Deep learning WebShell protection method based on cloud WAF

Abstract

The invention relates to a deep learning WebShell protection method based on a cloud WAF. The method comprises the steps of collecting the equivalent normal text and the WebShell text as a positive sample and a negative sample respectively; preprocessing and then extracting features, training the features by adopting a deep learning algorithm to obtain a stable algorithm template, predicting the features by using the algorithm template, if the texts are predicted to be the WebShell texts, notifying a WAF module through a Redis module to carry out real-time blocking, and otherwise, passing. According to the present invention, the characteristics extracted from the positive sample and the negative sample are trained through deep learning, and the algorithm template with high precision is obtained; during prediction, the behavior of maliciously uploading the file is identified by utilizing the algorithm template, and the behavior of maliciously uploading the file is blocked in real time,so that the detection cost is low, the real-time performance is strong, the accuracy is high, the false alarm rate is low, the attack behavior initiated by hackers intentionally can be effectively prevented, and some unnecessary data packets are prevented from occupying the flow in the network.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegraph communication, in particular to a deep learning WebShell protection method based on cloud WAF. Background technique [0002] With the development of Internet technology, Web application systems have been widely used in government portals, e-commerce, Internet and other industries, which is convenient for life and work, but also brings hidden dangers to network security. [0003] When attackers intrude on the target website, they usually obtain files through various methods, so as to gain control of the enterprise website, and then facilitate subsequent intrusion behaviors. Common attack methods include direct upload and acquisition of WebShell, SQL injection, remote files containing RFI, FTP, and even using cross-site scripting (XSS) as part of the attack, as well as some older methods, such as using background database backup and restore ...

AI Technical Summary

Problems solved by technology

[0006] The present invention solves the problems of low performance and high false negative rate in the protection of WebShell caused by the application of the technical means of protection through rules and the experience of senior web security personnel to identify malicious file upload behaviors in the prior art, and provides a An Optimized WebShell Protection Method Based on Deep Learning

Images