Web unknown threat detection method and system

Abstract

The invention provides a web unknown threat detection method and system, belonging to the technical field of network security. The method comprises: obtaining an initial set of feature vectors according to the HTTP response message; performing data dimensionality reduction on the initial set of feature vectors to obtain a matrix of feature vectors; performing model training on the matrix of feature vectors as training input data to obtain each feature vector For the corresponding output data, the model training is terminated when it is determined that the convergence is completed, and the current convergence model is used as a prediction model; the prediction model is used to detect the abnormality of the http response message in the current network environment, and an abnormal score set is obtained, and the abnormal score is concentrated The abnormal scores are sorted by size, the abnormal data is screened from the sorted abnormal scores according to the preset threshold percentage, and the corresponding level of risk warning is carried out according to the value of the abnormal data. The scheme of the invention realizes the unsupervised learning of web unknown threat detection, and is suitable for big data monitoring.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for detecting an unknown web threat and a system for detecting an unknown web threat. Background technique [0002] At present, web (World Wide Web, global wide area network) applications develop rapidly and provide great convenience for people's life. However, malicious attacks against web vulnerabilities are becoming more and more serious, causing serious information security problems. Among them, malicious attacks against web servers have the worst impact, including the most common existing attack methods such as SQL injection and command injection. These malicious attacks pose a great threat to the security of web servers. It is becoming more and more difficult to deal with various intrusion attacks. In recent years, with the rapid development of deep learning, many deep learning algorithms have been applied to web intrusion detection technology and have a...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the embodiment of the present invention is to provide a web unknown threat detection method and system to at least solve the problem that the current artificial intelligence algorithm can not adapt to the big data environment in web threat detection

Images