A grammatical inference approach to language-based anomaly detection in XML

Research output: Chapter in Book/Report/Conference proceedingsConference contributionpeer-review

2 Citations (Scopus)

Abstract

False-positives are a problem in anomaly-based intrusion detection systems. To counter this issue, we discuss anomaly detection for the extensible Markup Language (XML) in a language-theoretic view. We argue that many XML-based attacks target the syntactic level, i.e. the tree structure or element content, and syntax validation of XML documents reduces the attack surface. XML offers so-called schemas for validation, but in real world, schemas are often unavailable, ignored or too general. In this work-in-progress paper we describe a grammatical inference approach to learn an automaton from example XML documents for detecting documents with anomalous syntax. We discuss properties and expressiveness of XML to understand limits of learn ability. Our contributions are an XML Schema compatible lexical data type system to abstract content in XML and an algorithm to learn visibly pushdown automata (VPA) directly from a set of examples. The proposed algorithm does not require the tree representation of XML, so it can process large documents or streams. The resulting deterministic VPA then allows stream validation of documents to recognize deviations in the underlying tree structure or data types.

Original languageEnglish
Title of host publicationProceedings - 2013 International Conference on Availability, Reliability and Security, ARES 2013
PublisherIEEE Computer Society Press
Pages685-693
Number of pages9
ISBN (Print)9780769550084
DOIs
Publication statusPublished - 2013
Event2013 8th International Conference on Availability, Reliability and Security, ARES 2013 - Regensburg, Germany
Duration: 2 Sep 20136 Sep 2013

Publication series

NameProceedings - 2013 International Conference on Availability, Reliability and Security, ARES 2013

Conference

Conference2013 8th International Conference on Availability, Reliability and Security, ARES 2013
CountryGermany
CityRegensburg
Period02.09.201306.09.2013

Keywords

  • Anomaly detection
  • Grammatical inference
  • Intrusion detection
  • XML

Fingerprint Dive into the research topics of 'A grammatical inference approach to language-based anomaly detection in XML'. Together they form a unique fingerprint.

Cite this