Web anomaly detection method and device

Abstract

The invention provides a web anomaly detection method and device. The method comprises the following steps: establishing a plurality of anomaly detection models for detecting an anomaly web access based on web access characteristics according to a plurality of web access characteristics analyzed from a historical web access record, respectively detecting whether a target web access is an anomaly web access by adopting the various anomaly detection models, and labelling the web access characteristics corresponding to the anomaly detection model, the detection result of which is the anomaly web access, as the anomaly type of the target web access. The method in the embodiment of the invention realizes automatic detection of unknown vulnerabilities and novel attacks by utilizing the plurality of established anomaly detection models; data are unnecessary to re-collect; a rule is unnecessary to re-make; the relatively high detection ratio and the accuracy rate are ensured; the workload of workers is reduced; and the manpower and the detection time are saved.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to a web anomaly detection method and a web anomaly detection device. Background technique [0002] With the continuous popularity of web services, web sites suffer from more and more attacks. Web attacks are basically done by hackers by modifying URLs, including obtaining website database content, obtaining server root privileges, and stealing user data. There are many types of web attacks commonly used, such as directory traversal exploits, SQL injection, cross-site scripting attacks (XSS), cross-site request forgery attacks (CSRF), and so on. [0003] For web attacks, commonly used detection methods include finding attack behaviors based on attack detection rules formulated by security personnel, or extracting meaningful features based on human experience, and using supervised classification algorithms to find attack behaviors. [0004] The method based on manually fo...

AI Technical Summary

Problems solved by technology

[0004] The method based on manually formulated detection rules requires a large number of security experts for known vulnerabilities or attack behaviors, which will introduce more subjective elements, and for new types of attacks, the rules need to be re-formulated, which cannot guarantee the real-time performance and reliability of detection. comprehensive

[0005] Supervised classification algorithms can also achieve higher accuracy and rely less on security experts, but higher accuracy requires a large amount of comprehensive training data, and it is often difficult to obtain a large amount of comprehensive training data.

At the same time, for the detection of new attacks, the use of supervised classification algorithms also requires re-collection of data and training models, and it is not easy to ensure real-time and comprehensive detection

Images