WEB malicious scanning behavior abnormity detection method and system

Abstract

The invention discloses a WEB malicious scanning behavior abnormity detection method and a WEB malicious scanning behavior abnormity detection system. The method comprises the following steps: 1) extracting keyword characteristics and statistics characteristics of access users from an access history record, and building keyword vectors and statistic characteristic vectors of the users, 2) traversing the keyword vectors of the users, performing statistics on the user number corresponding to each keyword, and building a global keyword table, 3) calculating the uncommon degree of each keyword according to the global keyword table, calculating original abnormal score values of the access users according to the corresponding uncommon degrees, correcting the original abnormal score values then according to the statistic characteristic vectors of the access users, and obtaining final abnormal score values of the users; 4) for a jump point of a final abnormal score value sequence of all the access users, taking the final abnormal score value corresponding to the jump point as a threshold, and 5) comparing the final abnormal score values of the access values with the threshold, and taking the users as malicious scanning users if the final abnormal score values of the access values are greater than the threshold. An unknown attack behavior can be found, and normal historical data is not relied on.

Description

technical field [0001] The invention relates to an anomaly detection method and system for WEB malicious scanning behavior, belonging to the field of WEB security. Background technique [0002] WEB scanning is a common WEB access behavior, which generally means that a web crawler obtains the content of a target website according to certain rules. The difference between WEB malicious scanning and normal scanning is that the goal of the former is to find website vulnerabilities, sensitive information, authorized entries and other information through scanning, while the goal of the latter is to obtain content information normally provided by the website, such as Html pages, pictures, CSS files Wait. Since the goals of the two are fundamentally different, their access behaviors are also significantly different: [0003] First, the access request of WEB malicious scanning is obviously different from the access request of normal WEB scanning in semantics. For example, WEB malic...

AI Technical Summary

Problems solved by technology

The accuracy of this type of method greatly depends on normal historical data. If there is no normal historical data, or the normal historical data covers too few types of normal access behaviors, or the historical data is mixed with attack data, the false positive rate of this type of method and the false negative rate will be greatly increased

Images