A message detection method, device, apparatus and storage medium

Abstract

The application discloses a message detection method, device and equipment and a storage medium, and is applied to the field of flow monitoring. The method comprises the following steps: extracting each type field in a white list message group to construct a corresponding field group, and dividing each field group into a first field group and a second field group according to a preset proportion; extracting the features of each field in the first field group by using a first preset number of feature extraction modes to obtain a first feature matrix; extracting the features of each field in the second field group by using the first preset number of feature extraction modes to obtain a second feature matrix; obtaining the homodistribution test result of each feature type in the first feature matrix and the second feature matrix by using a statistical test method; and detecting a to-be-processed message by using the homodistribution test result of each field group. Compared with the prior art, the method does not need to collect malicious flow for training of a classification model, avoids overfitting of the classification model due to insufficient malicious flow samples, and solves the problem of reduced recognition accuracy.

Description

Technical Field

[0001] This invention relates to the field of flow monitoring, and in particular to a message detection method, apparatus, device, and storage medium. Background Technology

[0002] WAF (Web Application Firewall), also known as Web Application Protection System or Website Application-Level Intrusion Prevention System, can protect web applications by detecting and filtering malicious traffic in web applications. However, due to the excessive number of invalid detections on the WAF, the computing resources are overloaded and the traffic cannot be detected normally. Generally, a quick whitelisting process is added before traffic detection. Most existing WAFs add quick whitelisting processes based on machine learning classification models.

[0003] Training a classification model often requires a large amount of labeled data. However, in real-world scenarios, the vast majority of targets to be protected are legitimate business requests and do not typically involve a large amount of malicious traffic. Machine learning classification models are prone to overfitting when faced with uneven sample distribution, which leads to a decrease in the accuracy of model recognition and renders them unusable. Summary of the Invention

[0004] The purpose of this invention is to provide a message detection method, apparatus, device, and storage medium for use in the field of traffic monitoring. This method uses whitelisted messages and detects the messages to be detected based on statistical testing methods. It does not require the collection of malicious traffic for training of classification models, thus avoiding the problem of overfitting of classification models and decreased recognition accuracy due to insufficient malicious traffic samples.

[0005] To solve the above-mentioned technical problems, the present invention provides a message detection method, comprising:

[0006] Extract each type of field from the whitelist message group to construct the corresponding field group, and divide each field group into a first field group and a second field group according to a preset ratio;

[0007] The features of each field in the first field group are extracted using a first preset number of feature extraction methods to obtain the first feature matrix;

[0008] The features of each field in the second field group are extracted using the first preset number of feature extraction methods to obtain the second feature matrix;

[0009] The results of the isodistribution test of each feature type in the first feature matrix and the second feature matrix are obtained by statistical testing methods.

[0010] The messages to be processed are detected using the same distribution test results for each field group.

[0011] Optionally, the detection of the message to be processed based on the isodistribution test results of each field group includes:

[0012] Obtain the field type to be detected contained in the message to be detected, and determine the target test result from the same distribution test results of each field group according to the field type to be detected;

[0013] Based on the target inspection results, extract the usable features of the fields to be detected in the message to be detected;

[0014] Based on the available features, determine whether the field to be detected is an abnormal field;

[0015] When at least one of the aforementioned abnormal fields exists, the message to be detected is determined to be an abnormal message;

[0016] If the abnormal field is not present, the message to be detected is determined to be a whitelist message.

[0017] Optionally, determining whether the field to be detected is an anomalous field based on the available features includes:

[0018] Subtract the mean value of the corresponding feature distribution from the available features to obtain the mean difference;

[0019] If the mean difference is greater than twice the standard deviation of the corresponding feature distribution, then the field to be detected is determined to be the abnormal field.

[0020] If there is no corresponding feature distribution standard deviation whose mean difference is greater than twice, then the field to be detected is determined to be a normal field.

[0021] Optional, also includes:

[0022] Set an update cycle, and update the whitelist packets in the whitelist packet group every time the update cycle is completed, and recalculate the same distribution test results.

[0023] Optional, also includes:

[0024] If a second preset number of the messages to be detected are detected as whitelisted messages within a preset time in the final detection, then the whitelisted messages in the whitelisted message group are updated, and the same distribution test result is recalculated.

[0025] Optional, also includes:

[0026] The message to be detected labeled as an abnormal message is subjected to final detection to obtain the final detection result, and the message to be detected labeled as an abnormal message is relabeled according to the final result;

[0027] The relabeled message to be detected is stored in the database.

[0028] Optionally, obtaining the isodistribution test results of each feature type in the first feature matrix and the second feature matrix through statistical testing methods includes:

[0029] The KS test is used to obtain the same distribution test results for each feature type in the first feature matrix and the second feature matrix.

[0030] To address the aforementioned technical problems, the present invention also provides a message detection device, comprising:

[0031] The first module is used to extract fields of various types from the whitelist message group to construct corresponding field groups, and to divide each field group into a first field group and a second field group according to a preset ratio.

[0032] The second module is used to extract features of each field in the first field group through a first preset number of feature extraction methods to obtain a first feature matrix;

[0033] The third module is used to extract features of each field in the second field group through the first preset number of feature extraction methods to obtain a second feature matrix;

[0034] The fourth module is used to obtain the same distribution test results of each feature type in the first feature matrix and the second feature matrix through statistical test methods;

[0035] The fifth module is used to detect the message to be processed based on the same distribution test results of each field group.

[0036] To address the aforementioned technical problems, the present invention also provides a message detection device, comprising:

[0037] Memory, used to store computer programs;

[0038] A processor for implementing any of the message detection methods when executing the computer program.

[0039] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement any of the aforementioned message detection methods.

[0040] As can be seen, the method of this invention constructs corresponding field groups by extracting fields of each type from the whitelist message group, and divides each field group into a first field group and a second field group according to a preset ratio; it extracts features of each field in the first field group using a first preset number of feature extraction methods to obtain a first feature matrix; it extracts features of each field in the second field group using the same preset number of feature extraction methods to obtain a second feature matrix; it obtains the isodistribution test results of each feature type in the first feature matrix and the second feature matrix using statistical testing methods; and it uses the isodistribution test results of each field group to detect the message to be processed. Compared with the prior art, it eliminates the need to collect malicious traffic for training the classification model, avoiding the problem of overfitting of the classification model and decreased recognition accuracy due to insufficient malicious traffic samples. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0042] Figure 1 A flowchart of a message detection method provided in an embodiment of the present invention;

[0043] Figure 2 This is a structural block diagram of a message detection device provided in an embodiment of the present invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] The following combination Figure 1 , Figure 1 A flowchart of a message detection method provided by the present invention, the method may include:

[0046] S101: Extract the fields of each type from the whitelist message group to construct the corresponding field group, and divide each field group into the first field group and the second field group according to the preset ratio.

[0047] A Web Application Firewall (WAF) is a network security device installed between a web server and a client. It can be used to inspect traffic, filter out malicious traffic, and thus protect the secure and stable operation of web applications. To reduce the computational load on the WAF, a fast whitelisting process is usually added before the original inspection process to filter traffic in advance.

[0048] This embodiment can extract various types of fields from the whitelist packet group to construct corresponding field groups, and divide each field group into a first field group and a second field group according to a preset ratio. This embodiment does not limit the source of whitelist packets in the whitelist packet group. Generally, before the fast whitelisting process is completed, the detection process built into the WAF can be used for detection, and the detected traffic is tagged and stored in the database. In this embodiment, the whitelist packets can come from whitelist packets that have already been tagged in the database.

[0049] Generally, there are different types of fields in a message, and the field types may be different between messages from the same source. In this embodiment, the fields of each type in the whitelist message group can be extracted to construct the corresponding field group. For example, if there are 400 samples in the whitelist message group, but only 300 samples contain the password field, this embodiment can extract the password field from these 300 samples to construct the password field group.

[0050] After extracting the various types of fields and constructing field groups, each field group can be divided into a first field group and a second field group according to a preset ratio. For example, a password field group with 300 samples can be divided into a first password field group with 210 samples and a second password field group with 90 samples in a 7:3 ratio. This embodiment does not limit the size of the preset ratio, nor does it limit whether the preset ratios of each field group are the same; it can be set according to the actual application.

[0051] S102: Extract the features of each field in the first field group using a first preset number of feature extraction methods to obtain the first feature matrix.

[0052] This embodiment can extract features of each field in the first field group through a first preset number of feature extraction methods to obtain a first feature matrix. This embodiment does not limit the specific value of the first preset number, nor does it limit the specific feature extraction method. It can be set according to the actual application. In this embodiment, the general feature extraction method can include 12 features in total, including string length, number of numeric characters, number of letters, number of spaces, number of special characters, information entropy, number of substrings, number of subnumeric strings, maximum substring length, maximum subnumeric character length, probability transition value, and length of non-printable characters.

[0053] For example, for the first cryptographic field group of 210 samples, features can be extracted for each sample using the above 12 feature extraction methods, resulting in a 12×210 first cryptographic feature matrix. Each column represents 12 features of a sample, and each row represents a type of feature.

[0054] S103: Extract the features of each field in the second field group using the first preset number of feature extraction methods to obtain the second feature matrix.

[0055] In this embodiment, the second feature matrix can be constructed using the same method as the first feature matrix. For example, for the second cryptographic field group of 90 samples, 12 feature extraction methods can be used to extract features for each sample, resulting in a 12×90 second cryptographic feature matrix, where each column represents 12 features of a sample and each row represents a type of feature.

[0056] S104: Obtain the results of the same distribution test for each feature type in the first feature matrix and the second feature matrix through statistical test methods.

[0057] In this embodiment, the identical distribution test results for each feature type in the first feature matrix and the second feature matrix can be obtained through statistical testing methods. The statistical testing methods used in this embodiment are tests to determine whether two sets of data follow the same distribution. These methods generally include, but are not limited to, the Anderson-Darling test, the Kolmogorov-Smirnov test, and the Cramér-von Mises test. The Cramér-von Mises test is a non-parametric test method for determining whether two sets of data follow the same distribution. In this embodiment, the KS test can generally be used to obtain the identical distribution test results for the first feature matrix and the second feature matrix. The identical distribution test results in this embodiment are used to indicate whether the feature data extracted using the same feature extraction method in the two feature matrices follow the same distribution. For example, for the first and second cryptographic feature matrices, when the feature in the first row of the matrix is ​​string length, a statistical test is performed on the 210 string length data in the first row of the first cryptographic feature matrix and the 90 string length data in the first row of the second cryptographic feature matrix to obtain the identical distribution test results for the string length feature. This embodiment does not limit the representation of the same distribution test results. Generally, passing the same distribution test can be represented as 1, and failing the same distribution test can be represented as 0. Each field group has a corresponding feature extraction method and a corresponding same distribution test result. When using 1 and 0 to represent the same distribution test results, a corresponding test matrix can be constructed based on the same distribution test results. Each row in the test matrix represents the index of the feature extraction method, and the element in each row indicates whether the feature passed the same distribution test. In this embodiment, subsequent data for testing can be added to the test matrix. For example, the second column can represent the mean of the corresponding feature distribution, and the third column can represent the standard deviation of the corresponding feature distribution. In this embodiment, each field type can correspond to a test matrix.

[0058] S105: Detect the message to be processed based on the same distribution test results of each field group.

[0059] In this embodiment, the message to be processed can be detected by the same distribution test results of each field group. This embodiment does not limit the specific detection method. Generally, the field types contained in the message to be processed can be determined first, and the target test matrix required can be determined from all test matrices by each field type. The target test matrix contains the target same distribution test results required for the test.

[0060] This embodiment does not limit the specific verification method. Generally, usable features of each detection field in the message to be detected can be extracted through the target verification results. In this embodiment, usable features refer to features extracted using the feature extraction method of the same step-by-step verification. For example, when the message to be detected contains a password field, this embodiment can call the password verification matrix corresponding to the password field and extract usable features through the same distribution verification results of the password verification matrix. When the string length feature meets the same distribution verification, the string length in the password field to be detected can be extracted and added to the usable features. When the number of numeric characters meets the same distribution verification, the number of numeric characters in the password field to be detected can be extracted and added to the usable features.

[0061] This embodiment can detect each field to be detected by using its available features. This embodiment does not limit the specific detection method; generally, the 2x standard deviation method can be used. For a field to be detected, the mean difference is obtained by subtracting the mean value of the corresponding feature distribution from each type of feature in its available features. It is then determined whether this mean difference is greater than twice the standard deviation of the corresponding feature distribution. If there is a mean difference greater than twice the standard deviation of the corresponding feature distribution, the field to be detected is determined to be an abnormal field; if not, the field to be detected is determined to be a normal field. For example, if the available features of a password field to be detected include 8 types of features, including string length, the mean difference of string length is obtained by subtracting the mean value of string length from the mean value of string length. It is then determined whether this mean difference of string length is greater than twice the standard deviation of string length. If so, the string length feature in the available features can be considered an abnormal feature; otherwise, it can be considered a normal feature. This embodiment does not limit the method for determining abnormal fields; generally, if at least one abnormal feature exists, the field can be considered an abnormal field.

[0062] This embodiment does not limit how to detect packets through abnormal fields. Generally, when a packet to be detected contains at least one abnormal field, it can be considered an abnormal packet; when a packet to be detected does not contain any abnormal fields, it can be considered a whitelisted packet.

[0063] This embodiment pre-detects the packets to be tested using statistical testing to determine whether they are abnormal or whitelisted. Whitelisted packets can be directly stored in the database. For packets detected as abnormal, a final detection is performed, which follows the existing detection process in the WAF. After the final detection, the abnormal packets will yield a final detection result. This embodiment can relabel the abnormal packets based on the final detection result. If the final detection result indicates that the packet is abnormal, the label remains unchanged or is updated to an abnormal label. If the final detection result indicates that the packet is normal, the abnormal packet is relabeled as a whitelisted packet, and the relabeled packets are stored in the database.

[0064] In this embodiment, in order to ensure the accuracy of the test results, the same distribution test results can be updated. This embodiment does not limit the specific update method. Generally, an update period can be set. After each update period, the whitelist packets in the whitelist packet group are updated, and the same distribution test results are recalculated, thereby reconstructing the test matrix.

[0065] If, during the final detection, a second preset number of messages labeled as abnormal are detected as whitelisted messages within a preset time, it can be considered that there is an error in the preliminary inspection process. In this case, the whitelisted messages in the whitelisted message group can be updated, and the same distribution test results can be recalculated.

[0066] This invention utilizes a whitelist of packets and employs statistical testing methods to detect packets to be detected. This eliminates the need to collect malicious traffic for training the classification model, thus avoiding the problem of overfitting of the classification model and decreased recognition accuracy due to insufficient malicious traffic samples.

[0067] The following is a specific embodiment of a message detection method provided by the present invention, which may include:

[0068] Extract 400 whitelist messages from the database as a whitelist message group, extract fields of each type from the whitelist message group to construct corresponding field groups, and divide each field group into a first field group and a second field group in a preset ratio of 1:1.

[0069] Features of each field in the first and second field groups are extracted using 12 feature extraction methods to obtain the first feature matrix and the second feature matrix. The 12 feature extraction methods include extracting string length, number of numeric characters, number of letters, number of spaces, number of special characters, information entropy, number of substrings, number of subnumeric strings, maximum substring length, maximum subnumeric character length, probability transition value, and non-printable character length.

[0070] The results of the isodistribution test for each feature type in the first and second feature matrices were obtained using the KS statistical test method.

[0071] Obtain the types of fields to be detected contained in the message to be detected, and determine the target test result from the same distribution test results of each field group based on the types of fields to be detected;

[0072] Based on the target inspection results, extract the usable features of the fields to be detected in the message to be detected;

[0073] The mean difference is obtained by subtracting the mean of the corresponding feature distribution from the available features. If there is a mean difference greater than twice the standard deviation of the corresponding feature distribution, the field to be detected is determined to be an abnormal field. If there is no mean difference greater than twice the standard deviation of the corresponding feature distribution, the field to be detected is determined to be a normal field.

[0074] If at least one abnormal field exists, the message to be detected is determined to be an abnormal message; if no abnormal field exists, the message to be detected is determined to be a whitelisted message.

[0075] The packets to be detected as abnormal are subjected to final detection, and the packets to be detected are relabeled based on the final detection.

[0076] The following, in conjunction with Figure 2, is a structural block diagram of a message detection device provided in an embodiment of the present invention. This device may include:

[0077] The first module 100 is used to extract fields of various types from the whitelist message group to construct corresponding field groups, and to divide each field group into a first field group and a second field group according to a preset ratio.

[0078] The second module 200 is used to extract features of each field in the first field group through a first preset number of feature extraction methods to obtain a first feature matrix;

[0079] The third module 300 is used to extract features of each field in the second field group through the first preset number of feature extraction methods to obtain a second feature matrix.

[0080] The fourth module 400 is used to obtain the same distribution test results of each feature type in the first feature matrix and the second feature matrix through statistical test methods;

[0081] The fifth module 500 is used to detect the message to be processed based on the same distribution test results of each field group.

[0082] Based on the above embodiments, the method of the present invention uses whitelisted messages and statistical testing methods to detect the messages to be detected. It does not require the collection of malicious traffic to train the classification model, thus avoiding the problem of overfitting of the classification model and decreased recognition accuracy due to insufficient malicious traffic samples.

[0083] Based on the above embodiments, the fifth module 500 may include:

[0084] The first unit is used to obtain the type of the field to be detected contained in the message to be detected, and to determine the target test result from the same distribution test results of each field group according to the type of the field to be detected;

[0085] The second unit is used to extract available features of the fields to be detected in the message to be detected based on the target inspection results;

[0086] The third unit is used to determine whether the field to be detected is an abnormal field based on the available features;

[0087] The fourth unit is used to determine that the message to be detected is an abnormal message when at least one of the abnormal fields exists;

[0088] The fifth unit is used to determine that the message to be detected is a whitelist message when the abnormal field does not exist.

[0089] Based on the above embodiments, the third unit may include:

[0090] The first subunit is used to subtract the mean value of the corresponding feature distribution from the available features to obtain the mean difference;

[0091] The second subunit is used to determine that the field to be detected is the abnormal field when there is a mean difference greater than twice the standard deviation of the corresponding feature distribution.

[0092] The third subunit is used to determine that the field to be detected is a normal field when there is no corresponding standard deviation of the feature distribution with a mean difference greater than 2.

[0093] Based on the above embodiments, the device may further include:

[0094] The first update module is used to set the update cycle. Every time the update cycle is elapsed, the whitelist packets in the whitelist packet group are updated, and the same distribution test results are recalculated.

[0095] Based on the above embodiments, the device may further include:

[0096] The second update module is used to update the whitelist messages in the whitelist message group and recalculate the same distribution test results when a second preset number of the messages to be detected are detected as whitelist messages within a preset time in the final detection.

[0097] Based on the above embodiments, the device may further include:

[0098] The final detection module is used to perform a final detection on the message to be detected that is tagged as an abnormal message to obtain a final detection result, and to re-tagged the message to be detected that is tagged as an abnormal message based on the final result;

[0099] The storage module is used to store the re-tagged message to be detected into the database.

[0100] Based on the above embodiments, the fourth module 400 may include:

[0101] The KS test unit is used to obtain the same distribution test results of each feature type in the first feature matrix and the second feature matrix through the KS test.

[0102] Based on the above embodiments, the present invention also provides a device that may include a memory and a processor. The memory stores a computer program, and when the processor invokes the computer program in the memory, it can implement the steps provided in the above embodiments. Of course, the device may also include various necessary network interfaces, a power supply, and other components.

[0103] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by an execution terminal or processor, can implement the method provided in the embodiments of the present invention; the storage medium may include various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0104] In this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0105] The above provides a detailed description of the message detection method, apparatus, device, and storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A message detection method, characterized in that, include: Extract each type of field from the whitelist message group to construct the corresponding field group, and divide each field group into a first field group and a second field group according to a preset ratio; The features of each field in the first field group are extracted using a first preset number of feature extraction methods to obtain the first feature matrix; The features of each field in the second field group are extracted using the first preset number of feature extraction methods to obtain the second feature matrix; The results of the isodistribution test of each feature type in the first feature matrix and the second feature matrix are obtained by statistical testing methods. The message to be processed is detected based on the same distribution test results of each field group; The step of detecting the message to be processed using the same distribution test results of each field group includes: Obtain the field type to be detected contained in the message to be detected, and determine the target test result from the same distribution test results of each field group according to the field type to be detected; Based on the target inspection results, extract the usable features of the fields to be detected in the message to be detected; Based on the available features, determine whether the field to be detected is an abnormal field; When at least one of the aforementioned abnormal fields exists, the message to be detected is determined to be an abnormal message; When the abnormal field does not exist, the message to be detected is determined to be a whitelist message; The step of determining whether the field to be detected is an anomalous field based on the available features includes: Subtract the mean value of the corresponding feature distribution from the available features to obtain the mean difference; If the mean difference is greater than twice the standard deviation of the corresponding feature distribution, then the field to be detected is determined to be the abnormal field. If there is no corresponding feature distribution standard deviation whose mean difference is greater than twice, then the field to be detected is determined to be a normal field.

2. The message detection method according to claim 1, characterized in that, Also includes: Set an update cycle, and update the whitelist packets in the whitelist packet group every time the update cycle is completed, and recalculate the same distribution test results.

3. The message detection method according to claim 1, characterized in that, Also includes: If a second preset number of the messages to be detected are detected as whitelisted messages within a preset time in the final detection, then the whitelisted messages in the whitelisted message group are updated, and the same distribution test result is recalculated.

4. The message detection method according to claim 1, characterized in that, Also includes: The message to be detected labeled as an abnormal message is subjected to final detection to obtain the final detection result, and the message to be detected labeled as an abnormal message is relabeled according to the final result; The relabeled message to be detected is stored in the database.

5. The message detection method according to claim 1, characterized in that, The step of obtaining the same distribution test results for each feature type in the first feature matrix and the second feature matrix through statistical testing methods includes: The KS test is used to obtain the same distribution test results for each feature type in the first feature matrix and the second feature matrix.

6. A message detection device, characterized in that, include: The first module is used to extract fields of various types from the whitelist message group to construct corresponding field groups, and to divide each field group into a first field group and a second field group according to a preset ratio. The second module is used to extract features of each field in the first field group through a first preset number of feature extraction methods to obtain a first feature matrix; The third module is used to extract features of each field in the second field group through the first preset number of feature extraction methods to obtain a second feature matrix; The fourth module is used to obtain the same distribution test results of each feature type in the first feature matrix and the second feature matrix through statistical test methods; The fifth module is used to detect the message to be processed based on the same distribution test results of each field group; The step of detecting the message to be processed using the same distribution test results of each field group includes: Obtain the field type to be detected contained in the message to be detected, and determine the target test result from the same distribution test results of each field group according to the field type to be detected; Based on the target inspection results, extract the usable features of the fields to be detected in the message to be detected; Based on the available features, determine whether the field to be detected is an abnormal field; When at least one of the aforementioned abnormal fields exists, the message to be detected is determined to be an abnormal message; When the abnormal field does not exist, the message to be detected is determined to be a whitelist message; The step of determining whether the field to be detected is an anomalous field based on the available features includes: Subtract the mean value of the corresponding feature distribution from the available features to obtain the mean difference; If the mean difference is greater than twice the standard deviation of the corresponding feature distribution, then the field to be detected is determined to be the abnormal field. If there is no corresponding feature distribution standard deviation whose mean difference is greater than twice, then the field to be detected is determined to be a normal field.

7. A message detection device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the message detection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the message detection method as described in any one of claims 1 to 5.

Images