CLUSTERING BASED INTRUSION DETECTING IN MULTI-TIER WEB APPLICATIONS

This book presents Double Guard an IDS system that models the network behavior of user sessions across both the front-end web server and the back-end database. By monitoring both web and subsequent database requests it is possible to ferret out attacks that independent IDS would not be able to identify. Furthermore it is possible to quantify the limitations of any multi-tier IDS in terms of training sessions and functionality coverage. This work implemented Double Guard using an Apache web server with MySQL and lightweight virtualization.