Method and system for detecting and locating network anomaly

Abstract

The invention discloses a method and system for detecting and locating network anomaly, which relates to the fields of Internet security, deep learning and neural network. The method comprises the following steps: firstly, dividing the URL according to special characters; secondly, performing word vector encoding on the divided URL with word2vec; putting word vectors into a convolution layer for automatic feature processing; combining a convolution layer result with an attention layer which possesses a sequential attention mechanism; and finally, performing maximum pooling and full-connectionon an attention layer result to obtain a final anomaly detection result, and at the same time, using the output of the attention layer to locate the malicious code in the URL. The invention has an excellent detection effect, not only is the detection rate high, but also the malicious code fragment in the URL can be located and visualized, thus effectively avoiding the drawbacks of the artificial feature engineering and the expert knowledge method.

Description

technical field [0001] The invention belongs to the field of network intrusion detection and deep learning, and relates to a method and system for detecting and locating network abnormalities based on a sequence attention convolutional neural network. Background technique [0002] With the rapid development of technology, the Internet has brought a variety of convenient services to people, such as WordPress, GitHub, Yahoo, etc. They create a better working and living environment for people, but at the same time they also bring certain hidden dangers to people. WordPress is currently the most popular blogging platform in the world, with a market share of 70% and more than 45,000 plug-ins. Among them, the WordPress SEO by Yoast plug-in has a very high usage rate. In 2015, this plug-in was exposed to a high-risk SQL injection vulnerability. The vulnerability resulted in the disclosure of a large amount of sensitive information. In 2016, 270 million Gmail, YAHOO and Hotmail ac...

AI Technical Summary

Problems solved by technology

It can be seen that if people are using defense measures against versions prior to 5.0, using these defense measures in versions later than 5.0 may result in missed reports of various types of attacks, which also results in a lower rate of false negatives. raised

Secondly, malicious code is usually hidden in seemingly normal requests sent by attackers, but most of the existing research methods based on machine learning can only identify and judge whether these network requests are abnormal, but cannot detect abnormal requests. Locate the malicious code area in

Images