MINES: Explainable Anomaly Detection through Web API Invariant Inference

We developed MINES, a system for detecting anomalies in web applications by inferring explainable API invariants from the schema level instead of raw log instances. This approach effectively filters out log noise and identifies abnormal behaviors related to the database and session states. Our extensive evaluations demonstrate that MINES outperforms existing methods, achieving over 14% higher recall for anomaly detection with nearly zero false positives. The below image shows the overview of MINES. You can check more details from our paper or from the below links.