Web injection attack detection method, device, electronic device and storage medium

Abstract

The present disclosure provides a web injection attack detection method, device, electronic device and storage medium. It includes: pre-processing the flow data to obtain the URL and post body of the flow data; extracting the features of the URL and the post body by using a first neural network to obtain sequence features; extracting the features of the URL and the post body by using custom features to obtain discrete features; splicing the sequence features with the discrete features by a second neural network to obtain comprehensive features; and detecting web injection attacks by using a third neural network to detect the comprehensive features. This realizes large-scale real-time detection of SQL injection attacks, XSS attacks, and Command injection attacks, and effectively solves the problems in the prior art caused by difficulties in data collection, few training samples, and insufficient training, which leads to insufficient training, high model underreporting rate, and low accuracy.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security, and in particular to a web injection attack detection method, device, electronic device and storage medium. Background Art

[0002] Network attacks are attacks launched by hackers or virus Trojans on electronic devices, etc., which cause huge losses to users by stealing files, etc. Attackers use malicious programs to invade and control networks and information systems to steal sensitive data and destroy systems and network environments. With the development and widespread application of network technology, network security urgently needs to be guaranteed. Common web injection attacks include SQL injection attacks, XSS attacks, and Command injection attacks. Among them, SQL injection is accessed from the normal WWW port, and on the surface it looks no different from general Web page access, so the firewalls on the market will not issue alarms for SQL injection. If the administrator does not have the habit of checking the IIS log, the invasion may not be discovered for a long time. However, the SQL injection method is quite flexible, and many unexpected situations will be encountered during the injection, and it is necessary to construct clever SQL statements to successfully obtain the desired data. XSS attacks usually refer to exploiting loopholes left when developing web pages, injecting malicious instruction codes into web pages through clever methods, so that users can load and execute web programs maliciously created by attackers; attackers can make users execute their predefined malicious scripts in browsers, and the harm caused can be imagined, such as hijacking user sessions, inserting malicious content, redirecting users, using malware to hijack user browsers, breeding XSS worms, and even destroying websites and modifying router configuration information. After the attack is successful, the attacker may obtain various contents including but not limited to higher permissions (such as executing some operations), private web page content, sessions and cookies. Command injection attack, also known as command injection attack, refers to an attack method in which hackers change the dynamically generated content of a web page by inputting HTML code into an input mechanism (such as a table field without effective verification restrictions); when users enter a web page with a command injection vulnerability, their browsers will interpret the code, which may lead to malicious commands to control the user's computer and their network.

[0003] However, existing detection technologies have problems such as difficulty in data collection, small number of training samples, and insufficient training, which leads to insufficient training, high model underreporting rate, and low accuracy. Summary of the invention

[0004] In view of this, the purpose of the present disclosure is to provide a web injection attack detection method, device, electronic device and storage medium.

[0005] Based on the above objectives, the present disclosure provides a web injection attack detection method, comprising:

[0006] Preprocess the traffic data to obtain the URL and post body of the traffic data;

[0007] Extracting features from the URL and the post body using a first neural network to obtain sequence features;

[0008] Extracting features from the URL and the post body using custom features to obtain discrete features;

[0009] By means of a second neural network, the sequence feature and the discrete feature are concatenated to obtain a comprehensive feature;

[0010] The comprehensive features are used to detect web injection attacks through a third neural network.

[0011] Optionally, the preprocessing of the traffic data to obtain the URL and postbody of the traffic data includes:

[0012] The traffic data is sequentially subjected to protocol filtering and traffic layered analysis to obtain the URL and the postbody; wherein the protocol filtering includes: filtering out the TCP handshake protocol and the TCP wave protocol in the traffic data.

[0013] Optionally, the first neural network includes: a gated recurrent unit;

[0014] The method of extracting features from the URL and the post body using a first neural network to obtain sequence features includes: encoding the text of the URL, inputting the URL and the post body into the gated recurrent unit to extract features, and obtaining the sequence features.

[0015] Optionally, the encoding includes:

[0016] Mapping is performed according to the characters of the URL to obtain an ASCII code sequence corresponding to the URL.

[0017] Optionally, the custom features include: keyword features, length features, number ratio features, special character ratio features, and whether the parameter value contains an IP feature;

[0018] The extracting features of the URL and the post body by using custom features to obtain discrete features includes:

[0019] The keyword feature, the length feature, the number ratio feature, the special character ratio feature and whether the parameter value contains an IP feature in the URL and the post body are extracted to obtain the discrete feature.

[0020] Optionally, the second neural network comprises a convolutional neural network;

[0021] The step of combining the sequence features with the discrete features through a second neural network to obtain a comprehensive feature includes:

[0022] The dimension of the sequence feature is concatenated with the dimension of the discrete feature to obtain the comprehensive feature.

[0023] Optionally, the third neural network is a fully connected neural network;

[0024] The performing web injection attack detection on the comprehensive feature by using a third neural network includes:

[0025] The comprehensive features are detected through a fully connected neural network to determine whether the traffic data is normal traffic or malicious traffic, wherein the attack methods of the malicious traffic include SQL injection attacks, XSS attacks, and Command injection attacks.

[0026] Based on the same inventive concept, the present disclosure also provides a web injection attack detection device, which includes:

[0027] A preprocessing module is configured to preprocess the traffic data to obtain a URL and a postbody of the traffic data;

[0028] A first processing module is configured to extract features from the URL and the post body by using a first neural network to obtain sequence features;

[0029] A second processing module is configured to extract features from the URL and the post body by using custom features to obtain discrete features;

[0030] A fusion module is configured to concatenate the sequence feature with the discrete feature through a second neural network to obtain a comprehensive feature;

[0031] The detection module is configured to perform web injection attack detection on the comprehensive features through a third neural network.

[0032] Based on the same inventive concept, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the methods described above when executing the program.

[0033] Based on the same inventive concept, the present disclosure also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the above methods.

[0034] From the above description, it can be seen that the web injection attack detection method, device, electronic device and storage medium provided by the present invention respectively perform sequence feature extraction and discrete feature extraction on the data traffic after protocol filtering and traffic layer analysis, and splice the sequence feature extraction and discrete feature extraction through a convolutional neural network to obtain a comprehensive feature; perform web injection attack detection according to the comprehensive feature; splice the two features, effectively improve the dimension of the feature, and can detect SQL injection attacks, XSS attacks and Command injection attacks, three common web attacks from the perspective of attack behavior, thereby effectively solving the problem of high underreporting rate and low accuracy rate that the neural network model cannot effectively model due to insufficient specific segmentation data, thereby improving the security protection capability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 A conceptual diagram of a web injection attack detection method according to an embodiment of the present disclosure;

[0037] Figure 2 A flowchart of a web injection attack detection method according to an embodiment of the present disclosure;

[0038] Figure 3 It is an experimental comparison diagram of the embodiment of the present disclosure;

[0039] Figure 4 A schematic diagram of the device structure of the web injection attack detection method according to an embodiment of the present disclosure;

[0040] Figure 5 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0042] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0043] As mentioned in the background technology section, the security of networks and information systems is of vital importance to users, but existing detection technologies have problems such as difficulty in data collection, small number of training samples, and insufficient training, which leads to insufficient training, high model underreporting rate, and low accuracy.

[0044] In the process of implementing the present disclosure, the applicant discovered that the existing detection has the problem of incomplete state feature extraction. First, feature extraction is performed by customizing several features to obtain discrete features. Then, the discrete features are spliced ​​with the sequence features extracted by the gated recurrent unit, and the dimensions of the discrete features and the sequence features are fused to obtain a high-dimensional comprehensive feature, thereby solving the problem of high model underreporting rate and low accuracy. In addition, the spliced ​​comprehensive features can realize large-scale real-time detection, overcoming the problem that the existing technology cannot perform large-scale detection of Command injection attacks.

[0045] In view of this, one or more embodiments of the present disclosure provide a web injection attack detection method, specifically, refer to Figure 1 , which is a conceptual diagram of the disclosed method. First, the traffic data is captured, and the captured traffic data is subjected to protocol filtering and traffic layer analysis to obtain the URL and post body of the traffic data. Secondly, the URL and post body are respectively subjected to temporal feature extraction and discrete feature extraction. Furthermore, the temporal feature extraction and discrete feature are spliced ​​to obtain heterogeneous high-dimensional comprehensive features. Finally, accurate classification is performed based on the comprehensive features to determine whether the captured traffic data belongs to abnormal traffic or normal traffic.

[0046] The technical solution of the present disclosure is further described in detail below through specific embodiments.

[0047] refer to Figure 2 A web injection attack detection method according to an embodiment of the present disclosure includes the following steps:

[0048] Step 201: pre-process the traffic data to obtain the URL and post body of the traffic data.

[0049] In this embodiment, the web server to be used for data collection and the port to be monitored on the server are first determined; wherein the traffic data is transmitted in the form of data packets; the port to be monitored can also be called the target port. Then, the real-time HTTP traffic data is captured by setting a monitor on the target web application target port, and then the traffic data is subjected to protocol filtering and traffic hierarchical analysis to obtain the source IP, destination IP, URL (Uniform Resource Locator) and post body (i.e., content body).

[0050] Among them, the role of the protocol filtering is to filter out a small part of the TCP handshake protocol and TCP wave protocol contained in the captured traffic data; the purpose of traffic layered analysis is to obtain the source IP, destination IP, URL (Uniform Resource Locator) and post body of the traffic data. Traffic layered analysis is to extract valid information in each layer according to the network structure, among which the network structure is divided into 5 layers, from bottom to top: physical layer, data link layer, network layer, transport layer and application layer, and the content transmitted in each layer is different; the information in the upper layer of the network structure depends on the lower layer for transmission, and the content in the network is transmitted through the physical layer, data link layer, network layer, transport layer and application layer in turn, and finally presented to the user.

[0051] The transport layer specifies the port of the host receiving the data, the network layer specifies the IP of the data packet, the URL and post body are the contents carried by the application layer, and the IP is extracted from the network layer. The physical layer receives the data packets uploaded by the host and converts the received data packets into bit streams; a group of electrical signals (including digital signals and analog signals) constitutes a data packet, also called a frame, and each frame is divided into a header (the header contains the description items of the data packet, such as the sender, receiver, and data type of the data packet) and data (the data is the specific content of the data packet); the link layer determines the grouping method of the data 0 and 1 received from the physical layer, and transmits it after the grouping is completed; the network layer determines the transmission of the grouped data to the corresponding host; the transport layer determines the port of the host receiving the data (or data packet); the application layer interprets the data received from the transport layer and presents the content to the user. The steps to obtain valid information are as follows:

[0052] Obtaining a network structure; wherein the network structure is, from bottom to top, a physical layer, a data link layer, a network layer, a transport layer, and an application layer;

[0053] Extract valid information of each layer in the network structure; wherein, the valid information includes: the port of the host sending and receiving the data packet, the transmission IP and URL of the data packet, post body, source IP, destination IP, etc.; the transport layer indicates the port of the host corresponding to the data packet, obtains the transmission IP of the data packet from the network layer, and obtains the URL and postbody of the data packet from the application layer.

[0054] In some embodiments, the role of the source IP and destination IP is to store this data together with its corresponding IP and other information when the data is detected and identified as malicious data, so as to facilitate data analysis and tracing.

[0055] In some embodiments, after the source IP, destination IP, URL (Uniform Resource Locator) and post body are extracted, URL decoding, binary data stream processing, Chinese character removal and fixed length interception are performed on the URL and post body. In some cases, the URL or post body obtained by protocol filtering and traffic layered analysis based on traffic data does not meet the input length of the neural network for feature extraction. Therefore, it is necessary to intercept the URL or post body to obtain a suitable fixed length. For example, the standard length is 150, and the data length is 162 at this time. Then, data with a length of 150 is intercepted from the data with a length of 162. Of course, the standard length can be adjusted according to the actual situation, and the needs to adapt to the actual situation are all within the scope of protection of this application.

[0056] Step 202: extract features from the URL and the post body using a first neural network to obtain sequence features.

[0057] In this embodiment, before performing sequence features according to the URL and the post body, the URL after URL decoding, binary data stream processing, removal of Chinese characters and truncation of fixed length is converted into corresponding ASCII code values ​​in character order by mapping, thereby implementing encoding. After the encoding is completed, the ASCII code corresponding to the URL is input together with the post body into the first neural network in this application, that is, the gated recurrent unit (GRU, also known as GateRecurrent Unit), for feature extraction to obtain sequence features.

[0058] Among them, the gated recurrent unit mentioned above is a type of recurrent neural network (RNN). Like LSTM (Long Short-Term Memory), it is also proposed to solve the problems of long-term dependency and gradient disappearance in back propagation. GRU is further simplified on the basis of the three gate structures of LSTM, retaining only two gate structures, the update gate and the reset gate. GRU has a simpler unit structure while maintaining the excellent effect of LSTM. Therefore, GRU is widely used. It has been successfully applied to the problem of processing sequence and time series data. Thanks to the substantial improvement in computing power in recent years, GRU has also made breakthrough progress in fields such as machine translation and sequence labeling. Compared with RNN, GRU neural network is easier to learn long-term dependency than simple recursive architecture, and can also reduce the problems of gradient disappearance and gradient explosion; compared with LSTM, GRU is easier to train and has fewer parameters while achieving comparable results, which can greatly improve computing efficiency. GRU contains a state box that receives input over time. In any time series, the input vector is input into GRU, and the output formula is as follows:

[0059] h t =f u (h t-1 , x t )

[0060] Where xt is the input vector at the current time step t, and ht and ht-1 are the state vectors at time t and time t-1 respectively. ω is a nonlinear activation function, where ω is a weight matrix. GRU uses two gates to control the contents of the memory cell, one is the update gate and the other is the reset gate. The update gate defines the extent to which the previous memory is preserved to the current state, and the reset gate determines how to combine the new input information with the previous memory. The reset gate rt and update gate zt at time step t are calculated as follows:

[0061] z t =σ(x t U z +S t-1 W z )

[0062] r t =σ(x t U r +S t-1 W r )

[0063] The current state of the GRU memory unit And the final output is as follows:

[0064]

[0065]

[0066] Among them U h and W h is the weight matrix, h t is the output of the final gated recurrent unit, which is equal to the information retained to the final memory at the previous time step plus the information retained to the final memory at the current time step.

[0067] In some embodiments, encoding is performed before extracting sequence features using a GRU neural network. This is because data such as URLs or post bodies are in the form of strings of text, which cannot be directly recognized by the neural network. A mapping relationship between characters and numbers is required so that the neural network can recognize them. Therefore, the characters need to be encoded. In other words, encoding is performed first, and after the encoding is completed, the gated recurrent unit is input for feature extraction. The encoding is specifically to make a URL include several characters, and each character in the URL corresponds to an ASCII code, and a URL includes multiple characters, that is, a URL can obtain multiple ASCII codes, so a URL can obtain an ASCII code sequence.

[0068] Step 203: extract features from the URL and the post body using custom features to obtain discrete features.

[0069] In this embodiment, the custom features mainly include: keyword features, length features, number ratio features, special character ratio features and whether the parameter value contains IP features; by using the above custom features to extract features of the URL and the post body, features that meet the above requirements in the URL and the post body are extracted, and finally discrete features are obtained.

[0070] The encoding is specifically to make a URL include several characters, and each character in the URL corresponds to an ASCII code. Therefore, a URL can obtain an ASCII code sequence. Whether the parameter value contains IP features is specifically to determine whether the URL contains IP features. In some schemes, if IP features appear, the IP features are extracted. Because some abnormal traffic will be connected to jump web pages, and some Ping IP commands will be injected into the URL, so IP will appear in the URL or post body. Therefore, whether the parameter value contains IP is extracted as a feature, and marked when it contains IP.

[0071] In some embodiments, after the discrete feature extraction is completed, the extracted discrete features are standardized, wherein the standardization is performed by scaling the original discrete digital features to a distribution with a mean of 0 and a standard deviation of 1.

[0072] In the standardized calculation, the feature values ​​are first subtracted from the mean and then divided by the standard deviation to achieve standardization so that the feature values ​​are at the same order of magnitude. In some embodiments, the values ​​of the extracted discrete features may differ greatly. For example, the value obtained when extracting the digital proportion feature is 0.5 or 0.6 or 0.2, while the value obtained when extracting the keyword feature may be 6 or 10 or 12. It is obvious that 0.5 or 0.6 or 0.2 is at least ten times different from 6 or 10 or 12. Calculation based on data with a large difference is likely to result in inaccurate final results, and will also affect the convergence of the model, resulting in difficulty in the convergence of the model.

[0073] In some embodiments, standardization has two main functions: first, by scaling discrete features of different sizes to the same standard scale, the impact of scale differences and feature units is eliminated; second, standardization is used to speed up the convergence of model training.

[0074] Step 204: Use a second neural network to concatenate the sequence feature with the discrete feature to obtain a comprehensive feature.

[0075] In this embodiment, the second neural network, that is, the convolutional neural network, is used to splice the dimension of the sequence feature with the dimension of the discrete feature to obtain the comprehensive feature. For example, after feature extraction by the gated recurrent unit and the custom feature, the dimensions of the sequence feature extraction and the discrete feature are 64 dimensions and 5 dimensions respectively, while the comprehensive feature after splicing is 69 dimensions. The spliced ​​comprehensive feature not only has a higher dimension, but also combines the sequence feature and the discrete feature, making it more conducive to detecting the attack behavior, and is conducive to improving the accuracy of detection and reducing the false negative rate. Of course, in actual situations, the dimensions of the extracted sequence features and the dimensions of the discrete features may not necessarily be 64 and 5, but may be 70 and 6 respectively, or may be other dimensions, all of which are within the scope of protection of the present disclosure.

[0076] In some embodiments, the dimension of a feature is also referred to as an "order". When the dimension is 64, it is also referred to as 64-order. The higher dimension obtained by adding the dimension of a sequence feature to the dimension of a discrete feature can be referred to as a high-order feature.

[0077] Step 205: Perform web injection attack detection on the comprehensive features through a third neural network.

[0078] In this embodiment, the spliced ​​comprehensive features with high-dimensional features are input into a fully connected neural network, that is, the third neural network in this application, to perform web injection attack detection to determine whether the traffic data is normal traffic or malicious traffic, wherein the attack methods of the malicious traffic include SQL injection attacks, XSS attacks, and Command injection attacks.

[0079] In addition, reference Figure 3 The present disclosure also conducted a comparative experiment based on the existing detection scheme and the detection scheme of the present invention. The figure lists five models for detecting web injection attacks, namely Char-GRU, Char-CNN, C-LSTM, eXpose and the detection model in the present application, and indicates the accuracy, precision, recall rate and F1 value (F-Measure) corresponding to each model. It can be seen from the figure that for web injection attack detection, the model of the present application is superior to the existing centralized model in terms of accuracy, precision, recall rate and F1 value. Among them, accuracy, also known as "correctness", refers to the correctness of expressing or describing a thing. In the present disclosure, it is expressed as the ratio of detected attack behaviors to actual attack behaviors. When the number of detected behaviors is equal to the number of actual attack behaviors, the accuracy is the highest, which is 100%; precision, in machine learning, is expressed as the proportion of examples classified as positive examples that are actually positive examples; recall rate refers to the coverage; F value is a comprehensive evaluation indicator. For example, there are two indicators, P and R. When the two indicators contradict each other, they need to be comprehensively considered through weighted harmonic average to obtain the weighted harmonic average formula. F1 refers to the value of F when α in the formula is 1. The higher the F1, the better the detection effect of the model. Furthermore, Char-GRU refers to a character-embedded GRU network, which first embeds the acquired traffic data into characters, then uses the GRU deep learning model to extract temporal features, and finally uses a fully connected layer for classification; Char-CNN refers to a character-embedded CNN network, which first embeds the acquired traffic data into characters, then uses a convolutional neural network to automatically extract text abstract features, and finally uses a fully connected layer to classify the mentioned text abstract features to achieve web communication sample traffic data classification. C-LSTM refers to a detection model composed of CNN and LSTM, where CNN is used to capture high-level features of words and LSTM is used to capture long-term dependency information.

[0080] As can be seen from the above, the web injection attack detection provided in the embodiment of the present disclosure first performs protocol filtering and traffic layered analysis on the captured traffic data to remove data information with interference, so as to improve the accuracy in the subsequent feature extraction process, and obtain the source IP, destination IP, URL and post body, and then, extracts features through the gated loop unit and the custom features to obtain sequence features and discrete features, wherein the URL must be encoded before the sequence feature extraction in order to extract the sequence features; when the discrete features are extracted, the discrete features must be standardized, and further, the sequence features and the discrete features are spliced ​​to obtain a high-dimensional comprehensive feature including the sequence features and the discrete features; finally, the web injection attack detection is performed according to the comprehensive features to determine whether the captured traffic data belongs to normal traffic or malicious traffic, and when it is determined to be malicious traffic, it is determined whether it is an SQL injection attack, an XSS attack or a Command injection attack. The present invention realizes large-scale detection of traffic data, and can detect three types of attacks, namely SQL injection attacks, XSS attacks and Command injection attacks. It also solves the problems of high false negative rate and low accuracy in the prior art due to insufficient segmentation types and inability to effectively model through feature splicing, thereby improving the security protection capability of the system.

[0081] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0082] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0083] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides a web injection attack detection device.

[0084] refer to Figure 4 , the web injection attack detection device comprises:

[0085] A preprocessing module 401 is configured to preprocess the traffic data to obtain the URL and post body of the traffic data;

[0086] A first processing module 402 is configured to extract features from the URL and the post body using a first neural network to obtain sequence features;

[0087] The second processing module 403 is configured to extract features from the URL and the post body by using custom features to obtain discrete features;

[0088] A fusion module 404 is configured to combine the sequence feature with the discrete feature through a second neural network to obtain a comprehensive feature;

[0089] The detection module 405 is configured to perform web injection attack detection on the comprehensive features through a third neural network.

[0090] For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0091] The device of the above embodiment is used to implement the corresponding web injection attack detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0092] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the web injection attack detection method described in any of the above embodiments is implemented.

[0093] Web injection attack detection shows a more specific schematic diagram of the hardware structure of an electronic device provided by this embodiment. Figure 5 The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0094] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0095] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0096] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0097] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0098] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0099] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0100] The electronic device of the above embodiment is used to implement the corresponding web injection attack detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0101] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure further provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the web injection attack detection method described in any of the above embodiments.

[0102] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0103] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the web injection attack detection method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0104] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0105] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present disclosure difficult to understand, the known power / ground connections to the integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present disclosure difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present disclosure will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it is apparent to those skilled in the art that the embodiments of the present disclosure can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0106] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0107] The embodiments of the present disclosure are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A method for detecting a web injection attack, comprising: Preprocess the traffic data to obtain the URL and post body of the traffic data; Extracting features from the URL and the post body using a first neural network to obtain sequence features; By using custom features to extract features from the URL and the post body, discrete features are obtained; wherein the custom features include: keyword features, length features, number ratio features, special character ratio features, and whether the parameter value contains an IP feature; The extracting features of the URL and the post body by using custom features to obtain discrete features includes: Extract the keyword feature, the length feature, the number ratio feature, the special character ratio feature, and whether the parameter value contains an IP feature in the URL and the post body to obtain the discrete feature; By means of a second neural network, the sequence feature and the discrete feature are concatenated to obtain a comprehensive feature; The comprehensive feature is subjected to web injection attack detection through a third neural network; wherein the third neural network is a fully connected neural network, and the comprehensive feature is detected through the fully connected neural network to determine whether the traffic data is normal traffic or malicious traffic, wherein the attack methods of the malicious traffic include SQL injection attacks, XSS attacks, and Command injection attacks.

2. The web injection attack detection method according to claim 1, wherein: The preprocessing of the traffic data to obtain the URL and post body of the traffic data includes: The traffic data is sequentially subjected to protocol filtering and traffic layered analysis to obtain the URL and the post body; wherein the protocol filtering includes: filtering out the TCP handshake protocol and the TCP wave protocol in the traffic data.

3. The web injection attack detection method according to claim 1, wherein: The first neural network includes: a gated recurrent unit; The method of extracting features from the URL and the post body using a first neural network to obtain sequence features includes: encoding the text of the URL, inputting the URL and the post body into the gated recurrent unit to extract features, and obtaining the sequence features.

4. The web injection attack detection method according to claim 3, wherein: The encoding comprises: Mapping is performed according to the characters of the URL to obtain an ASCII code sequence corresponding to the URL.

5. The web injection attack detection method according to claim 1, wherein: The second neural network comprises a convolutional neural network; The step of combining the sequence features with the discrete features through a second neural network to obtain a comprehensive feature includes: The dimension of the sequence feature is concatenated with the dimension of the discrete feature to obtain the comprehensive feature.

6. A web injection attack detection device, wherein: include: A preprocessing module is configured to preprocess the traffic data to obtain a URL and a post body of the traffic data; A first processing module is configured to extract features from the URL and the post body by using a first neural network to obtain sequence features; The second processing module is configured to extract features from the URL and the post body by using custom features to obtain discrete features; wherein the custom features include: keyword features, length features, number ratio features, special character ratio features, and whether the parameter value contains an IP feature; The extracting features of the URL and the post body by using custom features to obtain discrete features includes: Extract the keyword feature, the length feature, the number ratio feature, the special character ratio feature, and whether the parameter value contains an IP feature in the URL and the post body to obtain the discrete feature; A fusion module is configured to concatenate the sequence feature with the discrete feature through a second neural network to obtain a comprehensive feature; The detection module is configured to perform web injection attack detection on the comprehensive feature through a third neural network; wherein the third neural network is a fully connected neural network, and the comprehensive feature is detected through the fully connected neural network to determine whether the traffic data is normal traffic or malicious traffic, wherein the attack method of the malicious traffic includes SQL injection attack, XSS attack and Command injection attack.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 5 when executing the program.

8. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 5.

Images