Abnormal access data detection method and device

Abstract

The invention discloses an abnormal access data detection method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of training an abnormal access data detection model according to a pre-established initial training set; after the training is finished, determining an abnormal probability of access data in a pre-established initial verification set by utilizing an abnormal access data detection model; labeling a plurality of pieces of access data of which the abnormal probability and accuracy meet a preset discrimination condition in the initial verification set as abnormal access data, and adding the abnormal access data into an initial training set; training the abnormal access data detection model according to the currenttraining set; and inputting to-be-detected access data into the trained abnormal access data detection model, and judging whether the to-be-detected access data is abnormal access data or not according to an output result. According to the embodiment, the abnormal access data detection model can be continuously optimized by utilizing the dynamically adjusted training set, so that the abnormal detection accuracy of the model is improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method and device for detecting abnormal access data. Background technique [0002] In the field of computer and Internet technology, the main carrier of webpage access is access data in the form of link strings. In practical applications, some malicious requests generate abnormal access data by cheating in order to bypass supervision. These cheating methods include: SQL (Structured Query Language) injection, XSS attack (that is, cross-site scripting attack), malicious Point of view verification program POC (Proof Of Concept), etc. Generally, the normal access data conforms to the standard format, and the abnormal access data has certain content randomness. [0003] In specific applications, there are many patterns of abnormal access data and changes in multiple segments, but the number of pre-labeled abnormal access data is relatively small, so the existing abnormal access...

AI Technical Summary

Problems solved by technology

[0003] In specific applications, there are many patterns of abnormal access data and changes in multiple segments, but the number of pre-labeled abnormal access data is relatively small, so the existing abnormal access data detection algorithms generally use statistics, matrix decomposition, isolation forest or deep network etc. Supervised learning algorithm, the above algorithm cannot use the marked anomaly to access data, and cannot further learn useful feature combinations with the help of marked data, its improvement space is small, and the detection accuracy is low

Images