Training method and device for server attack information generator

Abstract

The present disclosure relates to a training method and device for a server attack information generator. The method comprises generating first attack information according to preset sample information in the server attack information generator, and sending the first attack information to a web server; receiving feedback information fed back by a web application firewall in the web server according to the first attack information; training the server attack information generator according to the feedback information; training the server attack information generator through the feedback information fed back by the web application firewall in the web server, which can reduce the amount of calculation required for training the server attack information generator and provide a guiding direction for the server attack information generator to generate attack information, and is helpful to improve the success rate of attacking the server with attack information.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a training method and device for a server attack information generator. Background Art

[0002] With the development of technology, the functions of web pages are becoming more and more abundant. Web servers have become the main target of attacks because of their powerful computing power and processing performance and high value.

[0003] The existing technology mainly protects web servers from attacks through web application firewalls. The existing web application firewalls mainly implement the protection of web application firewalls by executing a series of security policies for the Hypertext Transfer Protocol. However, the existing web application firewalls protect known server attacks through a preset protection rule library and cannot deal with unknown server attacks. Summary of the invention

[0004] In view of this, the present disclosure proposes a training method for a server attack information generator, the method comprising:

[0005] Generate first attack information according to preset sample information in the server attack information generator, and send the first attack information to the web server, wherein the preset sample information includes web server attack information, and the first attack information is used to attack the web server;

[0006] receiving feedback information fed back by the web application firewall in the web server according to the first attack information, wherein the feedback information is used to indicate an identification result of the web application firewall on the first attack information;

[0007] The server attack information generator is trained according to the feedback information.

[0008] In one possible implementation, the server attack information generator includes generating an adversarial network model.

[0009] In a possible implementation manner, training the server attack information generator according to the feedback information includes:

[0010] According to the value of the first loss function of the generator and the value of the second loss function of the discriminator in the generative adversarial network model, respectively adjusting the parameters of the generator and the discriminator;

[0011] When the value of the first loss function and the value of the second loss function respectively meet the convergence conditions, completing the training of the server attack information generator;

[0012] The first loss function and the second loss function are constructed respectively through the feedback information.

[0013] In a possible implementation, the method further includes:

[0014] The trained server attack information generator is used to generate second attack information, where the second attack information is used to bypass the web application firewall to attack the web server, and the second attack information is used to be saved in a preset attack information library of the web application firewall.

[0015] In a possible implementation manner, the first attack information and the second attack information include server access request information.

[0016] According to another aspect of the present disclosure, a training device for a server attack information generator is provided, the device comprising:

[0017] a first generating module, configured to generate first attack information according to preset sample information in the server attack information generator, and send the first attack information to the web server, wherein the preset sample information includes web server attack information, and the first attack information is used to attack the web server;

[0018] a receiving module, configured to receive feedback information fed back by a web application firewall in the web server according to the first attack information, wherein the feedback information is used to indicate a recognition result of the web application firewall on the first attack information;

[0019] A training module is used to train the server attack information generator according to the feedback information.

[0020] In one possible implementation, the server attack information generator includes generating an adversarial network model.

[0021] In a possible implementation manner, the training module trains the server attack information generator according to the feedback information, including:

[0022] According to the value of the first loss function of the generator and the value of the second loss function of the discriminator in the generative adversarial network model, respectively adjusting the parameters of the generator and the discriminator;

[0023] When the value of the first loss function and the value of the second loss function respectively meet the convergence conditions, completing the training of the server attack information generator;

[0024] The first loss function and the second loss function are constructed respectively through the feedback information.

[0025] In one possible implementation, the device also includes a second generation module, which is used to generate second attack information using a trained server attack information generator, and the second attack information is used to bypass the web application firewall to attack the web server, and the second attack information is used to save it to a preset attack information library of the web application firewall.

[0026] In a possible implementation manner, the first attack information and the second attack information include server access request information.

[0027] By training the server attack information generator through the feedback information fed back by the web application firewall in the web server, the amount of calculation required for training the server attack information generator can be reduced and a guiding direction for the server attack information generator to generate attack information can be provided, which is helpful to improve the success rate of attacking the server with attack information. The attack information generated by the trained server attack information generator can simulate unknown attacks on the server, which is beneficial to improving the defense performance of the web application firewall. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0029] Figure 1 A flow chart showing a method for training a server attack information generator according to an embodiment of the present disclosure is shown.

[0030] Figure 2 A block diagram of a training device for a server attack information generator according to an embodiment of the present disclosure is shown.

[0031] Figure 3 A schematic diagram of the structure of a training device for a server attack information generator according to an embodiment of the present disclosure is shown.

[0032] Figure 4 A structural schematic diagram of a training system for a server attack information generator according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0033] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0034] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0035] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0036] Figure 1 A flow chart showing a method for training a server attack information generator according to an embodiment of the present disclosure is shown. Figure 1 As shown, the method includes:

[0037] Step S101, generating first attack information according to preset sample information in the server attack information generator, and sending the first attack information to the web server;

[0038] Step S102, receiving feedback information fed back by the web application firewall in the web server according to the first attack information;

[0039] Step S103: training the server attack information generator according to the feedback information.

[0040] In a possible implementation, the server attack information generator may include a generative adversarial network model, which may include a generator and a discriminator. The generator and the discriminator may be composed of an RNN (Recurrent Neural Network) and adopt an LSTM (Long Short Term Memory) structure.

[0041] Exemplarily, the generator is used to generate new sample information based on preset sample information in the generative adversarial network model, and send the generated new sample information to the discriminator; the discriminator is used to identify whether the sample information sent by the generator is real sample information or forged sample information.

[0042] It should be noted that the preset sample information in the generative adversarial network model can be adaptively adjusted according to the application scenario. Exemplarily, the preset sample information may include information such as pictures, texts, web server attack information, and the present disclosed embodiment does not limit the type of preset sample information. The new sample information generated by the generator may be forged information, that is, it has the same or similar features as the preset sample information, so that it is difficult for the discriminator to identify whether the new sample information generated by the generator is forged information; the identification result of the discriminator can be represented by a parameter between 0-1. Exemplarily, 1 can represent real sample information, and 0 can represent forged sample information.

[0043] In one possible implementation, a web application firewall can perform content detection and verification on various requests from web application clients to ensure their security and legality, block illegal requests in real time, and provide protection for web applications.

[0044] Exemplarily, a web application firewall can provide protection specifically for web applications by executing a series of security policies for the Hypertext Transfer Protocol. Specifically, the web application firewall can perform rule matching and behavior recognition on the content based on the Hypertext Transfer Protocol request. By parsing the data of the Hypertext Transfer Protocol, it can make judgments in different fields based on features, rules and other dimensions to determine whether the content based on the Hypertext Transfer Protocol request is a web attack behavior such as a web intrusion.

[0045] Exemplarily, the web application firewall may adopt an open source Open WAF (Web Application Firewall) engine. The Open WAF engine is a comprehensive open source web application protection system that can analyze Hypertext Transfer Protocol request information and is composed of a behavior analysis engine and a rule engine.

[0046] Among them, the behavior analysis engine is mainly responsible for tracking cross-request information. The behavior analysis engine can include anti-detection module, anti-attack module and anti-information leakage module, among which the anti-detection module has the functions of fuzzy recognition based on frequency, preventing malicious crawler attacks and performing human-machine identification; the anti-attack module has the functions of preventing CSRF (Cross-siterequest forgery) attacks and preventing privilege escalation attacks; the anti-information leakage module has the functions of preventing cookies (plain text files saved on the client) from being tampered with.

[0047] The rule engine mainly analyzes single Hypertext Transfer Protocol request information. The rule engine can perform functions such as server access protocol specification, prevent injection attacks, and block abnormal access requests.

[0048] In a possible implementation, in step S101, first attack information may be generated according to preset sample information in a server attack information generator, and the first attack information may be sent to a web page server.

[0049] Exemplarily, the preset sample information and the first attack information are used to attack the web server. The preset sample information and the first attack information may include server access traffic characteristic parameters. Exemplarily, the server access traffic characteristic parameters may include injection attack information (such as SQL (Structured Query Language) injection attack), cross-site attack information (such as CSS (Cross Site Scripting) attack), web crawler information, etc. The embodiments of the present disclosure do not limit the types of the preset sample information and the first attack information.

[0050] In a possible implementation, the server attack information generator may include a generative adversarial network model. Exemplarily, the first attack information may be generated by a generator in the generative adversarial network model and according to preset sample information in the server attack information generator.

[0051] In a possible implementation, the generator may include a noise generator, and the noise generator is used to generate noise information. Generating the first attack information according to the preset sample information in the server attack information generator may include:

[0052] By extracting feature information of preset sample information and inputting the extracted feature information into a generator, first attack information is generated according to the feature information and noise information, wherein the first attack information has features that are the same or similar to those of the preset sample information.

[0053] The first attack information generated according to the preset sample information in the server attack information generator has the same or similar features as the preset sample information, which is beneficial to improving the probability of the first attack information successfully attacking the server.

[0054] In a possible implementation, in step S102, feedback information fed back by a web application firewall in a web server according to the first attack information is received, wherein the feedback information is used to indicate an identification result of the web application firewall on the first attack information.

[0055] Exemplarily, the web application firewall can identify whether the server access information is normal access information. Specifically, if the web application firewall determines that the server access information is normal access information, the web application firewall allows the server access request information to pass; if the web application firewall determines that the server access request information is server attack information, the web application firewall blocks the server access request information.

[0056] The feedback information fed back by the web application firewall can indicate whether the first attack information generated by the generator can bypass the web application firewall, providing guidance for subsequent training of the server attack information generator.

[0057] In a possible implementation, in step S103, the server attack information generator is trained according to the feedback information.

[0058] Exemplarily, training the server attack information generator may include training the generator and the discriminator. The training goal of the generator may include that the discriminator cannot identify whether the first attack information generated by the generator is real information or forged information, and the first attack information generated by the generator can bypass the web application firewall and successfully attack the server; the training goal of the discriminator may include that the discriminator can accurately identify whether the information input into the discriminator is real information or forged information.

[0059] Without introducing feedback information, training the server attack information generator can only be done through repeated iterations until the values ​​of the loss functions corresponding to the generator and the discriminator meet the convergence conditions; by introducing feedback information to train the server attack information generator, the number of iterations can be effectively reduced, and the amount of computation required to train the server attack information generator can be reduced.

[0060] In a possible implementation, the server attack information generator is trained according to the feedback information, including:

[0061] According to the value of the first loss function of the generator and the value of the second loss function of the discriminator in the generative adversarial network model, respectively adjusting the parameters of the generator and the discriminator;

[0062] When the value of the first loss function and the value of the second loss function respectively meet the convergence conditions, completing the training of the server attack information generator;

[0063] The first loss function and the second loss function can be constructed by the feedback information respectively. For example, the first loss function of the generator can be shown as the following formula (1):

[0064] Formula (1):

[0065]

[0066] Wherein, G represents a generator, E represents an expected function, z represents noise information, G(z) represents first attack information, and D(G(z)) represents a discriminator's identification result of the first attack information, wherein z may include feedback information;

[0067] The second loss function of the discriminator can be expressed as follows:

[0068] Formula (2):

[0069]

[0070] Among them, D represents the discriminator, x represents a preset sample information, and p data represents a set of preset sample information, and D(x) represents the identification result of the discriminator on the preset sample information.

[0071] For example, J G The larger the value of is, the stronger the generator’s generation ability is, and the generated information is closer to the real information; D The smaller the value of, the stronger the identification ability of the discriminator is, and the better it can distinguish between forged information and real information.

[0072] The generator can use a heuristic method to generate the first attack information. The noise information of the first loss function of the generator may include feedback information. The feedback information can provide guidance for the generator to generate the first attack information, increase the success rate of the first attack information bypassing the web application firewall to attack the server, and make the value of the first loss function of the generator better reflect the output quality of the generator.

[0073] Similarly, feedback information can guide the discriminator to identify which information is forged, thereby improving the discriminator's identification ability, and then prompting the generator to generate forged information that is closer to the real information.

[0074] Exemplarily, the feedback information may include network flow features, such as access duration, number of bytes of accessed information, access timestamp, protocol fields of the Hypertext Transfer Protocol, etc. The network flow features can be converted into time series and used as input variables of the generator and discriminator to train the generative adversarial network model, and can prompt the generator to generate forged information that is closer to real information.

[0075] Exemplarily, the convergence condition of the first loss function may include that the information generated by the generator is input into the discriminator, and the discriminator determines that it is true information; the convergence condition of the second loss function may include that the discriminator cannot determine the authenticity of the information generated by the generator.

[0076] In a possible implementation, after step S103, the method of the embodiment of the present disclosure may further include:

[0077] The trained server attack information generator is used to generate second attack information, where the second attack information is used to bypass the web application firewall to attack the web server, and the second attack information is used to be saved in a preset attack information library of the web application firewall.

[0078] Exemplarily, the first attack information and the second attack information may include server access request information. The second attack information generated by the trained server attack information generator can attack the server when the web application firewall considers it as normal server access information, and can well simulate unknown server attack information. By saving the second attack information to the preset attack information library of the web application firewall, it can help the web application firewall update the preset attack information library and enhance the interception capability of the web application firewall against unknown attacks.

[0079] The training method of the server attack information generator of the disclosed embodiment trains the server attack information generator through the feedback information fed back by the web application firewall in the web server, which can reduce the amount of calculation required for training the server attack information generator and provide guidance for the server attack information generator to generate attack information, which helps to improve the success rate of attacking the server with attack information. The second attack information is generated by the trained server attack information generator, and the second attack information is saved in the preset attack information library of the web application firewall, which can help the web application firewall update the preset attack information library and enhance the interception capability of the web application firewall against unknown attacks.

[0080] Figure 2 A block diagram of a training device for a server attack information generator according to an embodiment of the present disclosure is shown. Figure 2 As shown, the device includes a server attack information generator 21, an information interactor 22 and a server 23.

[0081] The server attack information generator 21 may include a generator 211 and an identifier 212 , and the server attack information generator 21 is used to generate attack information to attack the server 23 .

[0082] The information exchanger 22 is used to receive the attack information sent by the server attack information generator 21 and send the attack information to the server 23; the information exchanger 22 is also used to receive feedback information fed back by the server 23 based on the attack information and send the feedback information to the server attack information generator 21.

[0083] The server 23 may include a web application firewall 231, which is used to determine whether the attack information sent by the information exchanger 22 is normal access information. Specifically, if the web application firewall 231 determines that the attack information is normal access information, the web application firewall 231 allows the attack information to pass; if the web application firewall 231 determines that the attack information is used to attack the server 23, the web application firewall 231 blocks the attack information from accessing the server 23.

[0084] Figure 3A schematic diagram of the structure of a training device for a server attack information generator according to an embodiment of the present disclosure is shown. Figure 3 As shown, the device comprises:

[0085] A first generating module 31, configured to generate first attack information according to preset sample information in the server attack information generator, and send the first attack information to the web server, wherein the preset sample information includes web server attack information, and the first attack information is used to attack the web server;

[0086] A receiving module 32, configured to receive feedback information fed back by a web application firewall in the web server according to the first attack information, wherein the feedback information is used to indicate a recognition result of the web application firewall on the first attack information;

[0087] The training module 33 is used to train the server attack information generator according to the feedback information.

[0088] In one possible implementation, the server attack information generator includes generating an adversarial network model.

[0089] In a possible implementation, the training module 33 trains the server attack information generator according to the feedback information, including:

[0090] According to the value of the first loss function of the generator and the value of the second loss function of the discriminator in the generative adversarial network model, respectively adjusting the parameters of the generator and the discriminator;

[0091] When the value of the first loss function and the value of the second loss function respectively meet the convergence conditions, completing the training of the server attack information generator;

[0092] The first loss function and the second loss function are constructed respectively through the feedback information.

[0093] In one possible implementation, the device also includes a second generation module, which is used to generate second attack information using a trained server attack information generator, and the second attack information is used to bypass the web application firewall to attack the web server, and the second attack information is used to save it to a preset attack information library of the web application firewall.

[0094] In a possible implementation manner, the first attack information and the second attack information include server access request information.

[0095] Figure 4FIG. 2 is a schematic diagram showing a structure of a training system for a server attack information generator according to an embodiment of the present disclosure. Figure 4 As shown, the system includes a generative adversarial network model 41 (an example of the server attack information generator 21), a web service component 42, a policy bypass generator 43 (the web service component 42 and the policy bypass generator 43 together constitute an example of the information interactor 22), and a web server 44 (an example of the server 23). The generative adversarial network model 41 may include a generator 411 and an identifier 412, and the web server 44 may include a web application firewall 441 and a web application 442.

[0096] Exemplarily, the generative adversarial network model 41 can generate attack information through preset sample information, wherein the attack information is used to attack the web server 44. The attack information is sent to the policy bypass generator 43 through the web service component 42, and then sent to the web server 44 by the policy bypass generator 43. The web application firewall 441 in the web server 44 identifies whether the attack information is used to attack the server, and sends the feedback information to the generative adversarial network model 41 via the policy bypass generator 43, and the generative adversarial network model 41 is trained through the feedback information.

[0097] In a possible implementation, the generative adversarial network model 41 includes a generator 411 and a discriminator 412, wherein the generator 411 and the discriminator 412 may be composed of a recurrent neural network using a long short-term memory structure. The loss functions of the generator 411 and the discriminator 412 may be respectively as shown in the aforementioned formula (1) and formula (2), which will not be repeated here.

[0098] However, the loss function cannot accurately reflect the attack effectiveness of the attack information generated by the generator 411. The generative adversarial network model 41 can be trained by introducing feedback information of the attack information from the web application firewall 441.

[0099] In a possible implementation, the web service component 42 is used to perform information exchange between the generative adversarial network model 41 and the policy bypass generator 43. Exemplarily, the web service component 42 may include two APIs (Application Programming Interface), namely, a parameter acquisition interface and a feedback information interface.

[0100] Among them, the parameter acquisition interface can obtain the attack information generated by the generator 411, and send the attack information to the policy bypass generator 43 in json format, and then the policy bypass generator 43 sends the attack information to the web server 44, trying to bypass the web application firewall 441; the feedback information interface can obtain the feedback information of the web application firewall 441 on the attack information, and feed the feedback information back to the generator 411 and the discriminator 412, and train the generative adversarial network model 41 according to the feedback information.

[0101] In a possible implementation, the policy bypass generator 43 can initiate a request to the generative adversarial network model 41 through an API, requesting to obtain the attack information generated by the generative adversarial network model 41, and send the attack information to the web server 44; in addition, the policy bypass generator 43 can also obtain the feedback information of the web application firewall 441 on the attack information, and feed the information back to the generative adversarial network model 41. By performing multiple information interactions with the generative adversarial network model 41, the generative adversarial network model 41 can be helped to change the attack strategy (for example, adjust the attack time, attack frequency, and attack cycle, etc.), so that the attack information generated by the generative adversarial network model 41 can bypass the web application firewall 441.

[0102] In a possible implementation, the web server 44 is used to provide normal web services, and in the disclosed embodiment, it can be regarded as a target of attack. The web application firewall 441 can be configured in the web server 44, and the Open WAF engine can be deployed at the same time. The protection strategy of the Open WAF engine can adopt the default Open WAF protection configuration, which can protect against general injection attacks, cross-site attacks, information leakage and other attacks. If the user performs normal access, normal web services are provided; if the web application firewall 441 detects an attack, the user access is blocked.

[0103] In a possible implementation, the function of the web application firewall 441 includes discovering and blocking suspected attacks on the web server 44. The web application firewall 441 may use an open source Open WAF engine. The Open WAF engine is the first all-round open source web application protection system, which consists of a behavior analysis engine and a rule engine, and can analyze hypertext transfer protocol request information based on the Nginx application program interface.

[0104] The rule engine is inspired by mod-security and free-waf, and the rule mechanism of mod-security is implemented through lua. Based on the rule engine, security protection such as protocol specifications, automatic tools, injection attacks, cross-site attacks, information leakage, and abnormal requests can be performed. It supports dynamic addition of rules and can promptly patch web server vulnerabilities.

[0105] The behavior analysis engine includes anti-detection modules such as frequency-based fuzzy recognition, anti-malicious crawlers, and human-machine recognition, as well as anti-attack modules such as anti-CSRF (Cross-site request forgery) attacks, anti-privilege, and file upload protection, as well as anti-information leakage modules such as cookie anti-tampering, anti-hotlinking, custom response headers, and attack response pages.

[0106] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0107] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0108] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0109] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0110] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0111] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0112] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0113] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0114] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A training method for a server attack information generator, characterized in that: The method comprises: Generate first attack information according to preset sample information in the server attack information generator, and send the first attack information to the web server, wherein the preset sample information includes web server attack information, and the first attack information is used to attack the web server; the server attack information generator includes a generative adversarial network model; the generative adversarial network model includes a generator and a discriminator; the generator and the discriminator are composed of a recurrent neural network, and adopt a long short-term memory network structure; receiving feedback information fed back by the web application firewall in the web server according to the first attack information, wherein the feedback information is used to indicate an identification result of the web application firewall on the first attack information; Training the server attack information generator according to the feedback information; Training the server attack information generator according to the feedback information includes: According to the value of the first loss function of the generator and the value of the second loss function of the discriminator in the generative adversarial network model, respectively adjusting the parameters of the generator and the discriminator; When the value of the first loss function and the value of the second loss function respectively meet the convergence conditions, completing the training of the server attack information generator; The first loss function and the second loss function are constructed respectively through the feedback information.

2. The method according to claim 1, characterized in that The method further comprises: The trained server attack information generator is used to generate second attack information, where the second attack information is used to bypass the web application firewall to attack the web server, and the second attack information is used to be saved in a preset attack information library of the web application firewall.

3. The method according to claim 1 or 2, characterized in that: The first attack information and the second attack information include server access request information.

4. A training device for a server attack information generator, characterized in that: The device comprises: A first generating module is used to generate first attack information according to preset sample information in the server attack information generator, and send the first attack information to the web server, wherein the preset sample information includes web server attack information, and the first attack information is used to attack the web server; the server attack information generator includes a generative adversarial network model; the generative adversarial network model includes a generator and a discriminator; the generator and the discriminator are composed of a recurrent neural network, and adopt a long short-term memory network structure; a receiving module, configured to receive feedback information fed back by a web application firewall in the web server according to the first attack information, wherein the feedback information is used to indicate a recognition result of the web application firewall on the first attack information; A training module, used for training the server attack information generator according to the feedback information; The training module trains the server attack information generator according to the feedback information, including: According to the value of the first loss function of the generator and the value of the second loss function of the discriminator in the generative adversarial network model, respectively adjusting the parameters of the generator and the discriminator; When the value of the first loss function and the value of the second loss function respectively meet the convergence conditions, completing the training of the server attack information generator; The first loss function and the second loss function are constructed respectively through the feedback information.

5. The device according to claim 4, characterized in that The device also includes a second generation module, which is used to generate second attack information using a trained server attack information generator, and the second attack information is used to bypass the web application firewall to attack the web server, and the second attack information is used to be saved in a preset attack information library of the web application firewall.

6. The device according to claim 4 or 5, characterized in that The first attack information and the second attack information include server access request information.

Images