HTTP Anomaly Detection

This project is a lightweight reverse proxy written in Go. The magic is that malicious requests are simply not accepted!

How does it work?

The idea is simple: we train an autoencoder on benign HTTP payloads, teaching it to compress the features of such a packet into a compact, reduced representation and then decode it to reproduce the original features. Decoding is not perfect, however; the more a payload differs from those found in the training data (benign packets) the worse the model will be at recomputing the original input.

This, by design, leads to a situation where regular, benign packets are reconstructed with very low error while malicious packets produce reconstructions that differ significantly from the input (high error). We can then use various methods for selecting an error threshold, where any packets that fall above this threshold (cannot be sufficiently decoded by the model) are rejected on suspicion of being malicious.

Threshold Selection

Bring Your Own Model