CNN-based Reduced Complexity Decision Confidence Estimation for Imbalanced Web Application Attack Detection

Seungyoung Park, Hansung Kim, Taejoon Jung

http://doi.org/10.5626/JOK.2020.47.9.842

As web application attacks have been rapidly increasing and their types have been diversified, there are limitations on detecting them with the existing schemes. To resolve this problem, the detection techniques using machine learning such as the convolutional neural network (CNN) have been proposed. However, the confidence on the decision error sample in these techniques has been unreliable. To estimate more reliable decision confidence, the Monte-Carlo batch normalization (MCBN) technique combined with the CNN has been proposed. In particular, the CNN performs multiple decisions on a given evaluation sample using multiple mini-batches containing it. Then, its decision confidence estimate is obtained by averaging the multiple decision results. However, it requires too large of a computational load. The reason is that each mini-batch comprises randomly selected (M-1) training samples and only one evaluation sample, when the mini-batch size is M. In this paper, we propose a reduced complexity decision confidence estimation scheme for imbalanced web application attack detection. Specifically, the proposed scheme reduces the computational load by up to M times compared to the MCBN scheme. Also, at the estimation process, the ratio of normal and attack samples in the mini-batch should be maintained the same as that of the training process. To achieve this, we found which class size was small by performing a temporal decision on the evaluation samples. Then, the small class was over-sampled using the training samples to maintain the ratio. Our experimental results showed that the performance improved, and the reliability estimation performance was not significantly degraded compared to the MCBN scheme.