A method for intrusion detection in web services based on time series

Abstract

A prevalent issue in today's society that has attracted much attention is anomaly detection in time series. Service-oriented architecture (SOA) and web services are considered as one of the most important technologies. In this paper, we propose a model for intrusion detection in web services based on the autoregressive integrated moving average (ARIMA). First, we apply the ARIMA model to the training data. Second, we forecast their next behavior within a specific confidence interval. Third, we examine the testing data; if any instance falls out of the range of the confidence interval, it might be an anomaly, and the system will notify the administrator. We present experiments and results obtained using real world data.