Web intrusion detection technology based on machine learning

Abstract

The invention discloses a Web intrusion detection method based on machine learning. The method mainly comprises the following steps of step 1, collecting data as a learning sample of anomaly detectionand attack detection; step 2, training an anomaly detection model, determining the random sampling number, the number of isolated trees, a K value and a threshold value needing to be set for secondary detection, training an attack detection model, and determining hyper-parameters C and g of three SVM models by using SQL injection and XSS as research objects; and collecting data of an HTTP requestin real time, carrying out anomaly detection and attack detection on the HTTP request, and recognizing an abnormal request and a corresponding attack behavior. Experiments show that the research method provided by the invention is effective, and compared with an existing method, the intrusion detection can be carried out on a Web attack rapidly and effectively.

Description

technical field [0001] The invention relates to the field of Web intrusion detection, and the main core is to establish a machine learning model by using the data by collecting statistical characteristics of Web attack samples, and use the constructed model to identify Web attack requests. Background technique [0002] In the face of complicated network attacks, software and hardware facilities such as intrusion prevention systems, intrusion detection systems, and firewalls are generally used to detect and intercept. These traditional software and hardware devices mainly use rule-based detection methods. In recent years, this detection method has gradually begun to show decline under the changing attack load, and the growth trend of security incidents has not been suppressed. Not only that, the high cost discourages many users, and the protective equipment of major security manufacturers is often exposed to have backdoors and loopholes. Overall, the overall security situati...

AI Technical Summary

Problems solved by technology

The rule-based detection method mainly has two limitations: on the one hand, the establishment and maintenance of the rule base requires a lot of manpower and material resources; on the other hand, the choice of pattern matching algorithm also greatly affects the detection efficiency.

If the anomaly detection model is used, the detection result is relatively simple; if the attack detection model is used, it is not suitable for real-time detection

[0005] The current numerous and complicated attack methods make the traditional intrusion detection system a bit weak, and serious attacks are becoming more and more difficult to be identified

Images