rule Mining in Preventing Cyberattacks"}

Designing a security solution should rely on having a good knowledge of the protected assets and better develop active responses rather than focus on reactive...

Application of Association Rule Mining in Preventing Cyberattacks

Published Online: Sep 22, 2022

Page range: 25 - 41

Received: Dec 11, 2021

Accepted: Dec 29, 2021

DOI: https://doi.org/10.2478/bipie-2021-0020

Keywords
cybersecurity, data mining, association rule mining, proactive security, IDPS

© 2021 Cătălin Mironeanu et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Application of Association Rule Mining in Preventing Cyberattacks

Published Online: Sep 22, 2022

Page range: 25 - 41

Received: Dec 11, 2021

Accepted: Dec 29, 2021

DOI: https://doi.org/10.2478/bipie-2021-0020

Keywordscybersecurity, data mining, association rule mining, proactive security, IDPS

© 2021 Cătălin Mironeanu et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Keywords
cybersecurity, data mining, association rule mining, proactive security, IDPS