A Framework for Classifying Web Attacks While Respecting ML Requirements

Abstract

Injection and Cross Site Scripting attacks are among the ten critical security risks to web-based applications. It is difficult, to provide a complete signature for firewalls that detect such attacks. Therefore, there are several proposals based on Machine Learning (ML) methods capable of detecting various web attacks from evolutive, heterogeneous data at large scale, without the need for expert knowledge. Unfortunately, web attacks detection have been addressed only from a ML algorithm viewpoint, there is a lack of clarity regarding the quality and amount of the training data, the hyperparameters tuning and the evaluation method. Low and poor data quality may compromise the success of the most powerful ML methods. Additionally, it is easy to build a model that is perfectly adapted to the dataset but unable to generalize the new unseen data. This paper introduces F2MW, a framework for multi-classifying web attacks with respect to the ML requirements.