A Human-Machine Collaborative Detection Model for Identifying Web Attacks

Abstract

Machine learning plays an important part in detecting web attacks. However, it exhibits high false alarm rate due to the lacking of labeled data. Humans perform better than machines in attack recognition, while suffer from low bandwidth. In this paper, we adopt a collaborative detection model, based on machine learning augmented with human interaction to detect web attacks. We leverage human knowledge to continuously optimize the detection model and make machines smarter against fast-changing web attacks. To eliminate the bottleneck of humans, we design an selection mechanism which could recommend most suspicious anomaly behaviors for humans to correct the false decision of machines. In addition, we also define a human involvement ratio, k, to represent how much efforts that human contributes to the collaborative detection model. By tuning k, the model accuracy and human workloads could be effectively balanced. We conduct several comprehensive experiments to evaluate the effectiveness of our model using reallife datasets. The results demonstrate that our approach could significantly improve the detection accuracy compared with traditional machine learning approaches.