一句话：提出基于一致性的正常性建模，检测并解释 Web 篡改攻击引发的运行时异常，缓解准确率与根因分析难题。
Web 应用前端易被客户端篡改以绕过验证，导致服务运行时异常。现有基于日志的深度学习异常检测虽有效，但正常日志与攻击日志差异细微时准确率不足，且异常发生后仍需额外根因分析。本文提出通过构建基于一致性的正常性来检测并解释此类篡改攻击异常：从正常行为中建立一致性约束或模型，将违反一致性的运行时行为判为异常，并据此定位和解释根因。给出的摘要未报告具体实验设置与结果，但方法目标在于同时提升检测准确性与可解释性。
Web applications are crucial infrastructures in the modern society, which have high demand of reliability and security. However, their frontend can be manipulable by the clients (e.g., the frontend code can be modified to bypass some validation steps), which incurs the runtime anomaly when operating the web service. Existing state-of-the-art anomaly detectors largely learn a deep learning model from the collected logs to predict abnormal logs with a probability. While effective in general, those approaches can suffer from (1) inaccuracy caused by subtle difference between the normal and abnormal/attack logs and (2) additional efforts for root cause analysis.
@inproceedings{paperbot8436,
title = {Detecting and Explaining Anomalies Caused by Web Tamper Attacks via Building Consistency-based Normality},
author = {Yifan Liao and Ming Xu and Yun Lin and Xiwen Teoh and Xiaofei Xie and Ruitao Feng and Frank Liaw and Hongyu Zhang and Jin Song Dong},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695024}
}