Web Servers Protection Using Anomaly Detection for HTTP Requests

Abstract

Many web servers are vulnerable to HTTP attacks and patching is not always possible, especially against 0 day exploits. We propose a solution able to learn the normal patterns in HTTP requests and reject those requests that do not match these normal patterns. The solution is mainly oriented towards IoT devices. These devices usually support a limited range of requests. Performance and energy consumption considerations prevents the usage of an internal security solution, while the firmware may be difficult to upgrade. The proposed system was able to protect the test servers, by deflecting most of the incoming attacks.