HTTP session anomaly detection method and detection system

Abstract

The invention discloses a method for detecting HTTP session anomalies, which includes identifying HTTP traffic; extracting the features of each HTTP user session; performing vectorization processing on the session features corresponding to each HTTP session to obtain a feature vector; The clustering algorithm performs clustering and marking and judges abnormal sessions. The invention also provides a detection system for realizing the HTTP session abnormality detection method. According to the user sessions divided by HTTP traffic, the present invention uses a clustering algorithm to efficiently cluster and store core points without label data, and uses the stored core points to calculate the distance between the HTTP session to be tested and the core point to discover HTTP traffic The session in the system is abnormal, and then the Web attack is found; the invention solves a large number of problems in the prior art, and has high reliability, good practicability and high accuracy.

Description

technical field [0001] The invention belongs to the field of network security, in particular to an HTTP session anomaly detection method and a detection system. Background technology [0002] With the development of economy and technology, web application services have been widely used in people's production and life, which has brought endless convenience to people's production and life. [0003] However, with the growth of web application services, attacks against web application services are also growing rapidly. The continuous innovation of attack means has led to an endless stream of network security incidents, which not only caused economic losses, but also had a negative impact on the society. [0004] In order to resist web attacks, the traditional solution is to deploy misuse detection method on WAF (Web Application Firewall): that is, intercept or release HTTP (Hypertext Transfer Protocol) requests based on pre-defined attack rule sets. Although this misuse detection met...

AI Technical Summary

Problems solved by technology

The anomaly detection method can detect new types of attacks, but the false positive rate is higher than that of the misuse detection method, and it cannot identify specific attack types

At the same time, most of the existing detection algorithms need to rely on a large number of attack samples or a large number of normal samples, but the attack sample data in the actual collected data is far less than the normal data samples, and it is difficult to cover all attack types; especially in different website environments, Obtaining labeled data is difficult

Images