Detection method and system for HTTP malicious traffic

Abstract

The invention discloses a detection method and system for HTTP malicious traffic, and the method comprises the steps: capturing network traffic data, carrying out the preprocessing of the network traffic data, and obtaining formatted data corresponding to each HTTP request; performing feature extraction on the formatted data to obtain text vector features of each piece of formatted data; performing classification detection on the text vector characteristics based on a pre-trained malicious flow detection model to detect an HTTP malicious request; performing similar attack clustering on the HTTP malicious request based on a similar attack clustering algorithm to obtain a cluster; and performing analysis based on the cluster to obtain malicious attack information of the HTTP malicious request. According to the method, the Spark big data analysis engine is used for carrying out feature extraction and conversion on the flow data, and the machine learning and clustering algorithm is used for mining the malicious flow, so that the detection accuracy of the network malicious flow is improved, and the flow analysis time cost of security analysts is reduced.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a method and system for detecting malicious traffic of HTTP (Hyper Text Transfer Protocol, hypertext transfer protocol). Background technique [0002] In recent years, with the rapid development of Internet applications, the network scale of the Internet has shown an unprecedented expansion trend, and the complexity of the network has become higher and higher. While the Internet brings convenient services to the vast number of users, the accompanying network security problems are becoming more and more serious. Incidents such as arbitrary theft and modification of user information frequently occur during network data transmission, which has drawn widespread attention to network security issues. [0003] Malicious traffic identification is an important method in network supervision. Using network traffic analysis to identify and classify malicious traffic has become...

AI Technical Summary

Problems solved by technology

This method has a fast detection speed, but the pattern is fixed and single, and the quality of the detection results depends entirely on WAF regular expressions, and this method can only detect known network attack methods. For attack methods that add obfuscated code or unknown Attack method, this method does not work

The detection method based on the deep learning model has good data fitting ability and can identify malicious attacks with obfuscated codes to a certain extent. server) resources, so it is not suitable for today's big data traffic detection scenarios

Images