Abstract
As a crucial part of web servers, web logs record information about client requests. Logs contain not only the traversal sequences of malicious users but the operations of normal users. Taking advantage of web logs is important for learning the operation of websites. Furthermore, web logs are helpful when conducting postmortem security analysis. However, common methods of analyzing web logs typically focus on discovering preferred browsing paths or improving the structure of website, and thus can not be used directly in security analysis. In this paper, we propose an approach to mining frequent attack sequence based on PrefixSpan. We perform experiments on real data, and the evaluations show that our method is effective in identifying both the behavior of scanners and attack sequences in web logs.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Awstats. http://www.awstats.org/
Piwik. http://piwik.org/
Splunk. http://www.splunk.com/
Cooley, R., Mobasher, B., Srivastava, J.: Data preparation for mining world wide web browsing patterns. Knowl. Inf. Syst. 1, 5–32 (1982)
Dziczkowski, G., Wegrzyn-Wolska, K., Bougueroua, L.: An opinion mining approach for web user identification and clients’ behaviour analysis. In: 2013 Fifth International Conference on Computational Aspects of Social Networks (CASoN), pp. 79–84. IEEE (2013)
Han, J., Pei, J., Mortazavi-Asl, B., et al.: FreeSpan: frequent pattern-projected sequential pattern mining. In: Sixth ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 355–359. ACM (2000)
He, J.: Mining users potential interested in personalized information recommendation service. J. Mod. Inf. (2013)
Li, Y., Feng, B.Q., Mao, Q.: Research on path completion technique in web usage mining. In: International Symposium on Computer Science and Computational Technology, pp. 554–559. IEEE (2008)
Kewen, L.: Analysis of preprocessing methods for web usage data. In: 2012 International Conference on Measurement, Information and Control (MIC), pp. 383–386. IEEE (2012)
Mele, I.: Web usage mining for enhancing search-result delivery and helping users to find interesting web content. In: Proceedings of the Sixth ACM International Conference on Web Search and Data Mining, pp. 765–770. ACM (2013)
Nasraoui, O.: Web data mining: exploring hyperlinks, contents, and usage data. ACM SIGKDD Explor. Newsl. 10, 23–25 (2009)
Provos, N., Mcnamee, D., Mavrommatis, P., et al.: The ghost in the browser analysis of web-based malware. In: Usenix Hotbots (2007)
Srivastava, J., Cooley, R., Deshpande, M., et al.: Web usage mining: discovery and applications of usage patterns from web data. ACM SIGKDD Explor. Newsl. 1(2), 12–23 (2000)
Suresh, R.M., Padmajavalli, R.: An overview of data preprocessing in data and web usage mining. In: 2006 1st International Conference on Digital Information Management (2006)
Ting, I.H., Kimble, C., Kudenko, D.: Applying web usage mining techniques to discover potential browsing problems of users. In: IEEE International Conference on Advanced Learning Technologies, pp. 929–930. IEEE Computer Society (2007)
Varnagar, C.R., Madhak, N.N., Kodinariya, T.M., et al.: Web usage mining: a review on process, methods and techniques. In: International Conference on Information Communication and Embedded Systems (ICICES) 2013, pp. 40–46. IEEE (2013)
Wang, T., He, P.L.: User identification in web mining and iris recognition technology. Comput. Eng. 34(6), 182–184 (2008)
Pei, J., Han, J., Mortazavi-Asl, B., et al.: Mining sequential patterns by pattern-growth: the PrefixSpan approach. IEEE Trans. Knowl. Data Eng. 16(11), 1424–1440 (2004)
Qin, C., Liao, C.: Session identification based on linked referrers and web log indexing. Comput. Syst. Sci. Eng. 25(8), 273–286 (2013)
Agrawal, R., Srikant, R.: Mining sequential patterns. In: Proceedings of ICDE, pp. 3–14. IEEE Computer Society (1995)
Srikant, R., Agrawal, R.: Mining sequential patterns: generalizations and performance improvements. In: Apers, P., Bouzeghoub, M., Gardarin, G. (eds.) EDBT 1996. LNCS, vol. 1057, pp. 1–17. Springer, Heidelberg (1996)
Acknowledgment
This research was supported in part by the National Science Foundation of China under grants 61173166, 61272190, and 61572179, the Program for New Century Excellent Talents in University, and the Fundamental Research Funds for the Central Universities of China.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2016 Springer International Publishing Switzerland
About this paper
Cite this paper
Sun, H., Sun, J., Chen, H. (2016). Mining Frequent Attack Sequence in Web Logs. In: Huang, X., Xiang, Y., Li, KC. (eds) Green, Pervasive, and Cloud Computing. Lecture Notes in Computer Science(), vol 9663. Springer, Cham. https://doi.org/10.1007/978-3-319-39077-2_16
Download citation
DOI: https://doi.org/10.1007/978-3-319-39077-2_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-39076-5
Online ISBN: 978-3-319-39077-2
eBook Packages: Computer ScienceComputer Science (R0)