Clustering Based Intrusion Detecting in Multi-Tier Web Applications

This book presents Double Guard, an IDS system that models the network behavior of user sessions across both the front-end web server and the back-end database. By monitoring both web and subsequent database requests, it is possible to ferret out attacks that independent IDS would not be able to identify. Furthermore, it is possible to quantify the limitations of any multi-tier IDS in terms of training sessions and functionality coverage. This work implemented Double Guard using an Apache web server with MySQL and lightweight virtualization.