Deep Neural Network Intrusion Detection for Web Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems for web applications are inadequate in detecting unknown attacks and false alarms, particularly due to their reliance on signature-based analysis, which struggles with zero-day attacks and new malware.
Innovation Solution
A deep-learning-based intrusion detection method using a deep neural network (DNN) model that preprocesses traffic data by classifying attributes, removing special characters, and embedding words into vectors, allowing the system to detect security threats bypassing signature-based detection schemes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based analysis is used for intrusion detection, then detection accuracy for known attacks is improved, but the system cannot detect unknown attacks such as zero-day attacks
Solution Approach 1:
The patent transforms the intrusion detection approach by changing the parameter from signature matching to deep learning-based feature extraction. The DNN model processes raw HTTP traffic data and automatically learns attack patterns, enabling detection of both known and unknown attacks without relying on pre-defined signature lists.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a neural network-based intelligent system. The DNN model substitutes the rigid rule-based detection mechanism with a flexible learning-based system that can adapt to new attack types by learning from training data.
2Reliability
If signature-based analysis is used for intrusion detection, then false positives can be reduced with accurate signatures, but the system requires maintenance of up-to-date signature lists
Solution Approach 1:
The patent implements a self-updating detection system where the DNN model automatically learns and adapts to new attack patterns through continuous training on updated datasets. This eliminates the manual maintenance burden of signature lists, as the model self-improves by learning from new training data without requiring explicit signature updates.
Solution Approach 2:
The patent performs preliminary training of the DNN model on comprehensive attack datasets before deployment. This preliminary learning phase enables the model to establish robust detection capabilities in advance, reducing false positives by learning the true distribution of normal and malicious traffic patterns before actual detection begins.
3Adaptability or versatility
If deep neural network models are used for intrusion detection, then detection of unknown attacks is improved, but the system complexity increases
Solution Approach 1:
The patent segments the intrusion detection task into distinct processing stages: data preprocessing, feature extraction, and classification. The DNN model is divided into multiple layers (embedding layer, convolutional layers, pooling layers, fully connected layers) that progressively transform raw input into detection decisions, making the complex system more manageable and interpretable.
4Reliability
If deep neural network models are used for intrusion detection, then false positives are reduced, but processing time increases
Solution Approach 1:
The patent performs preliminary training of the DNN model on comprehensive attack datasets before deployment. This preliminary learning phase enables the model to establish robust detection capabilities in advance, reducing false positives by learning the true distribution of normal and malicious traffic patterns before actual detection begins.
Data Source
AI summary
The present invention relates to a deep-learning-based intrusion detection method, a system and a computer program for web applications, and more particularly, to a method, a system and a computer program for detecting whether the traffic is a hacker attack, based on an output from a deep neural network (DNN) model after setting network traffic flowing into a server farm as an input of the model. The present invention provides an effective intrusion detection system by utilizing deep neural networks in the form of complicated messages of the Web service protocol (hypertext transfer protocol (HTTP)), which is most general and representative for a company, among various application-layered services. In particular, the present invention provides a web application threat detection method, a system and a computer program implementing the same that are configured to determine security threats bypassing and intruding the detection scheme of the signature-based security system.