Detecting suspicious behaviour in a web application - what to look for?

Question

I would like to ask the proactive (or paranoid;) among us: What are you looking for, and how?

I'm thinking mainly about things that can be watched for programmatically, rather than manually inspecting logs.

For example:

• Manual/automated hack attempts.
• Data skimming.
• Bot registrations (that have evaded captcha etc.).
• Other unwanted behaviour.

Just wondering what most people would consider practical and effective.

Preventative stuff (like user input sanitation) is of course crucial, but in the case of this question I'm more interested in detecting a potential threat. In this case I'm interested in the Burglar alarm, rather than the locks.

An example of the kind of thing I'm talking about exists here on SO. If you make too many modifications to a question in a short period of time, it brings up a captcha to make sure you're not a bot.

Answer 1

Three pointers for you:

1. Sanitize user input
2. Sanitize user input
3. Sanitize user input

Remeber it, and remember it good.