Attack detection method and device and electronic equipment

Abstract

The invention discloses an attack detection method and device and electronic equipment, relates to the technical field of network security, and is used for improving the accuracy and real-time performance of web attack detection, and the method comprises the steps: firstly, obtaining to-be-recognized network request data, carrying out the preprocessing of the to-be-recognized network request data, and obtaining the preprocessed network request data; then, adopting a pre-trained target detection model to extract a deep semantic vector of the preprocessed network request data, and calculating the similarity between the deep semantic vector and each semantic vector in a preset semantic vector library; and finally, based on each similarity, determining a detection result of the to-be-identified network request data. Through the method, the detection model only needs to learn the semantic vectorization expression of the text, so that the training difficulty of the model is reduced, the model parameters are reduced, the calculation amount of the model is reduced, and the detection efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an attack detection method, device and electronic device. Background Art

[0002] The current web attack detection function is mainly integrated in the Web Application Firewall (WAF), which uses WAF to perform real-time detection of web traffic.

[0003] However, with the development of artificial intelligence technology, attempts have been made to use deep learning models for web attack detection. However, since deep learning models require a large amount of training data, and in the case of a large amount of training data, there is often dirty data, which will cause the trained deep learning model to learn incorrect knowledge, resulting in missed or false positives of web attacks; in addition, the number of parameters in deep learning models is often huge, resulting in a long detection time for deep learning models, which is difficult to meet the requirements of real-time detection of web attacks.

[0004] Therefore, how to improve the accuracy and real-time performance of web attack detection is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide an attack detection method, device and electronic device to improve the accuracy and real-time performance of web attack detection.

[0006] In a first aspect, the present application provides an attack detection method, the method comprising:

[0007] Acquire the network request data to be identified, and preprocess the network request data to be identified to obtain the preprocessed network request data;

[0008] A pre-trained target detection model is used to extract the deep semantic vector of the pre-processed network request data, and the similarity between the deep semantic vector and each semantic vector in a preset semantic vector library is calculated; wherein the preset semantic vector library is a semantic vector library set based on the attack sample;

[0009] Based on each similarity, a detection result of the network request data to be identified is determined; the detection result is used to indicate that the network request data to be identified is normal data, or that the network request data to be identified is attack data and the corresponding attack type.

[0010] Through the above method, the detection model only needs to learn the semantic vectorized expression of the text. When performing detection, the deep semantic vector of the data to be identified is similar to the semantic vector in the preset semantic vector library to obtain the detection result. The model has low training difficulty and few parameters, which reduces the calculation time of the model and improves the efficiency and accuracy of detection.

[0011] In an optional implementation, preprocessing the network request data to be identified includes:

[0012] Decode the network request data according to the preset encoding character rule library to obtain the target decoding result;

[0013] The target decoding results are generalized and de-duplicated.

[0014] Through the above method, the network data to be identified is preprocessed, which can restore the original text information in the network request to be identified to the greatest extent, thereby improving the detection accuracy of the model.

[0015] In an optional implementation, the pre-trained object detection model is obtained in the following manner:

[0016] Input the set of training sample pairs into the detection model to be trained, and calculate the cosine similarity of each pair of training sample pairs; wherein the training sample pairs are obtained by randomly combining normal samples and / or attack samples in pairs, if the attack types of the two attack samples are the same, then the label similarity of the training sample pairs is 1, or if the attack types of the two attack samples are different, then the label similarity of the training sample pairs is 0.5, or if the normal sample is combined with the attack sample, then the label similarity of the training sample pairs is 0;

[0017] The detection model to be trained is iteratively trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples to obtain a pre-trained target detection model.

[0018] The training method described above has low training difficulty but high detection accuracy.

[0019] In an optional implementation, the detection model to be trained is iteratively trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples to obtain a pre-trained target detection model, including:

[0020] Based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples, the loss function corresponding to the detection model to be trained is calculated;

[0021] Based on the loss function, the model parameters of the detection model to be trained are adjusted until the loss function is less than a preset threshold to obtain a pre-trained target detection model.

[0022] In an optional implementation, the preset semantic vector library is obtained in the following manner:

[0023] Get the original attack sample set;

[0024] Input the preprocessed attack samples into the target detection model to generate the corresponding semantic vector;

[0025] Calculate the similarity between two semantic vectors, and remove duplicates of two semantic vectors whose similarity is greater than a preset threshold;

[0026] Based on the semantic vectors after deduplication processing, a preset semantic vector library is obtained.

[0027] Through the above method, a semantic vector library containing various attack types can be obtained, which is convenient for similarity calculation and thus determines the detection result.

[0028] In an optional implementation, determining the detection result of the network data to be identified based on the similarity includes:

[0029] Sort each similarity and determine the maximum similarity;

[0030] If the maximum similarity is greater than a preset threshold, it is determined that the network data to be identified is attack data and the attack type to which it belongs.

[0031] In an optional implementation, after determining the detection result of the network data to be identified based on the similarity, the method further includes:

[0032] The preset semantic vector library is updated according to the preset period. If there is a new attack sample, the first depth semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second depth semantic vector in the preset semantic vector library is changed to a normal sample, the second depth semantic vector is deleted from the preset semantic vector library.

[0033] Through the above method, the preset semantic vector library can be updated, so that the preset semantic vector library can always correspond to relatively accurate attack samples, thereby improving the accuracy of detection.

[0034] In a second aspect, the present application provides an attack detection device, the device comprising:

[0035] A processing module, used to obtain the network request data to be identified, and preprocess the network request data to be identified to obtain the preprocessed network request data;

[0036] A calculation module is used to extract the deep semantic vector of the preprocessed network request data using a pre-trained target detection model, and calculate the similarity between the deep semantic vector and each semantic vector in a preset semantic vector library; wherein the preset semantic vector library is a semantic vector library set based on the attack sample

[0037] The identification module is used to determine the detection result of the network request data to be identified based on each of the similarities; the detection result is used to indicate that the network request data to be identified is normal data, or that the network request data to be identified is attack data and the corresponding attack type.

[0038] In an optional implementation, when preprocessing the network request data to be identified, the processing module is specifically used to:

[0039] Decode the network request data according to the preset encoding character rule library to obtain the target decoding result;

[0040] The target decoding results are generalized and de-duplicated.

[0041] In an optional implementation, a training module is further included, and the training module is specifically used to:

[0042] Input the set of training sample pairs into the detection model to be trained, and calculate the cosine similarity of each pair of training sample pairs; wherein the training sample pairs are obtained by randomly combining normal samples and / or attack samples in pairs, if the attack types of the two attack samples are the same, then the label similarity of the training sample pairs is 1, or if the attack types of the two attack samples are different, then the label similarity of the training sample pairs is 0.5, or if the normal sample is combined with the attack sample, then the label similarity of the training sample pairs is 0;

[0043] The detection model to be trained is iteratively trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples to obtain a pre-trained target detection model.

[0044] In an optional implementation, when the detection model to be trained is iteratively trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples, the training module is specifically used to:

[0045] Based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples, the loss function corresponding to the detection model to be trained is calculated;

[0046] Based on the loss function, the model parameters of the detection model to be trained are adjusted until the loss function is less than a preset threshold to obtain a pre-trained target detection model.

[0047] In an optional implementation, the calculation module is further used for:

[0048] Get the original attack sample set;

[0049] Input the preprocessed attack samples into the target detection model to generate the corresponding semantic vector;

[0050] Calculate the similarity between two semantic vectors, and remove duplicates of two semantic vectors whose similarity is greater than a preset threshold;

[0051] Based on the semantic vectors after deduplication processing, a preset semantic vector library is obtained.

[0052] In an optional implementation, when determining the detection result of the network data to be identified based on the similarity, the identification module is specifically used to:

[0053] Sort each similarity and determine the maximum similarity;

[0054] If the maximum similarity is greater than a preset threshold, it is determined that the network data to be identified is attack data and the attack type to which it belongs.

[0055] In an optional implementation, after determining the detection result of the network data to be identified based on the similarity, the calculation module is further used to:

[0056] The preset semantic vector library is updated according to the preset period. If there is a new attack sample, the first depth semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second depth semantic vector in the preset semantic vector library is changed to a normal sample, the second depth semantic vector is deleted from the preset semantic vector library.

[0057] In a third aspect, the present application provides an electronic device comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the attack detection method described in the first aspect above.

[0058] In a fourth aspect, the present application provides a computer-readable storage medium, which includes a program code. When the program code is executed on an electronic device, the program code is used to enable the electronic device to execute the steps of the attack detection method described in the first aspect above.

[0059] In a fifth aspect, the present application provides a computer program product, which, when called by a computer, enables the computer to execute the steps of the attack detection method as described in the first aspect.

[0060] In addition, other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0062] Figure 1 A schematic diagram of an implementation flow of an attack detection method provided in an embodiment of the present application;

[0063] Figure 2 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application;

[0064] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0066] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. A and B are connected, which can represent two situations: A and B are directly connected and A and B are connected through C. In addition, in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0067] In addition, the collection, dissemination, and use of data in the technical solution of this application comply with the requirements of relevant national laws and regulations.

[0068] The following is a brief introduction to the design concept of the embodiment of the present application:

[0069] Currently, the web attack detection function is mainly integrated into WAF, and WAF is used to perform real-time detection of web traffic.

[0070] However, with the development of artificial intelligence technology, attempts have been made to use deep learning models for web attack detection. However, since deep learning models require a large amount of training data, and in the case of a large amount of training data, there is often dirty data, which will cause the trained deep learning model to learn incorrect knowledge, resulting in missed or false positives of web attacks; in addition, the number of parameters in deep learning models is often huge, resulting in a long detection time for deep learning models, which is difficult to meet the requirements of real-time detection of web attacks.

[0071] Therefore, how to improve the accuracy and real-time performance of web attack detection is a technical problem that needs to be solved urgently.

[0072] In view of this, the present application adopts deep semantic vectors to detect web attacks, which can timely correct the preset semantic vector library, improve the detection accuracy, and the model only needs to map the network data to be detected into the vector space, the model parameters will be greatly reduced, and the amount of calculation will also be reduced, thereby improving the real-time performance of the detection.

[0073] Specifically, the present application provides an attack detection method, which includes: first, obtaining the network request data to be identified, and preprocessing the network request data to be identified to obtain the preprocessed network request data; then, using the pre-trained target detection model to extract the deep semantic vector of the preprocessed network request data, and calculating the similarity between the deep semantic vector and each semantic vector in the preset semantic vector library; wherein the preset semantic vector library is a semantic vector library set based on the attack sample; finally, based on each similarity, determining the detection result of the network request data to be identified; the detection result is used to indicate that the network request data to be identified is normal data, or the network request data to be identified is attack data and the corresponding attack type. Through the above method, only the speech vectorization expression of the text data needs to be learned, which reduces the difficulty of model training and greatly improves the accuracy and real-time performance of web attack detection.

[0074] The attack detection method provided by the exemplary embodiment of the present application is described below with reference to the accompanying drawings.

[0075] See also Figure 1 FIG. 1 is a schematic diagram of an implementation process of an attack detection method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0076] S1: Acquire network request data to be identified, and preprocess the network request data to be identified to obtain processed network request data.

[0077] In an embodiment of the present application, first, the network request data to be identified is obtained. For example, the network request data to be identified may be Hypertext Transfer Protocol (HTTP). Specifically, in order to ensure that data can be transmitted normally and improve security, the HTTP request is usually encoded. For example, URL encoding, Unicode encoding, etc. are used.

[0078] However, when extracting the deep semantic vector of the network request data to be identified, it is not possible to process it directly based on the encoded HTTP request. It is necessary to preprocess the HTTP request to be identified to ensure that the deep semantic vector of the HTTP request can be successfully extracted later.

[0079] In an optional implementation, when preprocessing the network request data to be identified, first, the network request data to be identified is decoded according to a preset encoding character rule library to obtain a target decoding result.

[0080] Exemplarily, the preset coded character rule library can be a standard decoding library for Uniform Resource Locator (URL) decoding, a standard decoding library for Hypertext Markup Language (HTML) decoding, a standard decoding library for Unicode decoding, etc., which is not specifically limited in the embodiment of the present application. The corresponding coded character rule library can be selected for decoding according to the actual situation to obtain the target decoding result.

[0081] For example, the network request data to be identified may be decoded by using at least one of URL decoding, HTML decoding, and Unicode decoding.

[0082] In an embodiment of the present application, by decoding the network request data to be identified through a preset encoding character rule library, the original text information in the network request data to be identified can be restored to the greatest extent, so that the subsequent target detection model can extract the deep semantic vector of the network request data to be identified.

[0083] Furthermore, after obtaining the target decoding result corresponding to the to-be-identified network request data, it is also necessary to perform generalization processing and deduplication processing on the target decoding result.

[0084] Based on generalization processing, non-ASCII characters in the target decoding result can be removed, and long strings, large numbers, etc. can be replaced with specific tokens.

[0085] For example, the long string in the target decoding result: I need a pen that can be used <chinese>For example, if the target decoded result is a large number: 8654187, you can use <num>replace.

[0086] Then, the target decoding results after generalization processing are deduplicated to delete the repeated texts.

[0087] Through the above method, the target decoding result corresponding to the network request data to be identified is generalized, and the specific string is converted into a generalized identifier, so that the subsequent target detection model can more accurately identify the deep semantic vector corresponding to the network request data to be identified.

[0088] S2: Use the pre-trained target detection model to extract the deep semantic vector of the pre-processed network request data, and calculate the similarity between the deep semantic vector and each semantic vector in the preset semantic vector library.

[0089] In an embodiment of the present application, the target detection model is used to identify whether the network request data of the network to be identified is normal data or attack data, and when the network request data to be identified is identified as attack data, the attack type corresponding to the network request data to be identified can also be accurately determined.

[0090] In an optional implementation, the pre-trained object detection model is obtained in the following manner:

[0091] Specifically, in an embodiment of the present application, first, it is necessary to collect sample data, that is, to collect normal HTTP requests and attack data containing various attack types from historical data sets, such as SQL injection, distributed denial of service attack (DDoS) and other types of attack data.

[0092] Similarly, after collecting normal HTTP requests and attack data containing various attack types, they are also pre-processed, that is, decoded according to the preset encoding character rule library as described above, and then the decoded results are generalized and de-duplicated. This application will not be described in detail here.

[0093] Furthermore, the preprocessed sample data needs to be combined to obtain training sample pairs used for training the model.

[0094] Specifically, the collected sample data includes normal samples and attack samples. In this step, the normal samples and the attack samples need to be combined, that is, randomly extracted from the collected sample data, and combined in pairs, so as to obtain training sample pairs.

[0095] It is understandable that the training sample pairs obtained by combination can be a combination of normal samples and attack samples, a combination of attack samples, and a combination of normal samples. Therefore, label similarity can also be set for the training sample pairs.

[0096] In an embodiment of the present application, the label similarity corresponding to two attack samples of the same attack type is set to 1. For example, the attack type of attack sample 1 is SQL injection, and the attack type of attack sample 2 is also SQL injection. Then, the label similarity of the training sample pair composed of attack sample 1 and attack sample 2 is 1; the attack type of attack sample 3 is SQL injection, and the attack type of attack sample 4 is DDoS attack, then, the label similarity of the training sample pair composed of attack sample 3 and attack sample 4 is 0.5; if a normal sample and an attack sample constitute a training sample pair, then the label similarity corresponding to the training sample pair is set to 0.

[0097] By combining normal samples and attack samples through the above method, a set of training sample pairs can be obtained based on the collected sample data.

[0098] Combining training sample pairs based on the above method can increase the diversity of data, which will help the model learn a wider data distribution when training the model later, improve the generalization ability of the model and reduce the risk of overfitting; and combining normal samples in pairs can help the model learn the similarities and differences between normal samples, which is crucial for identifying abnormal data; combining attack samples in pairs can help the model understand the diversity and complexity of abnormal data, so that the model can more accurately identify abnormal data and reduce the risk of misjudging normal data as abnormal; combining normal samples and abnormal samples in pairs can enable the model to learn the boundaries and differences between the two, which can improve the model's ability to distinguish between normal and abnormal data.

[0099] Furthermore, the obtained training sample pairs are input into the detection model to be trained to perform model training, thereby obtaining a target detection model that can accurately identify attack data.

[0100] Specifically, in the embodiment of the present application, the detection model to be trained can be a twin network model based on Sentence-BERT. The input of the detection model to be trained is the set of training sample pairs obtained above. The twin network structure based on the twin network model, that is, two BERT models with shared weights are used to encode the input training sample pairs respectively. Each training sample pair obtains the hidden state at the token level through the BERT model, and then obtains the vector representation of the training sample pair through pooling operations (for example, average pooling, maximum pooling, etc.), and the cosine similarity of the training sample pair can be further calculated using cosine similarity.

[0101] Furthermore, the detection model to be trained is iteratively trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples to obtain a pre-trained target detection model.

[0102] In an optional implementation, after obtaining the cosine similarity corresponding to each pair of training samples, the loss function corresponding to the detection model to be trained can be calculated based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples.

[0103] Exemplarily, in an embodiment of the present application, the loss function may adopt Mean-Square Error (MSE). For example, the cosine similarity of training sample pair 1 is 0.4, and the label similarity of training sample pair 1 is 0.5. Then, the error between the cosine similarity and the label similarity of training sample pair 1 can be further calculated; the cosine similarity of training sample pair 2 is 0.8, and the label similarity of training sample pair 2 is 1. Then, the error between the cosine similarity and the label similarity of training sample pair 2 can be further calculated; similarly, the error between the cosine similarity and the label similarity of all training sample pairs can be calculated. After obtaining the error between the cosine similarity and the label similarity of all training sample pairs, the mean square error of the detection model to be trained can be calculated. The specific implementation process of calculating the mean square error will not be described in detail here.

[0104] Furthermore, after obtaining the mean square error of the detection model to be trained, it is possible to judge whether the model has converged based on the mean square error, and update the weight parameters and bias parameters of the detection model to be trained based on the mean square error through the optimizer, and continuously iterate and update the detection model to be trained until the detection model to be trained converges, or judge whether the number of iterations of the detection model to be trained reaches a predetermined number, thereby obtaining a trained target detection model.

[0105] In an embodiment of the present application, the pre-trained target detection model can be used to implement web attack detection.

[0106] It should be noted that before attack detection, a semantic vector library needs to be preset. It is understandable that the preset semantic vector library is a semantic vector library set based on attack samples, which stores semantic vectors extracted based on various attack data.

[0107] Specifically, in the embodiment of the present application, the preset semantic vector library can be obtained in the following manner:

[0108] First, an original attack sample set is obtained; the original attack sample set stores various types of attack data.

[0109] The original attack sample is then preprocessed, namely the aforementioned decoding, generalization processing, and deduplication processing. Since the preprocessing process described in this step is the same as the aforementioned preprocessing process, the embodiment of the present application will not be repeated here.

[0110] Furthermore, each preprocessed original attack sample is input into a pre-trained target detection model, and the deep semantic vector corresponding to each original attack sample is extracted through the pre-trained target detection model.

[0111] Due to the existence of a large amount of data, there will be very similar original attack samples in the original attack sample set. After obtaining the deep semantic vector corresponding to each original sample, it is also necessary to perform deduplication processing on the obtained deep semantic vector.

[0112] Specifically, the similarity between the deep semantic vectors corresponding to each of the two original samples can be calculated, for example, their cosine similarity can be calculated. If the similarity is greater than a preset threshold, for example, the preset similarity threshold is 0.6, then one of the deep semantic vectors corresponding to the two original samples can be randomly selected and the other can be deleted, or the two deep semantic vectors can be averaged to obtain a new deep semantic vector.

[0113] Currently, each original attack sample corresponds to a deep semantic vector, but it may also contain dirty data, which will affect the detection results.

[0114] Therefore, a preset clustering algorithm may also be used to find outliers in these deep semantic vectors to determine whether these outliers are dirty data.

[0115] Exemplarily, in the embodiment of the present application, the K-means clustering algorithm can be used to find outliers. Specifically, the value of the number of clusters K can be determined as the number of attack types. For example, if there are 5 types of attacks, the number of clusters K is 5. The K-means clustering algorithm can map the same type of attack samples to the same space as much as possible, and then determine whether the outliers that have not entered each cluster are dirty data, and delete the attack samples that are dirty data, thereby reducing the negative effects of dirty data on the detection model.

[0116] After deduplication processing and removal of dirty data in outliers using the above method, the deep semantic vectors corresponding to the remaining original attack samples can form a preset semantic vector library.

[0117] It can be understood that in the embodiment of the present application, the target detection model obtained by the above training can be used to extract the deep semantic vector of the network request data to be identified, and then the obtained deep semantic vector is calculated for similarity with each semantic vector in the preset semantic vector library obtained above. Cosine similarity can also be used here.

[0118] Exemplarily, the deep semantic vector corresponding to the network request data to be identified is A, and the preset semantic vector library includes deep semantic vector B, deep semantic vector C, and deep semantic vector D. Then, the similarity A between the depth semantic vector A and the depth semantic vector B, the similarity B between the depth semantic vector A and the depth semantic vector C, and the similarity C between the depth semantic vector A and the depth semantic vector D can be calculated.

[0119] S3: Based on each similarity, determine the detection result of the network request data to be identified.

[0120] In the embodiment of the present application, after obtaining the similarity between the deep semantic vector of the network request data to be identified and each semantic vector in a preset semantic vector library, the detection result of the network request data to be identified can be obtained.

[0121] Specifically, in an optional implementation, first, the similarities between the deep semantic vector of the network request to be identified and each semantic vector in a preset semantic vector library are sorted.

[0122] For example, similarity A is 0.9, similarity B is 0.95, and similarity C is 0.5. After sorting, similarity B>similarity A>similarity C, indicating that the deep semantic vector corresponding to the network request data to be identified has the highest similarity with the deep semantic vector C.

[0123] Then, if the maximum similarity is greater than the preset similarity threshold, the network data to be identified is determined to be attack data, and the attack type corresponding to the network request data to be identified can be determined, that is, the network request data to be identified is the same as the attack type of the deep semantic vector C in the above example, for example, the attack type is SQL injection.

[0124] If the maximum similarity is less than a preset similarity threshold, it is determined that the network data to be identified is normal data.

[0125] In an optional implementation, the preset semantic vector library needs to be updated regularly to ensure the accuracy of the detection. If there is a new attack sample, the first depth semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second depth semantic vector in the preset semantic vector library is changed to a normal sample, the second depth semantic vector is deleted from the preset semantic vector library. This ensures the sample accuracy of the preset semantic vector library, thereby improving the accuracy of the detection.

[0126] Further, based on the same technical concept, the embodiment of the present application provides an attack detection device, which is used to implement the above method flow of the embodiment of the present application. Figure 2 As shown, the device includes: a processing module 201, a calculation module 202 and an identification module 203, wherein:

[0127] The processing module 201 is used to obtain the network request data to be identified, and pre-process the network request data to be identified to obtain the pre-processed network request data;

[0128] The calculation module 202 is used to extract the deep semantic vector of the preprocessed network request data using a pre-trained target detection model, and calculate the similarity between the deep semantic vector and each semantic vector in a preset semantic vector library; wherein the preset semantic vector library is a semantic vector library set based on the attack sample.

[0129] The identification module 203 is used to determine the detection result of the network request data to be identified based on each of the similarities; the detection result is used to indicate that the network request data to be identified is normal data, or the network request data to be identified is attack data and the corresponding attack type.

[0130] In an optional implementation, when preprocessing the network request data to be identified, the processing module 201 is specifically used to:

[0131] Decode the network request data according to the preset encoding character rule library to obtain the target decoding result;

[0132] The target decoding results are generalized and de-duplicated.

[0133] In an optional implementation, a training module 204 is further included, and the training module 204 is specifically used to:

[0134] Input the set of training sample pairs into the detection model to be trained, and calculate the cosine similarity of each pair of training sample pairs; wherein the training sample pairs are obtained by randomly combining normal samples and / or attack samples in pairs, if the attack types of the two attack samples are the same, then the label similarity of the training sample pairs is 1, or if the attack types of the two attack samples are different, then the label similarity of the training sample pairs is 0.5, or if the normal sample is combined with the attack sample, then the label similarity of the training sample pairs is 0;

[0135] The detection model to be trained is iteratively trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples to obtain a pre-trained target detection model.

[0136] In an optional implementation, when the detection model to be trained is iteratively trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples, the training module 204 is specifically used to:

[0137] Based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples, the loss function corresponding to the detection model to be trained is calculated;

[0138] Based on the loss function, the model parameters of the detection model to be trained are adjusted until the loss function is less than a preset threshold to obtain a pre-trained target detection model.

[0139] In an optional implementation, the calculation module 202 is further configured to:

[0140] Get the original attack sample set;

[0141] Input the preprocessed attack samples into the target detection model to generate the corresponding semantic vector;

[0142] Calculate the similarity between two semantic vectors, and remove duplicates of two semantic vectors whose similarity is greater than a preset threshold;

[0143] Based on the semantic vectors after deduplication processing, a preset semantic vector library is obtained.

[0144] In an optional implementation, when determining the detection result of the network data to be identified based on the similarity, the identification module 203 is specifically used to:

[0145] Sort each similarity and determine the maximum similarity;

[0146] If the maximum similarity is greater than a preset threshold, it is determined that the network data to be identified is attack data and the attack type to which it belongs.

[0147] In an optional implementation, after determining the detection result of the network data to be identified based on the similarity, the calculation module 202 is further used to:

[0148] The preset semantic vector library is updated according to the preset period. If there is a new attack sample, the first depth semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second depth semantic vector in the preset semantic vector library is changed to a normal sample, the second depth semantic vector is deleted from the preset semantic vector library.

[0149] Based on the same technical concept, the embodiment of the present application also provides an electronic device, which can implement the attack detection method process provided in the above embodiment of the present application. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. Figure 3 As shown, the electronic device may include:

[0150] At least one processor 301, and a memory 302 connected to the at least one processor 301. The specific connection medium between the processor 301 and the memory 302 is not limited in the embodiment of the present application. Figure 3 In the example, the processor 301 and the memory 302 are connected via the bus 300. The bus 300 is Figure 3 The bus 300 is represented by a bold line, and the connection between other components is only for schematic illustration and is not intended to be limiting. The bus 300 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 301 can also be called a controller, and there is no limitation on the name.

[0151] In the embodiment of the present application, the memory 302 stores instructions that can be executed by at least one processor 301. The at least one processor 301 can execute an attack detection method discussed above by executing the instructions stored in the memory 302. The processor 301 can implement Figure 2 The functions of each module in the device shown.

[0152] Among them, the processor 301 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 302 and calling data stored in the memory 302, the various functions of the device and process data, the device can be monitored as a whole.

[0153] In one possible design, the processor 301 may include one or more processing units, and the processor 301 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 301. In some embodiments, the processor 301 and the memory 302 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0154] The processor 301 may be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of an attack detection method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0155] The memory 302 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 302 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 302 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 302 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0156] By programming the processor 301, the code corresponding to the frequency offset estimation method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1 The steps of an attack detection method in the embodiment shown are as follows: How to design and program the processor 301 is a technique known to those skilled in the art and will not be described in detail here.

[0157] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes an attack detection method discussed above.

[0158] In some possible implementations, the present application also provides various aspects of an attack detection method that can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of an attack detection method according to various exemplary implementations of the present application described above in this specification.

[0159] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0160] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0161] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0162] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0163] Program code for performing the operations of the present application may be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0165] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.< / num> < / chinese>

Claims

1. An attack detection method, characterized in that: The method comprises: Acquire network request data to be identified, and preprocess the network request data to be identified to obtain preprocessed network request data; A pre-trained target detection model is used to extract the deep semantic vector of the pre-processed network request data, and the similarity between the deep semantic vector and each semantic vector in a preset semantic vector library is calculated; wherein the preset semantic vector library is a semantic vector library set based on the attack sample; Based on each of the similarities, a detection result of the network request data to be identified is determined; the detection result is used to indicate that the network request data to be identified is normal data, or that the network request data to be identified is attack data and the corresponding attack type.

2. The method according to claim 1, characterized in that Preprocessing the network request data to be identified includes: Decoding the network request data according to a preset encoding character rule library to obtain a target decoding result; The target decoding result is generalized and de-duplicated.

3. The method according to claim 1, characterized in that The pre-trained target detection model is obtained in the following manner: Input the set of training sample pairs into the detection model to be trained, and calculate the cosine similarity of each pair of training sample pairs; wherein the training sample pairs are obtained by randomly combining normal samples and / or attack samples in pairs, and if the attack types of the two attack samples are the same, the label similarity of the training sample pair is 1, or if the attack types of the two attack samples are different, the label similarity of the training sample pair is 0.5, or if the normal sample is combined with the attack sample, the label similarity of the training sample pair is 0; The detection model to be trained is iteratively trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples to obtain the pre-trained target detection model.

4. The method according to claim 3, characterized in that The iterative training of the detection model to be trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples to obtain the pre-trained target detection model includes: Calculate the loss function corresponding to the detection model to be trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples; Based on the loss function, the model parameters of the detection model to be trained are adjusted until the loss function is less than a preset threshold, thereby obtaining the pre-trained target detection model.

5. The method according to claim 1, characterized in that The preset semantic vector library is obtained in the following manner: Get the original attack sample set; Input the preprocessed attack sample into the target detection model to generate a corresponding semantic vector; Calculate the similarity between two semantic vectors, and remove duplicates of two semantic vectors whose similarity is greater than a preset threshold; Based on the semantic vectors after deduplication processing, the preset semantic vector library is obtained.

6. The method according to claim 1, characterized in that The step of determining the detection result of the network data to be identified based on the similarity includes: Sorting the similarities to determine the greatest similarity; If the maximum similarity is greater than a preset threshold, it is determined that the network data to be identified is attack data and the attack type to which it belongs.

7. The method according to any one of claims 1 to 6, characterized in that After determining the detection result of the network data to be identified based on the similarity, the method further includes: The preset semantic vector library is updated according to a preset period. If there is a new attack sample, the first depth semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second depth semantic vector in the preset semantic vector library is changed to a normal sample, the second depth semantic vector is deleted from the preset semantic vector library.

8. An attack detection device, characterized in that: The device comprises: A processing module, used to obtain the network request data to be identified, and preprocess the network request data to be identified to obtain the preprocessed network request data; A calculation module, used to extract the deep semantic vector of the preprocessed network request data by using a pre-trained target detection model, and calculate the similarity between the deep semantic vector and each semantic vector in a preset semantic vector library; wherein the preset semantic vector library is a semantic vector library identification module set based on attack samples, and is used to determine the detection result of the network request data to be identified based on each similarity; the detection result is used to indicate that the network request data to be identified is normal data, or that the network request data to be identified is attack data and the corresponding attack type.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images