ELSV: An Effective Anomaly Detection System from Web Access Logs

As network technologies have been developing rapidly, web applications have been widely used. Meanwhile, more and more web attacks have appeared. These attacks have caused a lot of losses to individuals or organizations. A large number of web access logs also bring huge challenges to the attack detection. In this paper, we propose a system ELSV(Ensemble Learning classification with Semantic Vectorization) to detect anomaly web access logs. We use the difference of word occurrence between different types of web access logs to refine the formatted log data, strengthening the distinction between them. The Word2Vec method and TextCNN model are applied to extract vectorized features, making feature extraction more automated and intelligent. We use the ensemble learning classification algorithm as the final classifier, improving the overall classification performance. ELSV is tested on the HTTP DATASET CSIC 2010. The final experimental results show that ELSV achieved 98.48% F1-score and 99.74% AUC, proving the efficacy of it.