Empowering Intrusion Detection Systems in Multitier Web Applications Using Clustering Algorithms?

The Internet, which can be defined as a huge network of networks - both wired and wireless, uses the Internet Protocol Suite (TCP/IP) to make information available beyond geographical boundaries. Computing devices all through the world connect to the World Wide Web via the Client Server architecture. In this architecture, the client requests some information from a web server through a web browser. The web server connects to a database server in turn to fetch data. The connection between the web server and the database is the one that needs to be well secured. This project presents a system used to detect attacks in multi-tiered web services and classify through clustering Algorithm. This approach can create normality models of isolated user sessions that include both the web front-end (HTTP) and back-end (File or SQL) network transactions with respect to Data volumes and Classify them. The project implements a lightweight virtualization technique to assign each user’s web session to a dedicated container, an isolated virtual computing environment. The system then use clustering algorithm to accurately associate each web request with the subsequent DB queries and build a causal mapping profile by taking both the web server and DB traffic into account. Finally the system is able to detect attacks both in static and dynamic websites with 100 percent accuracy by reducing the processing time.