1

I'm wondering how to successfully detect malicious activity in my web server traffic?

Could you point me out some popular solutions which can help me to detect attacks on my web application?

I didn't find similar questions with sufficient answer.

I will appreciate any answer.

B

  • Anomalous activity might just mean that you hit the front page of reddit. – Christian Jan 8 '14 at 12:32
  • @Christian - typically one doesn't browse the internet from their web server. Your comment is geared towards a desktop or other client device browsing. – user2320464 Jan 9 '14 at 0:59
  • @Christian - of course, you're right. This is one of type of anomalous traffic I would like to monitor as well. But it would be good to have information also about another events like headers fuzzing, parameters enumeration etc. – boleslaw.smialy Jan 9 '14 at 12:42
6

It sounds like what you're looking to do is intrusion detection, but at a web application level (layer 7). This is usually referred to as a Web Application Firewall (WAF).

(Note the differences between a network IDS/IPS and a WAF: http://www.sans.org/security-resources/idfaq/ips-web-app-firewall.php)

Web Application Firewalls are generally designed to prevent as well as detect/alert, although they hold the key ability to analyse web traffic for suspected malicious activity. As a general rule they seem include logging and alerting capabilities in addition to the prevention.

Some potential solutions include:

A list of WAFs from OWASP: https://www.owasp.org/index.php/Web_Application_Firewall

These are examples of popular implementations rather than personal recommendations.

3

Actually we can't predict which attack your server might get so possibly its very difficult to implement perfect security system.

But you can avoid it and you need to upgrade it again and again. The following are possible solutions to monitor web server traffic,

  1. Usually attacker used to send very small picket sizes (in bits) that firewall can't check and resist so you should make your firewall strong.
  2. Use of antivirus program.
  3. Use of packet analyser tool to monitor traffic (kind of manual work needed to be done here).

And possibly ready this document will help you little more

  • Thanks for you reply! I already review logs and I have antivirus. I was rather thinking about "packet analyser tool to monitor traffic". Some program/script which could help me to detect anomalies from webtraffic. If there is a lot of traffic it is easy to miss something in logs. – boleslaw.smialy Jan 8 '14 at 13:18
  • @boleslaw.smialy: Ya that's why earlier I mentioned we can't predict... Probably its an activity where you needed to be updated daily, and its a research topic... – Rohit Jan 8 '14 at 15:49
  • @Rohit - There are ways to predict malicious traffic. That is the basis for creating signatures used by IDS/IPS/ModSecurity/etc. – user2320464 Jan 9 '14 at 1:03
  • @user2320464: Thnx for your information, I will check it out.....!!! :) – Rohit Jan 9 '14 at 3:20
1

You should know what is the expected traffic, and also, you should have a performance baseline. If you see something is off boundaries, then you know something is happening and you have to further research the problem, checking web server's log, firewall 's log, IDS' log, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.