  Web applications are relied upon by many for the services they provide. It is
essential that applications implement appropriate security measures to prevent
security incidents. Currently, web applications focus resources towards the
preventative side of security. Whilst prevention is an essential part of the
security process, developers must also implement a level of attack awareness
into their web applications. Being able to detect when an attack is occurring
provides applications with the ability to execute responses against malicious
users in an attempt to slow down or deter their attacks. This research seeks to
improve web application security by identifying malicious behaviour from within
the context of web applications using our tool BlackWatch. The tool is a
Python-based application which analyses suspicious events occurring within
client web applications, with the objective of identifying malicious patterns
of behaviour. Based on the results from a preliminary study, BlackWatch was
effective at detecting attacks from both authenticated, and unauthenticated
users. Furthermore, user tests with developers indicated BlackWatch was user
friendly, and was easy to integrate into existing applications. Future work
seeks to develop the BlackWatch solution further for public release.
