一句话：从 API schema 推断可解释不变式，用正常日志筛选后生成 Python 代码检测 Web 异常，显著优于日志学习基线。
现代 Web 应用依赖 Web API，但异常行为（如 Web 篡改攻击）的日志常与正常日志高度相似甚至完全相同，且日志噪声会误导日志学习模型学到伪相关，难以发现涉及数据库或会话状态的异常。本文提出 MINES，从 schema 层面而非原始日志实例推断可解释的 API 不变式：先将 API 签名转换为表模式以增强数据库模式，再利用 LLM 在给定表结构下抽取潜在关系与约束（如引用约束、检查约束），并用正常日志实例接受或拒绝候选不变式，最后将其翻译为可执行 Python 代码以校验运行时日志。在 Train-Ticket、NiceFish、Gitea、Mastodon 与 NextCloud 的 Web 篡改攻击基准上，MINES 相比 LogRobust、LogFormer 与 WebNorm 召回率提升逾 14%，同时几乎不引入误报，达到新的最优水平。
Detecting the anomalies of web applications, important infrastructures for running modern companies and governments, is crucial for providing reliable web services. Many modern web applications operate on web APIs (e.g., RESTful, SOAP, and WebSockets), their exposure invites intended attacks or unintended illegal visits, causing abnormal system behaviors. However, such anomalies can share very similar logs (sometimes even identical logs) with normal logs, missing crucial information (which could be in database) for log discrimination. Further, log instances can be also noisy, which can further mislead the state-of-the-art log learning solutions to learn spurious correlation, resulting superficial models and rules for anomaly detection. In this work, we propose MINES which infers explainable API invariants for anomaly detection from the schema level instead of detailed raw log instances, which can (1) significantly discriminate noise in logs to identify precise normalities and (2) detect abnormal behaviors beyond the instrumented logs (e.g., regarding the database state or session state). Our learned invariants can capture API preconditions such as (1) “what is the legitimate database state to initiate the call events?” and (2) “what are the constraints to satisfy between different API calls?”. Then we translate the invariants into executable Python code to verify its consistency with the runtime logs. Technically, MINES (1) converts API signatures into table schema to enhance the original database shema; and (2) infers the potential database constraints (such as reference constraint and check constraints) on the enhanced database schema to capture the potential relationships between APIs and database tables. MINES uses LLM for extracting potential relationship based on two given table structures; and use normal log instances to reject and accept LLM-generated invariants. Finally, MINES translates the inferred constraints into invariants to generate Python code for verifying the runtime logs. We extensively evaluate MINES on web-tamper attacks on the benchmarks of Train-Ticket, NiceFish, Gitea, Mastodon, and NextCloud against baselines such as LogRobust, LogFormer, and WebNorm. The results show that MINES achieves high recall (more than 14% over LogRobust, LogFormer, and WebNorm) for the anomalies while introducing almost zero false positives, indicating a new state-of-the-art.
@inproceedings{abs-2512-06906,
title = {MINES: Explainable Anomaly Detection through Web API Invariant Inference},
author = {Wenjie Zhang and Yun Lin and Chun Fung Amos Kwok and Xiwen Teoh and Xiaofei Xie and Frank Liauw and Hongyu Zhang and Jin Song Dong},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773160}
}