Attack detection method and device based on attack detection model, medium and equipment

Abstract

The invention discloses an attack detection method and device based on an attack detection model, a medium and equipment, relates to the field of network security, and mainly aims to solve the problems that when an existing machine learning algorithm is used for attack behavior detection, due to the fact that the number of training samples and the number of feature selection are small, the accuracy of an attack detection result is low, and the efficiency is high. And the false alarm rate is high. Comprising the steps of obtaining operation behavior data of a target user; the operation data are classified based on an attack detection model after model training is completed, a classification result is obtained, the attack detection model is constructed based on a support vector machine algorithm, model training is completed based on training samples and script language features, and the classification result is obtained. The training sample is composed of an attack sample collected based on an attack tool and a normal sample generated based on an automatic test attack, and the script language feature is extracted based on the attack sample; and if the classification result is an attack behavior, outputting an attack warning, and intercepting data generated by all operation behaviors of the target user.

Description

technical field [0001] The present application relates to the technical field of network security, and in particular, to an attack detection method, apparatus, medium and device based on an attack detection model. Background technique [0002] With the rapid development of Internet technology, websites have become more and more popular, and any user with a computer and Internet connection can access web applications. And attacks on web applications and networks are on the rise. XSS attack is one of the most common network attacks, attackers often insert malicious scripts into vulnerable network applications, creating session hijacking, sensitive data leakage, cross-site request forgery attacks, and other security holes. Further, the XSS vulnerability is used to execute malicious code on the server, obtain user or database permissions, etc. [0003] Traditional XSS attack prevention methods include hardware- and software-based web application firewalls (wafs). Most of thes...

AI Technical Summary

Problems solved by technology

[0005] In view of this, this application provides an attack detection method and device, storage medium, and computer equipment based on an attack detection model. Few, resulting in low accuracy of attack detection results and high false alarm rate technical problems

Images