Using Artificial Packets for Training Network Payload Anomaly Detection Systems.

Attacks on web servers are becoming increasingly prevalent, and the social and economic impact of a successful attack are also increasing. There are many existing attack detection and prevention schemes, which must be carefully configured and utilized together to provide the highest level of protection possible. To this end, we must continue to analyze existing techniques and develop new methods for practical deployment and implementation. In this paper, we present a study on utilizing artificially formed network packets to aid in tuning payload anomaly detection when real collected traffic may not be available (especially as concept-drift occurs) for continuous updates. Our results show that the method has potential for use for certain systems, where high detection rates can be achieved while maintaining low false positive rates.