Anomaly detection for weblog data analysis using weighted PCA technique

Abstract

Many methods have been developed to protect web servers against attacks. Anomaly detection methods rely on generic user models and application behavior, which interpret departures as indications of potentially dangerous behavior from the established pattern. However, due to a lack of evaluations and comparisons of various anomaly detection techniques, engineers may still decide which detection methods should not be used. Furthermore, even if engineers use an unusual detection technique, re-implementation will take a lifetime. We offer a comprehensive analysis and evaluation of six existing log-based detection techniques, including three monitored and three unchecked modes, as well as an open toolkit that allows for simple reuse, to address these problems. The different anomalies are detected with weighted PCA techniques. There are four datasets BGL, Liberty, Spirit & Thunderbird, which are used. The weighted PCA is compared with traditional KNN methods. The weighted PCA provided better results as compared to the KNN algorithm.

Subject Classification:

• 68xx
• 90xx

Keywords:

• Weighted PCA
• BGL
• Liberty
• Accuracy
• Precision rate