Unsupervised deep auto-encoding network-based unknown threat detection method and system for HTTP data

Abstract

The invention discloses an unknown threat detection method and system based on an unsupervised deep self-encoding network for HTTP data, and the method comprises the following steps: S101, data access: accessing HTTP request data; s102, data cleaning: cleaning the HTTP request data; s103, feature extraction: carrying out feature extraction on the cleaned HTTP data; s104, model matching: carrying out model matching on the extracted feature data; and S105, threat detection: carrying out threat detection on a model result. According to the unknown threat detection method and system for the HTTP data based on the unsupervised deep self-encoding network, unknown threats in the HTTP data can be effectively detected through the unsupervised deep self-encoding network, and the defect that a traditional threat detection method based on rules cannot effectively detect the unknown threats is effectively overcome.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an unknown threat detection method and system based on an unsupervised deep self-encoding network for HTTP data. Background technique [0002] HTTP Hyper Text Transfer Protocol (HTP) is the core communication protocol used to access the Internet and is a communication protocol used by all web applications. Therefore, HTTP data is an important medium for attackers to carry out network attacks. Attackers often use HTTP data to Disguise, modify, and launch network attacks such as SQL injection, XSS, RCE, etc. [0003] The traditional threat detection for HTTP data is based on rules. By maintaining a large number of known attack method characteristics, feature rule matching is used to check the attack behavior in HTTP data. This method is simple and effective, but in today's complex network environment and flexible and changeable It is difficult to effectively detect unknow...

AI Technical Summary

Problems solved by technology

[0003] Traditional threat detection for HTTP data is based on rules. By maintaining a large number of known attack method features and using feature rule matching to check attack behavior in HTTP data, this method is simple and effective, but in today's complex network environment and flexible and changeable In the case of network threats, it is difficult to effectively detect unknown threats, limited capabilities, difficult to deal with attackers' flexible and changeable attack methods, and difficult to balance misjudgment and missed judgment.

[0004] In addition, with the rapid development of machine learning in recent years, many deep learning algorithms have been applied in the direction of unknown threat detection, but the disadvantage is that most of them are based on supervised algorithms, which require a large number of experienced network security experts to mark a large number of sample data for training

Secondly, most unsupervised algorithms are based on URLs, but network attack theories exist in various formats of HTTP data, which cannot be effectively and comprehensively detected

Images