Research Article
Enhancing Runtime Application Self-Protection with Unsupervised Deep Learning
@INPROCEEDINGS{10.1007/978-3-031-94445-1_11, author={Bolun Wu and Futai Zou and Mingyi Huang and Xin Sun and Jiajia Han}, title={Enhancing Runtime Application Self-Protection with Unsupervised Deep Learning}, proceedings={Security and Privacy in Communication Networks. 20th EAI International Conference, SecureComm 2024, Dubai, United Arab Emirates, October 28--30, 2024, Proceedings, Part I}, proceedings_a={SECURECOMM}, year={2026}, month={9}, keywords={Intrusion detection Runtime application self-protection Deep learning}, doi={10.1007/978-3-031-94445-1_11} }- Bolun Wu
Futai Zou
Mingyi Huang
Xin Sun
Jiajia Han
Year: 2026
Enhancing Runtime Application Self-Protection with Unsupervised Deep Learning
SECURECOMM
Springer
DOI: 10.1007/978-3-031-94445-1_11
Abstract
In contemporary cybersecurity landscapes, safeguarding web applications against diverse malicious attacks remains paramount for organizations. While conventional defense systems like WAF and IDS offer mitigation strategies, they are susceptible to circumvention or compromise. A more effective strategy involves implementing runtime application self-protection (RASP) directly within the web application. This approach has proven its efficacy by facilitating early detection of attacks. However, RASP often generates a significant number of false alarms and struggles to detect unknown attacks, necessitating extensive human scrutiny. To address these challenges, this paper introduces a novel approach by integrating unsupervised deep learning with Runtime Application Self-Protection (RASP) systems. Our method aims to detect genuine attacks from false alarms generated by RASP systems. To achieve this, we propose a novel fused neural network models capable of extracting features from various fields. Then we train an autoencoder model on RASP logs of normal behaviors (white samples). This model reconstructs features of white samples better than black samples, which can be used to detect real attacks by setting a threshold. Through extensive experimentation conducted on a real-world dataset comprising 260k RASP logs covering 11 types of attacking, our approach demonstrates exceptional efficacy, achieving a remarkable recall rate of 99.32% and a notably low false alarm rate of 0.66%.