Collective Detection Of Harmful Requests
summary
Uses a compact behavior graph of URL transitions (edge weights decay over time) to flag rare traversals, shares MD5 hashes of stripped URLs across servers for collective hashing to confirm hits, and reports suspicious requests without leaking raw parameters. On small public servers the system detects about 30% of attack attempts with no false positives; limitations include session identification, filtering browser asset loads (favicon dot ico etc), low-traffic learning time, and changes to site structure.
AI-written summary · about
chapters (5)
- 0:00Start
- 3:33There are several classes of the attacks
- 10:28Effective representations of large log data sets
- 12:23Assembly of sessions from the requests
- 22:21Tests ran for a year on three (small) servers
related talks
37mAutomatic Extraction of Indicators of Compromise for Web App.
46mNavigating The Landscape Of Client-Side Request Hijacking On The Web
15mUnsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety...
01h 02mMonitoring the net for violent extremist material.
50mDeep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge
52mKnock Knock: Understanding Who is Using Your Web Applications
41mRed Phish, Blue Phish: Improved Phishing Detection Using Perceptual Hashing
29mStandard Classification: Good Bot, Bad Bot: Characterizing Automated Brows...