Malicious attack detection method, system and device based on cloud WAF and medium

Abstract

The invention relates to the field of network security, in particular to a malicious attack detection method, system and device based on cloud WAF and a medium. The malicious attack detection method based on the cloud WAF comprises the steps: after an access request for a service line source station is received, performing parameter extraction on the access request; judging whether the access request is abnormal or not based on an HMM model; if the access request is abnormal, judging whether the access request is an attack based on an SVM classifier; if so, intercepting the access request. According to the invention, the HMM model is suitable for processing continuous dynamic signals, and the excellent time sequence modeling capability of the HMM model is organically combined with the extremely strong dichotomy capability of the SVM classifier under the condition of small samples; a re-training mechanism is added, so that model attenuation is effectively slowed down, the robustness isgood, the behavior of bypassing detection can be effectively prevented, the high accuracy is ensured, and the method has the advantages of lower missing report rate and false alarm rate and cost saving.

Description

technical field [0001] The present invention relates to the field of network security, in particular to a cloud WAF-based malicious attack detection method, system, device and medium. Background technique [0002] With the rapid development of Internet technology, the Web has been widely used in enterprise informatization, e-commerce, and e-government affairs. While the Internet brings us convenience and efficiency, network security issues have become increasingly prominent; Attacks and damages continue to grow. According to statistics from Goldman Sachs, 75% of attacks are aimed at Web applications; however, many companies have not fully understood and prepared for this, and many developers have no experience. This gives hackers Once these attacks are successful, they will cause great harm to individuals or enterprises, such as information leakage, illegal transfer, server paralysis, etc. Therefore, how to quickly and accurately detect potential malicious Web attacks has be...

AI Technical Summary

Problems solved by technology

Both of these methods apply technical measures such as rule protection and signature codes, and there are problems such as high false negative rate, high false positive rate, and high maintenance cost.

The above methods not only do not have a retraining mechanism, which leads to a decline in model accuracy over time, but also require constant update and maintenance of the rule base, resulting in low performance and high false negative rates.

Images