HTTP request double-layer progressive anomaly detection method

Abstract

The invention discloses an HTTP request double-layer progressive anomaly detection method, anomaly detection is carried out based on a double-layer progressive anomaly detection model, and the model is composed of an XGBoost gradient boosting tree module and an LSTM long-term and short-term memory network module. The method comprises the following steps: training an HTTP request data set of a certain scale; according to the model, firstly using a first-layer XGBoost gradient boosting tree module for rapid judgment, inputting a suspected HTTP request into a second-layer LSTM module for carefuljudgment, achieving HTTP request exception detection, and achieving the purpose of intercepting a malicious HTTP request through a normal HTTP request. According to the method, the accuracy of HTTP request anomaly detection can be effectively improved, the false positive of anomaly detection is reduced, and an anomaly detection model has certain long-term dependence.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an HTTP request double-layer progressive anomaly detection method oriented to a network application firewall. Background technique [0002] With the development of cloud computing and big data technology, the security of network applications under massive data is threatened. Traditional web application firewalls use rule matching methods to detect abnormalities in HTTP requests, which cannot cope with challenges such as changing requirements, complex attacks, and large data volumes. Therefore, researchers began to apply machine learning methods to web application firewalls. [0003] A single machine learning model generally has shortcomings such as complex models, complex feature engineering, low accuracy, high false positives, and difficulty in long-term dependence. For example, in a single K-Means clustering analysis, it is difficult to measure the distance between t...

AI Technical Summary

Problems solved by technology

The advantage is that multiple weak classifiers are integrated, and the feature extraction of each weak classifier is relatively simple; the disadvantage is that the selection and optimization of weak classifiers is difficult, and the retraining of weak classifiers is time-consuming; moreover, some simple composite machines Even after retraining the learning algorithm, its long-term dependence effect is not good

Images