A web attack detection method, system, medium and device
A technology for attack detection and test samples, applied in the field of Web attack detection, can solve problems such as difficult to have interpretability, samples, and labels required
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
specific Embodiment 1
[0039] Specific embodiment one: the embodiment of the present application is realized in the following way: a kind of Web attack detection method comprises:
[0040] Step 101: constructing a reconstruction error model based on the first positive sample;
[0041] Step 201: Calculate the error matrix corresponding to the second positive sample set according to all characters of the second positive sample, and calculate the threshold T;
[0042] Step 301: According to the reconstruction error model, calculate the corresponding probability P of each character in the output test sample set nj ; Wherein, the test sample set includes n HTTP sample strings, each HTTP sample string includes j characters, n, j are positive integers greater than 0;
[0043] For example: when the HTTP sample string length is 128, then j∈[1-128];
[0044] Step 401: Obtain the probability P through the Sparsemax function xj The corresponding sparse probability value H(P xj ); According to the sparse pro...
specific Embodiment 2
[0047] Specific embodiment two: On the basis of the above, the reconstruction error model construction training process in step 301 is: build an end-to-end model based on the training set, as follows figure 2 As shown, it contains three parts: encoder (Encoder), decoder (Decoder), sparse function Sparsemax. Both Encoder and Decoder are composed of multi-layer GRU neural network. In the training phase, learn from the idea of the autoencoder, keep the input and output consistent, and train the model based on the reconstruction error. For example, after the model training is completed, encode the value corresponding to an HTTP request "GET / vulnbank / online / api.php HTTP / 1.1" [46,44,59,98,80,35,34,25,27, 15,14,27,24,80,28,27,25,22,27,18,80,14,29,22,79,29,21,29,98,47,59,59,55,80, 5,79,5,3] input to the reconstruction error model, the reconstruction error model will output the probability P of the character corresponding to the test set nj .
[0048] Step 3011: Randomly initial...
Embodiment 3
[0055] Embodiment 3: Calculate the xth P for the test sample set according to the reconstruction error model xj , the P xj =P x1 +P x2 +......+P xy , P nj =P 1j +P 2j +......+P xj Among them, 0xy )j p j *logp j . The comparison curve of the two functions is as follows Figure 4 As shown, the Sparsemax function can be expressed more sparsely. Its geometric diagram is as follows Figure 5 As shown: [0.5,0.3,0.2] represents the result of the Softmax function, which means that the output probability of the character at the first position is 0.5, and the output probabilities of the following characters are 0.3 and 0.2 respectively. Similarly, [0.7,0.2,0.1] represents the result of the Sparsemax function, and [1,0,0] represents the result of the step function. It can be seen from the above schematic diagram that Sparsemax has a sparser expression than the Softmax function, and is more effective for the expression of suspicious character regions.
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More