Attack detection method and system

Abstract

The embodiment of the invention discloses an attack detection method and system. The method comprises the following steps: establishing a plurality of detection models related to an HTTP request in advance, and detecting each record after web access logs are decomposed by utilizing each detection model respectively to obtain a parameter abnormal value of each detection model aiming at the record; calculating an optimized weighted value corresponding to the parameter abnormal value of each detection model, carrying out weighted calculation to obtain a final parameter abnormal value, and determining a final abnormal threshold; judging whether the final parameter abnormal value calculated aiming at the log record to be detected is greater than the determined final abnormal threshold; and if yes, determining the HTTP request of the log record to be detected as attack behavior. By applying the embodiment of the invention, unknown attacks can be actively discovered, so that the detection rate of the unknown attacks can be improved; and optimized weighting of multiple detection models is adopted for detecting, so that the limitation of a single detection model is avoided, false-reporting and under-reporting conditions are reduced, and the false detection rate is lowered.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to an attack detection method and system. Background technique [0002] With the development of the Internet, Internet web applications for the public based on the Internet environment are becoming more and more extensive. These applications will undoubtedly greatly increase the possibility of web attacks. [0003] As the core protocol of web applications, the HTTP protocol carries the realization of the basic functions of web applications. However, the HTTP protocol itself lacks relevant security features, and developers lack security-related experience and awareness during the writing process, so there are inevitable loopholes in web applications. The diversity and complexity of web application security vulnerabilities also determine that hacker attack methods have the same characteristics. [0004] At present, the security detection method for web vulnerabilities is: by e...

AI Technical Summary

Problems solved by technology

This method has a relatively high detection rate and low false detection rate for known attacks, but the detection rate for unknown attacks is very low. At the same time, with the discovery of attacks, the rule base needs to be updated in time, so that the rule base continues to expand. Reduced detection efficiency

Images