BLADE: Behavior-Level Anomaly Detection Using Network Traffic in Web Services

TL;DR

BLADE is an unsupervised system that detects both flow-level and behavior-level anomalies in web service network traffic by analyzing multi-flow communication patterns using autoencoders and clustering.

Contribution

It introduces a novel approach combining autoencoders, clustering, and one-class classification to identify behavior-level attacks in web services, surpassing traditional flow-based methods.

Findings

Achieves high F1 scores of 0.9732 and 0.9801 on two datasets.

Outperforms traditional single-flow anomaly detection baselines.

Effectively detects behavior-level attacks in web service traffic.

Abstract

With their widespread popularity, web services have become the main targets of various cyberattacks. Existing traffic anomaly detection approaches focus on flow-level attacks, yet fail to recognize behavior-level attacks, which appear benign in individual flows but reveal malicious purpose using multiple network flows. To transcend this limitation, we propose a novel unsupervised traffic anomaly detection system, BLADE, capable of detecting not only flow-level but also behavior-level attacks in web services. Our key observation is that application-layer operations of web services exhibit distinctive communication patterns at the network layer from a multi-flow perspective. BLADE first exploits a flow autoencoder to learn a latent feature representation and calculates its reconstruction losses per flow. Then, the latent representation is assigned a pseudo operation label using an unsupervised clustering method. Next, an anomaly score is computed based on the reconstruction losses. Finally, the triplets of timestamps, pseudo labels, and anomaly scores from multiple flows are aggregated and fed into a one-class classifier to characterize the behavior patterns of legitimate web operations, enabling the detection of flow-level and behavior-level anomalies. BLADE is extensively evaluated on both the custom dataset and the CIC-IDS2017 dataset. The experimental results demonstrate BLADE's superior performance, achieving high F1 scores of 0.9732 and 0.9801, respectively, on the two datasets, and outperforming traditional single-flow anomaly detection baselines.