Enhancing Runtime Application Self-Protection with Unsupervised Deep Learning

doi:10.1007/978-3-031-94445-1_11

Enhancing Runtime Application Self-Protection with Unsupervised Deep Learning

2026-01-01

0

PRE

AI

DOI：10.1007/978-3-031-94445-1_11

Original

Original request for help

Save

Abstract

En 中文

In contemporary cybersecurity landscapes, safeguarding web applications against diverse malicious attacks remains paramount for organizations. While conventional defense systems like WAF and IDS offer mitigation strategies, they are susceptible to circumvention or compromise. A more effective strategy involves implementing runtime application self-protection (RASP) directly within the web application. This approach has proven its efficacy by facilitating early detection of attacks. However, RASP often generates a significant number of false alarms and struggles to detect unknown attacks, necessitating extensive human scrutiny. To address these challenges, this paper introduces a novel approach by integrating unsupervised deep learning with Runtime Application Self-Protection (RASP) systems. Our method aims to detect genuine attacks from false alarms generated by RASP systems. To achieve this, we propose a novel fused neural network models capable of extracting features from various fields. Then we train an autoencoder model on RASP logs of normal behaviors (white samples). This model reconstructs features of white samples better than black samples, which can be used to detect real attacks by setting a threshold. Through extensive experimentation conducted on a real-world dataset comprising 260k RASP logs covering 11 types of attacking, our approach demonstrates exceptional efficacy, achieving a remarkable recall rate of 99.32% and a notably low false alarm rate of 0.66%.

Keywords:

Intrusion detection

Runtime application self-protection

Deep learning

Enhancing Runtime Application Self-Protection with Unsupervised Deep Learning

Abstract

Journal

Organization