An Effective Unsupervised Cyber Attack Detection on Web Applications Using Gaussian Mixture Model

Abstract

Due to the popularity of web applications, web attacks have become more prevalent and sophisticated, which poses a threat to cyber security. Many works have proposed training a supervised learning model to detect these attacks, which has also been demonstrated to deliver a high detection rate. However, this methodology is challenging to deploy in the real world. Firstly, it demands a sufficiently annotated dataset, which is often difficult and costly to collect. Secondly, a supervised learning-based detection system could only detect new variants of known attacks while unable to detect novel attack types. Recognizing these challenges, this paper introduces an unsupervised approach that employs a Gaussian Mixture Model (GMM) for web attack detection. This approach not only eliminates the need for annotated datasets but also improves the ability to detect zero-day attacks, as it only requires training on normal data. Our experiments on CSIC2012, AIoT-Sol, and SR-BH 2020 show that our proposal achieves high accuracy and F1-score, both of 91%, demonstrating the potential of unsupervised learning in web attack detection.