Data mining for web application attacks analysis

The greatest challenge of web application attack investigations is dealing with the huge amount of data, the level of complexity of the web application integration technology and the huge number of sophisticated attacks. There is a need for more intelligent and convenient techniques for better web application attack investigations. Data mining and machine learning might aid to analyze and investigate web application attacks. This study proposes a framework for web application attacks forensic by applying data mining models. To date, there has not been an adequate approach to apply data mining technique to find web attack digital evidence. In this study, a hybrid approach is proposed for the feature selection and a data mining framework is proposed for web application forensics process. This framework has been validated by experimental measurements on three different web attack datasets. The results show that our proposed framework can find evidence with high recall, high accuracy and low error rates. We believe that the results presented herein may help to improve accuracy and recall of data mining techniques; particularly in the field of web attack investigation. The solution that will utilize this framework may help in digital forensic investigation and provide aid to experts and law enforcement in finding digital evidence significantly more productively and quicker.