A double-layer progressive anomaly detection method for http requests

Abstract

The invention discloses a double-layer progressive abnormality detection method for HTTP requests. The abnormality detection is carried out based on a two-layer progressive abnormality detection model. The model is composed of an XGBoost gradient boosting tree module and an LSTM long short-term memory network module. After training a certain size of HTTP request data set, the model first uses the first-layer XGBoost gradient boosting tree module to make quick judgments, and then input suspicious HTTP requests to the second-layer LSTM module for careful judgment to realize HTTP request anomaly detection. , to achieve the purpose of intercepting malicious HTTP requests through normal HTTP requests. The invention can effectively improve the accuracy of HTTP request abnormality detection, reduce the false positive of abnormality detection, and make the abnormality detection model have certain long-term dependence.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an HTTP request double-layer progressive anomaly detection method oriented to a network application firewall. Background technique [0002] With the development of cloud computing and big data technology, the security of network applications under massive data is threatened. Traditional web application firewalls use rule matching methods to detect abnormalities in HTTP requests, which cannot cope with challenges such as changing requirements, complex attacks, and large data volumes. Therefore, researchers began to apply machine learning methods to web application firewalls. [0003] A single machine learning model generally has shortcomings such as complex models, complex feature engineering, low accuracy, high false positives, and difficulty in long-term dependence. For example, in a single K-Means clustering analysis, it is difficult to measure the distance between t...

AI Technical Summary

Problems solved by technology

The advantage is that multiple weak classifiers are integrated, and the feature extraction of each weak classifier is relatively simple; the disadvantage is that the selection and optimization of weak classifiers is difficult, and the retraining of weak classifiers is time-consuming; moreover, some simple composite machines Even after retraining the learning algorithm, its long-term dependence effect is not good

Images