Injection Attack Detection Method Based on Gated Recurrent Unit and Attention Mechanism

Abstract

The invention discloses an injection attack detection method based on a gated cyclic unit and an attention mechanism, which is characterized in that it comprises the following steps: Step 1, extracting sentences related to databases in the Internet as samples; preprocessing each sample respectively , and obtain its category label; Step 2, inject the result of the sample preprocessing into the attack detection model, and predict its corresponding category label; where the injection attack detection model includes an activation layer, a gated recurrent unit layer, and an attention Mechanism layer and output layer; step 3, training the injection attack detection model based on sample data; step 4, for the sentence to be detected, first preprocess it, and then input the preprocessed result into the trained injection attack detection model to obtain The category label of the statement to be detected, so as to determine whether the statement to be detected is an injection attack statement. The invention has high accuracy rate.

Description

Background technique [0001] An injection attack is when an attacker injects code into a program or query or injects malware into a computer in order to execute remote commands that can read or modify a database, or change data on a website. Common injection attacks in cyberspace include SQL injection attacks, XSS attacks, etc. According to the 2016 cyberspace security data report, two common injection attacks, SQL injection attack and XSS attack, have become common methods of network attack incidents, causing serious social and economic impacts. [0002] Common defenses against injection attacks include precompiled instructions and dynamic analysis. The detection method of injection attack has changed greatly from the rule-based method in the past to the machine learning-based method today. Representative rule-based methods mainly include methods based on regular expression matching, methods using pre-compiled methods, and methods using proxy server buffering. Although these...

AI Technical Summary

Problems solved by technology

Both the tree-kernel and word-graph methods combine machine learning, and to a certain extent, consider the contextual relationship between words, but the relationship between words that are far apart cannot be measured, so there is a problem for shorter attack sentences The recognition is accurate, but the recognition effect is not good for long attack sentences

Images