HTTP session exception detection method and detection system

Abstract

The invention discloses an HTTP session exception detection method. The method comprises the following steps: identifying HTTP traffic; extracting features of each HTTP user session; performing vectorization processing on the session feature corresponding to each HTTP session to obtain a feature vector; and clustering and marking the session set by adopting a clustering algorithm, and judging to obtain an abnormal session. The invention also provides a detection system for realizing the HTTP session exception detection method. According to the method, efficient clustering and core point storage are carried out by utilizing a clustering algorithm under the condition of not needing label data according to the user sessions divided by the HTTP traffic, the session exception in the HTTP traffic is discovered by calculating the distance between the HTTP session to be tested and the core point by utilizing the stored core point, and then the Web attack is discovered; and the method solves alarge number of problems in the prior art, and is high in reliability, good in practicability and high in accuracy.

Description

Technical field [0001] This French belongs to the network security field, and specific to an HTTP session anomaly detection method and a detection system. Background technique [0002] With the development of economic technology, web application services have been widely used in people's production and life, bringing endless convenience to people's production and life. [0003] However, with the growth of web application services, attacks for web application services have grown rapidly. Attack methods continue to introduce new, causing an endless network security incident, not only cause economic losses, but also adversely affect society. [0004] In order to defend against Web attacks, traditional solutions are deployed on WAF (Web Application Firewall, Web Application Firewall) to deploy misuse detection methods based on pre-defined attack rule sets, for HTTP (Hypertext Transfer Protocol, Hypertext Transfer Protocol Request to intercept or release. This misuse detection method ...

AI Technical Summary

Problems solved by technology

The anomaly detection method can detect new types of attacks, but the false positive rate is higher than that of the misuse detection method, and it cannot identify specific attack types

At the same time, most of the existing detection algorithms need to rely on a large number of attack samples or a large number of normal samples, but the attack sample data in the actual collected data is far less than the normal data samples, and it is difficult to cover all attack types; especially in different website environments, Obtaining labeled data is difficult

Images