用双层机器学习模型提升网页防火墙的威胁识别准确率
Adaptive Dual-Layer Web Application Firewall (ADL-WAF) Leveraging Machine Learning for Enhanced Anomaly and Threat Detection
- 第一层决策树识别流量异常，第二层SVM分类异常类型
- 在五个数据集上达99.88%准确率，精确率达100%
- 适合需要低误报的高安全场景应用
Web应用防火墙对抵御各类网络攻击至关重要。传统WAF难以有效区分恶意与合法流量，导致检测效果有限。为此，本文提出一种自适应双层WAF（ADL-WAF），采用两层机器学习模型以提升异常和威胁检测精度。第一层使用决策树（DT）算法，通过识别流量偏离正常模式来检测异常；第二层采用支持向量机（SVM）将异常分类为威胁型或良性。ADL-WAF结合全面的数据预处理与特征工程，并在五个大型基准数据集上进行了充分评估。结果表明，该模型在五大数据集上实现了99.88%的检测准确率和100%的精确率，显著提升了异常检测能力并大幅降低误报率。研究证明，将机器学习技术融入WAF可大幅提升网页应用的安全性，实现更精准高效的威胁识别。
原文摘要 · Abstract (English)
Web Application Firewalls are crucial for protecting web applications against a wide range of cyber threats. Traditional Web Application Firewalls often struggle to effectively distinguish between malicious and legitimate traffic, leading to limited efficacy in threat detection. To overcome these limitations, this paper proposes an Adaptive Dual-Layer WAF employing a two-layered Machine Learning model designed to enhance the accuracy of anomaly and threat detection. The first layer employs a Decision Tree (DT) algorithm to detect anomalies by identifying traffic deviations from established normal patterns. The second layer employs Support Vector Machine to classify these anomalies as either threat anomalies or benign anomalies. Our Adaptive Dual Layer WAF incorporates comprehensive data pre-processing and feature engineering techniques and has been thoroughly evaluated using five large benchmark datasets. Evaluation using these datasets shows that ADL WAF achieves a detection accuracy of 99.88% and a precision of 100%, significantly enhancing anomaly detection and reducing false positives. These findings suggest that integrating machine learning techniques into WAFs can substantially improve web application security by providing more accurate and efficient threat detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。