Libsie, Mulugeta (PhD)Kassie, Yitayal2021-07-302023-11-042021-07-302023-11-0410/5/2020http://etd.aau.edu.et/handle/123456789/27496World Wide Web is a vastly resource full of knowledge, entertainment and cultural exchange of the planet. In today’s world, more than half of world’s population use Internet for their day to day activities, their life much more depends on Internet services. Due to this, the Web is the number one targeted versatile attack. To detect the attack many works have been done, but events (HTTP request packet payload) correlation based web attack detection has got less attention, as payload is the key attackers used for attacking application layer. In order to solve such a problem, we have proposed and implemented an event correlation based web attack detection using deep learning approaches. The aim of our proposed system is based on the correlation of events increasing the detection capability for the current sophisticated web attacks. To do this, our proposed system has integrated components such as convolutional neural network, and bidirectional long short-term memory recurrent neural network are the hearts of our proposed system. Convolutional neural network extracts high level features by correlating low level feature of events, then passes the sequence of extracted high level features to the bidirectional long short-term memory recurrent neural network. It learns the sequence of features by considering the past and the future of the events information and classify the incoming events as attack or benign. This approach helps to minimize false positives and false negatives, make the system adaptive to changes, detecting new attacks and reducing operational costs. The proposed system is implemented using the CSIC 2010 HTTP dataset which contains the attack and normal raw HTTP request packet. We extract the payload of the request packet and using it the model is trained and tested. We split 65% of the data for training, 20% of the data for testing and 15% of the data for validation. The common performance evaluation techniques accuracy, precision, recall and f1-score were used to measure the effectiveness of the proposed system. The study showed that the result of an event correlation based web attack detection using the combination of convolutional neural network and bidirectional long short-term memory recurrent neural network achieved 98.6% accuracy, 99.2% precision, 97.3% recall, and 98.2% f1-score.enWebWeb AttackPayloadEventCorrelationDeep LearningConvolutional Neural NetworkBidirectional Long Short-Term MemoryWord EmbeddingThesis