Regular rule generation method based on unsupervised thought in mimicry WAF

Abstract

The invention discloses a regular rule generation method based on an unsupervised thought in a mimicry WAF, and the method is used for generating regular rules in the mimicry WAF, and supplementing a regular rule base in real time according to new traffic. A mimicry judgment module, a traffic collection module, a parameter extraction module, a parameter feature extraction module, a clustering module, a rule generation module and a manual reexamination module are designed, traffic passing through a regularization detection module is counted, when the traffic reaches ten thousands, an unsupervised rule generation engine is started, parameters in the traffic are extracted, and the rule generation efficiency is improved. Parameter values are input into a feature extraction module to obtain feature vectors, clustering is carried out, the clustered parameter values are input into a rule base to be selected, parameter level rules are manually selected and added into the rule base, and a regular rule base in the mimicry WAF is supplemented.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a regular rule generation method based on an unsupervised idea in a mimic WAF. Background technique [0002] WAF is a product that provides application protection for the Web by implementing a series of security policies for HTTP / HTTPS. Certain detection rules are integrated in WAF, and each HTTP traffic is detected and processed according to the rules, and corresponding defense or Release operations to maintain the security of web applications. The detection rule system of each WAF product is different, and the rule system is the core of the WAF architecture. [0003] Most security breaches occur due to exploiting WAF vulnerabilities. Ideally, the best way to improve system security is to discover all vulnerabilities and fix them, but due to the complexity and difficulty of evaluating the system, it is almost impossible to fix all vulnerabilities, so suppl...

AI Technical Summary

Problems solved by technology

Ideally, the best way to improve system security is to discover all vulnerabilities and fix them, but due to the complexity and difficulty of evaluating the system, it is almost impossible to fix all vulnerabilities, so supplement WAF rules as comprehensively as possible is an important and daunting task

Images