Anomaly detection in web traffic using artificial immune algorithms

In recent years, different types of threats and attacks continue to increase in the internet world. There are also important developments in the security measures as a result of this situation. Increased number of users in network and web traffic and serious security vulnerabilities in the amount of shared data can directly lead to data leak. Preventing these data leaks to a large extent has become an important problem to solve. In particular, considering the studies conducted in this field, it is important to take error detection out of human error tolerance and connect it to a systematic and take precautions. Therefore, the rapid and accurate detection and prevention of abnormal changes in the rate of online visitors and web traffic data shown as time series is of great importance. Different methodologies and data classification techniques are used to detect abnormal traffic in network data. This problem is generally evaluated by classifying the signal windows by removing the feature. In this thesis, a method based on the Negative Selection Algorithm (NSA) of Artificial Immune Systems for the detection of abnormal web traffic on the network is proposed and a user-friendly application software is developed. For web traffic, the real data contained in the Yahoo Webscope S5 dataset is used and the data is split into windows using the window sliding method. In the experimental studies, the detection of abnormal traffic data in the web traffic data is realized by monitoring the changes in the number of activated detectors in the structure of the NSA. It is observed that the average performance of finding anomalies in a web traffic data is 94.30% and the overall classification rate is 97.69%.