김강문, 이인섭,

Vol. 34, No. 6, pp. 1231-1238, 12월. 2024
10.13089/JKIISC.2024.34.6.1231, Full Text:
Keywords: Anomaly Detection, Threat Detection, Access Log, Embedding, TF-IDF
Abstract

As the demand for web applications grows, the importance of security control increases, particularly for detecting webshell attacks that remotely access servers and execute malicious commands. Existing security measures, like web firewalls, can be bypassed and are vulnerable to unknown attacks. Therefore, an anomaly detection technique is needed to define normal behavior from log data and detect deviations. This study proposes a TF-IDF-based embedding technique to vectorize user behavior from web server access logs, thereby defining normal states and detecting anomalies, such as web shell attacks. The proposed method incorporates byte variation count to provide a more refined embedding of user behavior, enabling effective detection of abnormal states like web shell attacks.

Statistics
Cite this article