BLADE: Behavior-Level Anomaly Detection Using Network Traffic in Web Services

TL;DR

BLADE addresses the challenge of detecting both flow-level and behavior-level attacks in web services by exploiting multi-flow network patterns with a fully unsupervised pipeline. It combines a flow autoencoder (BiGRU with self-attention) to learn latent representations, a pseudo operation labeling step via PCA whitening and HDBSCAN clustering, ECDF-based anomaly scoring per feature channel, and a multi-flow detector using an extractor and an OCSVM. Key contributions include (i) enabling behavior-level anomaly detection from encrypted, multi-flow traffic, (ii) proposing pseudo operation labels to capture operation-specific patterns, and (iii) demonstrating state-of-the-art F1 scores on a custom dataset and CIC-IDS2017, validating effectiveness for flow- and behavior-level attacks. The approach is unsupervised and adaptive, suitable for deployment at web gateways, with practical impact for securing web services against evolving multi-flow threats.

Abstract

With their widespread popularity, web services have become the main targets of various cyberattacks. Existing traffic anomaly detection approaches focus on flow-level attacks, yet fail to recognize behavior-level attacks, which appear benign in individual flows but reveal malicious purpose using multiple network flows. To transcend this limitation, we propose a novel unsupervised traffic anomaly detection system, BLADE, capable of detecting not only flow-level but also behavior-level attacks in web services. Our key observation is that application-layer operations of web services exhibit distinctive communication patterns at the network layer from a multi-flow perspective. BLADE first exploits a flow autoencoder to learn a latent feature representation and calculates its reconstruction losses per flow. Then, the latent representation is assigned a pseudo operation label using an unsupervised clustering method. Next, an anomaly score is computed based on the reconstruction losses. Finally, the triplets of timestamps, pseudo labels, and anomaly scores from multiple flows are aggregated and fed into a one-class classifier to characterize the behavior patterns of legitimate web operations, enabling the detection of flow-level and behavior-level anomalies. BLADE is extensively evaluated on both the custom dataset and the CIC-IDS2017 dataset. The experimental results demonstrate BLADE's superior performance, achieving high F1 scores of 0.9732 and 0.9801, respectively, on the two datasets, and outperforming traditional single-flow anomaly detection baselines.

Figures (5)

• Figure 1: Threat model.
• Figure 2: Framework of BLADE.
• Figure 3: t-SNE visualization of malicious and benign traffic.
• Figure 4: Performance of different clustering algorithms.
• Figure 5: Performance comparison between BLADE and flow-level baselines on the custom and CIC-IDS2017 datasets.