A malicious request identification method, device, equipment and storage medium
By using a hybrid model to identify malicious requests, combining network security information and request object information, the problem of high false positive rates in existing technologies for identifying HTTP malicious requests is solved, achieving efficient and accurate malicious request identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- XIAN SECLOVER INFORMATION TECH CO LTD
- Filing Date
- 2023-06-02
- Publication Date
- 2026-05-19
AI Technical Summary
Existing technologies for identifying malicious HTTP requests have a high false positive rate based on predefined rule sets, while machine learning algorithms and artificial intelligence platforms are costly and difficult to meet the efficiency requirements of general enterprises.
A hybrid model is used to identify malicious requests. By acquiring network security information and request object information, the identification pattern is determined. A hybrid model of the target n-Gram model and the target NNLM model is used for identification. The fusion training of the GloVe model and the n-Gram model is combined to improve the accuracy and efficiency of identification.
While ensuring accuracy, it improves identification efficiency, reduces false alarm rate, adapts to new attack types, and lowers technical threshold and computing resource requirements.
Smart Images
Figure CN116938517B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and in particular to a method, apparatus, device and storage medium for identifying malicious requests. Background Technology
[0002] The internet has established a link between platforms and users. Users initiate requests to platforms via the internet and receive responses from them. However, with the diversification of internet content and interaction methods, malicious requests to obtain content and resources through illegitimate means have emerged. HTTP, short for Hyper Text Transfer Protocol, is a protocol for transferring files to client browsers and is one of the most common protocols on the internet. The web pages we typically access are transmitted via the HTTP protocol. With the widespread use of HTTP requests, the risk of attacks on this request has also increased. Therefore, the ability to accurately identify and recognize various abnormal HTTP requests in a changing environment has significant practical importance and high commercial value.
[0003] Currently, HTTP malicious requests are typically detected based on predefined rule sets. This detection method is relatively mature, but whether it is manually written or supplemented to an existing rule base, it cannot identify rules not included in the rule set, resulting in a high false positive rate. Summary of the Invention
[0004] This application provides a method, apparatus, device, and storage medium for identifying malicious requests, which can improve the accuracy of identifying abnormal HTTP requests.
[0005] To achieve the above objectives, this application adopts the following technical solution:
[0006] A first aspect of this application provides a method for identifying malicious requests, the method comprising:
[0007] Upon receiving an HTTP request, obtain the network security information corresponding to the HTTP request and the request object information of the HTTP request;
[0008] Based on network security information and request object information, determine the identification mode of the HTTP request. The identification mode includes a first identification mode and a second identification mode. The identification mode is used to identify whether the HTTP request is a malicious request.
[0009] If the first identification mode is determined, the pre-stored target n-Gram model is called to identify the HTTP request and obtain the first sequence information. The target n-Gram model is trained based on the training set, which is a collection of multiple HTTP request information without anomalies.
[0010] If the second recognition mode is determined, the pre-stored hybrid model is invoked to recognize the HTTP request and obtain the second sequence information. Both the first and second sequence information are used to indicate the correlation between each word in the HTTP request and other words in the HTTP request. The hybrid model is a hybrid model of the target n-Gram model and the target NNLM model. The hybrid model is trained based on the training set and the validation set. The validation set includes multiple HTTP request information without anomalies, and each HTTP request information includes corresponding word sequence annotation information. The word sequence annotation information is used to indicate the correlation between each word and other words.
[0011] Determine whether there is any abnormal information in the HTTP request based on the first sequence information or the second sequence information.
[0012] As one possible implementation, determining whether there is abnormal information in the HTTP request based on the first sequence information or the second sequence information includes:
[0013] If there is a sequence of information in the first or second sequence of information with a correlation degree less than a preset threshold, then it is determined that there is malicious information in the HTTP request.
[0014] As one possible implementation method, network security information includes: internal and external network environment information of the HTTP request, current system risk sensitivity, current system risk compatibility, and the risk level of the HTTP request source;
[0015] The request object information includes: the importance of the HTTP request object and the sensitivity of the HTTP request interface.
[0016] As one possible implementation, the method also includes the following steps before receiving an HTTP request:
[0017] Obtain the dataset of HTTP requests, which includes a training set and a validation set;
[0018] The initial GloVe model, initial n-Gram model, and initial NNLM model were trained using the training set respectively to obtain the GloVe model, n-Gram model, and NNLM model.
[0019] Based on the GloVe model, n-Gram model, and NNLM model, determine the target n-Gram model.
[0020] As one possible implementation, based on the GloVe model, the n-Gram model, and the NNLM model, the target n-Gram model is determined, including:
[0021] The GloVe model and the n-Gram model are fused to obtain the first fused model;
[0022] The GloVe model and the NNLM model are fused to obtain a second fused model;
[0023] The first fusion model and the second fusion model are cross-trained using the validation set until the model accuracy of the first fusion model and the second fusion model reaches the corresponding target accuracy, thus obtaining the target n-Gram model corresponding to the first fusion model and the target NNLM model corresponding to the second fusion model.
[0024] As one possible implementation, cross-training of the first and second fusion models using a validation set includes:
[0025] The first fusion model and the second fusion model are trained using the validation set. If one of the first fusion model and the second fusion model reaches a preset first accuracy, the model that reaches the first accuracy is determined as the first reference model, and the model parameters of the first reference model are used as the model parameters of the other model to obtain the first updated model of the other model.
[0026] The first updated model and the first reference model are trained again using the validation set. If one of the first updated model and the first reference model reaches the preset second precision, the model that reaches the second precision is determined as the second reference model, and the model parameters of the second reference model are used as the model parameters of the other model to obtain the second updated model of the other model. The first precision is less than the second precision, and the second precision is less than the target precision.
[0027] Repeat the above operations until the first fusion model and the second fusion model reach the corresponding target accuracy.
[0028] As one possible implementation, after obtaining the target n-Gram model corresponding to the first fusion model and the target NNLM model corresponding to the second fusion model, the method further includes:
[0029] Obtain the model parameters of the target n-Gram model and the target NNLM model to obtain the first model parameters and the second model parameters;
[0030] After assigning weights to the first model parameters and the second model parameters respectively, a weighted linear combination is performed to obtain the hybrid model parameters, and a hybrid model is obtained based on the hybrid model parameters.
[0031] A second aspect of this application provides a malicious request identification device, the device comprising:
[0032] The acquisition module is used to obtain network security information and request object information corresponding to the HTTP request after receiving the HTTP request.
[0033] The first determining module is used to determine the identification mode of the HTTP request based on network security information and request object information. The identification mode includes a first identification mode and a second identification mode. The identification mode is used to identify whether the HTTP request is a malicious request.
[0034] The first calling module is used to call the pre-stored target n-Gram model to identify the HTTP request if it is determined to be the first identification mode, and obtain the first sequence information. The target n-Gram model is trained based on the training set, which is a collection of multiple HTTP request information without anomalies.
[0035] The second calling module is used to call the pre-stored hybrid model to identify the HTTP request if the second recognition mode is determined, and obtain the second sequence information. Both the first and second sequence information are used to indicate the correlation between each word information in the HTTP request and other word information in the HTTP request. The hybrid model is a hybrid model of the target n-Gram model and the target NNLM model. The hybrid model is trained based on the training set and the validation set. The validation set includes multiple HTTP request information without anomalies, and each HTTP request information includes corresponding word sequence annotation information. The word sequence annotation information is used to indicate the correlation between each word information and other word information.
[0036] The second determining module is used to determine whether there is any abnormal information in the HTTP request based on the first sequence information or the second sequence information.
[0037] A third aspect of this application provides an electronic device, including a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, it implements the malicious request identification method in the first aspect of this application.
[0038] A fourth aspect of this application provides a computer-readable storage medium, characterized in that it stores a computer program thereon, which, when executed by a processor, implements the method for identifying malicious requests according to the first aspect of this application.
[0039] The beneficial effects of the technical solutions provided in this application include at least the following:
[0040] The malicious request identification method provided in this application embodiment, upon receiving an HTTP request, obtains network security information corresponding to the HTTP request and request object information of the HTTP request; based on the network security information and request object information, determines the HTTP request identification mode, which includes a first identification mode and a second identification mode, used to identify whether the HTTP request is a malicious request; if determined to be the first identification mode, a pre-stored target n-Gram model is invoked to identify the HTTP request, obtaining first sequence information, wherein the target n-Gram model is trained based on a training set, which is a collection of multiple HTTP request information without anomalies; if determined to be the second identification mode... The method calls a pre-stored hybrid model to identify the HTTP request, obtaining second sequence information. Both the first and second sequence information are used to indicate the correlation between each word in the HTTP request and other words in the HTTP request. The hybrid model is a hybrid of the target n-Gram model and the target NNLM model. The hybrid model is trained on a training set and a validation set. The validation set includes multiple HTTP request messages without anomalies, and each HTTP request message includes corresponding word sequence annotation information, which is used to indicate the correlation between each word and other words. The method determines whether there is abnormal information in the HTTP request based on the first or second sequence information. The malicious request identification method provided in this application determines the corresponding identification mode based on the network security information corresponding to the HTTP request and the request object information of the HTTP request. If it is determined that the first mode is to be used for identification, the n-Gram prediction model can be used directly for prediction. If it is determined that the second mode is to be used for identification, the hybrid model of the n-Gram prediction model and the NNLM prediction model is used for prediction. This can improve the identification efficiency while ensuring the identification accuracy. Attached Figure Description
[0041] Figure 1 A flowchart illustrating a method for identifying malicious requests provided in an embodiment of this application;
[0042] Figure 2 A structural diagram of a malicious request identification device provided in an embodiment of this application;
[0043] Figure 3 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0044] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0045] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of this disclosure, unless otherwise stated, "a plurality of" means two or more.
[0046] In addition, the use of “based on” or “according to” implies openness and inclusivity, because processes, steps, calculations or other actions “based on” or “according to” one or more conditions or values can in practice be based on additional conditions or values beyond those conditions.
[0047] The internet has established a link between platforms and users. Users initiate requests to platforms via the internet and receive responses from them. However, with the diversification of internet content and interaction methods, malicious requests to obtain content and resources through illegitimate means have emerged. HTTP, short for Hyper Text Transfer Protocol, is a protocol for transferring files to client browsers and is one of the most common protocols on the internet. The web pages we typically access are transmitted via the HTTP protocol. With the widespread use of HTTP requests, the risk of attacks on this request has also increased. Therefore, the ability to accurately identify and recognize various abnormal HTTP requests in a changing environment has significant practical importance and high commercial value.
[0048] Currently, HTTP malicious requests are typically detected based on predefined rule sets. This detection method is relatively mature, with advantages such as simplicity, ease of use, and low cost. However, its disadvantage is that neither manually written rules nor additions to existing rule bases can identify rules not included in the rule set, resulting in a high false positive rate.
[0049] Furthermore, a classifier is trained using machine learning algorithms to categorize HTTP requests. The classification results determine whether a request is malicious. This method can automatically adapt to new attack types, but it requires a large dataset to train the classifier, and individual models often have limitations in their predictive performance. The quality of the data directly determines the effectiveness of the detection scheme.
[0050] Alternatively, one can detect attacks by analyzing abnormal patterns in HTTP requests using statistical methods. This approach has the advantage of detecting unknown attack types, but it is less efficient at detecting attacks without statistically predictable patterns and may generate many false positives. Another approach is to utilize artificial intelligence platforms to analyze and detect HTTP requests, including AI robots, Robotic Process Automation (RPA), and Natural Language Processing (NLP). This solution achieves good detection results, but it has high technical barriers, requires significant computing resources, and has a high overall cost, making it difficult to meet the efficiency requirements of most enterprises and scenarios. Furthermore, security gateways can be used to detect and block malicious HTTP requests, including network firewalls and Intrusion Detection and Prevention Systems (IDS / IPS). This solution provides comprehensive network security protection, but it requires dedicated equipment, specialized technical expertise, additional costs, a high false positive rate, and frequent equipment upgrades.
[0051] Figure 1 A flowchart of a method for identifying malicious requests provided in this application embodiment specifically includes the following steps:
[0052] Step 101: After receiving the HTTP request, obtain the network security information corresponding to the HTTP request and the request object information of the HTTP request.
[0053] The network security information includes: internal and external network environment information of the HTTP request, the current system risk sensitivity, the current system risk compatibility, and the risk level of the HTTP request source. The request object information includes: the importance of the HTTP request object and the sensitivity of the HTTP request interface.
[0054] Step 102: Determine the identification pattern of the HTTP request based on network security information and request object information.
[0055] The identification mode includes a first identification mode and a second identification mode, which are used to identify whether an HTTP request is malicious.
[0056] Optionally, the network security information corresponding to the HTTP request and the request object information of the HTTP request can be input into a preset multi-level prediction and judgment algorithm to determine the corresponding identification mode. For example, if the multi-level prediction and judgment algorithm determines that the security requirements of the HTTP request are greater than the preset security level based on the network security information corresponding to the HTTP request and the request object information, then it determines to use the second identification model to identify the malicious HTTP request; otherwise, it determines to use the first identification mode to identify the malicious HTTP request.
[0057] Step 103: If the first identification mode is determined, the pre-stored target n-Gram model is called to identify the HTTP request and obtain the first sequence information.
[0058] The target n-Gram model is trained on a training set, which is a collection of HTTP request messages without anomalies.
[0059] It should be noted that before performing step 101, the target n-Gram model needs to be determined. The specific method for determination is as follows: obtain the dataset of HTTP requests, which includes a training set and a validation set; train the preset initial GloVe model, initial n-Gram model and initial NNLM model using the training set respectively to obtain the GloVe model, n-Gram model and NNLM model; determine the target n-Gram model based on the GloVe model, n-Gram model and NNLM model.
[0060] In practice, after cleaning a large amount of non-abnormal HTTP request data, 20% can be used as a validation set and the remainder as a training set. The validation set data can then be manually labeled with word sequences.
[0061] Among them, the GloVe model is a word vector model based on global word frequency statistics. Trained on a large dataset, it can obtain word vectors with semantic information. The n-Gram model is a statistical language model used to capture local relationships between words. The NNLM model is a neural network-based language model used to predict the probability of the next word; the NNLM model can learn contextual relationships and semantic information between words.
[0062] Optionally, the process of determining the target n-Gram model based on the GloVe model, n-Gram model, and NNLM model can be as follows:
[0063] The GloVe model and the n-Gram model are fused to obtain the first fused model; the GloVe model and the NNLM model are fused to obtain the second fused model; the first fused model and the second fused model are cross-trained using the validation set until the model accuracy of the first fused model and the second fused model reach the corresponding target accuracy, thus obtaining the target n-Gram model corresponding to the first fused model and the target NNLM model corresponding to the second fused model.
[0064] The process of fusing the GloVe model and the n-Gram model to obtain the first fused model can be described as follows: The vectors obtained from the GloVe model are weighted and fused with the n-Gram features obtained from the n-Gram model, directly corresponding to the weighted feature representation of each word. By fusing the word vectors from the GloVe model with the n-Gram features from the n-Gram model, both lexical-level semantic information and local contextual information can be utilized simultaneously, improving the ability to represent text and the accuracy of the language model.
[0065] The process of fusing the GloVe model and the NNLM model to obtain a second fused model can be as follows: The word vectors obtained from the GloVe model and the hidden layer representations obtained from the NNLM model are weighted and summed to obtain the second fused model, which has richer feature representations. Training the first fused model allows for adjustment of feature weights to balance the influence between the GloVe model and the n-Gram model; training the second fused model allows for adjustment of the weights of the fused features to balance the influence between the GloVe model and the NNLM model.
[0066] The above validation set is used to cross-train the first fusion model and the second fusion model. The process may include:
[0067] Using a validation set, train a first fusion model and a second fusion model respectively. If either the first or second fusion model reaches a preset first accuracy, the model that reaches the first accuracy is designated as the first reference model, and its parameters are used as the parameters of the other model, resulting in the first updated model of the other model. Then, using the validation set, continue training the first updated model and the first reference model. If either the first updated model or the first reference model reaches a preset second accuracy, the model that reaches the second accuracy is designated as the second reference model, and its parameters are used as the parameters of the other model, resulting in the second updated model of the other model. Here, the first accuracy is less than the second accuracy, and the second accuracy is less than the target accuracy. Repeat the above operations until the first and second fusion models reach their respective target accuracies.
[0068] In practice, the fused n-Gram model and the fused NNLM model are trained separately using validation set data until either model's features reach a first precision, at which point cross-validation begins. The first precision is typically set relatively low for ease of achievement. The cross-training process is as follows: using the model that has reached the first precision as a baseline, the parameters of the other model are adjusted. The adjusted model is then trained first (generally, the model whose parameters were adjusted will have higher accuracy after training). The model precision is updated, and the corresponding model parameters are adjusted again. This process is often alternating, i.e., cross-validation. Cross-validation is beneficial for rapid convergence of model training, improving efficiency and model quality. Furthermore, cross-training allows for more accurate evaluation of model performance. By dividing the dataset into multiple subsets, each subset is used alternately as both the test and training sets, allowing for multiple evaluations of the model, resulting in more reliable performance metrics. Additionally, cross-training provides a more comprehensive evaluation of model performance. Since each subset is used as both the test and training sets, it covers more data scenarios, leading to more comprehensive performance evaluation results. Finally, cross-training improves model generalization ability by reducing overfitting to specific data. More efficient parameter tuning. Cross-training allows for faster adjustment of model parameters to optimize performance. By comparing the performance of multiple models, a better understanding of how model parameters affect performance can be achieved, leading to a quicker discovery of the optimal parameter combination. Better data utilization. Cross-training allows for better utilization of data, improving the efficiency of model training. Since each subset is used as both the training and test sets, model training and evaluation can be performed without wasting data.
[0069] Step 104: If the second identification mode is determined, the pre-stored hybrid model is called to identify the HTTP request and obtain the second sequence information.
[0070] Both the first and second sequence information are used to indicate the correlation between each word in the HTTP request and other word information in the HTTP request; the hybrid model is a hybrid model of the target n-Gram model and the target NNLM model. The hybrid model is trained based on the training set and the validation set. The validation set includes multiple HTTP request information without anomalies, and each HTTP request information includes corresponding word sequence annotation information. The word sequence annotation information is used to indicate the correlation between each word and other word information.
[0071] It should be noted that before performing step 101, a hybrid model needs to be obtained. The specific process for determining the hybrid model can be as follows:
[0072] After obtaining the target n-Gram model corresponding to the first fusion model and the target NNLM model corresponding to the second fusion model, the model parameters of the target n-Gram model and the target NNLM model are obtained to obtain the first model parameters and the second model parameters. The first model parameters and the second model parameters are assigned weights respectively and then weighted linearly combined to obtain the hybrid model parameters. The hybrid model is obtained based on the hybrid model parameters.
[0073] In actual execution, after obtaining the target n-Gram model and the target NNLM model, the prediction results of each model are transformed using Softmax. The Softmax transformation process involves: inputting a matrix and outputting a matrix (i.e., performing a one-to-one function transformation on the original matrix); then assigning weights (based on experience) to the two result sets (matrices); and finally, using a weighted linear combination. The algorithm is run, outputting the probability matrix for word segmentation prediction, and storing the model and related parameters. By using a Softmax hybrid model to blend the results of the target n-Gram model and the target NNLM model after training, the accuracy and robustness of the recognition results are improved.
[0074] Understandably, while n-gram models are simple and efficient to use alone, they can only consider limited contexts. NNLM-like models, on the other hand, are more complex, requiring more training data and computational resources, but can consider longer contexts and more linguistic patterns. Combining the advantages of both can improve both training and recognition efficiency, as well as accuracy. Compared to using NNLM or n-gram models alone, using softmax fusion can significantly improve model performance, especially when dealing with large-scale language models. Furthermore, if other models are needed to supplement or modify the current model later, softmax fusion makes it relatively easy to add other models to the ensemble model; only minor adjustments to the weight parameters are needed for further performance improvements.
[0075] Step 105: Determine whether there is any abnormal information in the HTTP request based on the first sequence information or the second sequence information.
[0076] Optionally, if there is a correlation less than a preset threshold in the first sequence information or the second sequence information, then it is determined that there is malicious information in the HTTP request.
[0077] It is understandable that both the target n-gram model in the first recognition mode and the hybrid model in the second recognition mode are trained on a dataset of non-malicious HTTP requests. They are based on detecting the sequence information in the HTTP request. Therefore, in the real-time recognition process, if the correlation included in the first or second sequence information of the identified HTTP request is less than the preset threshold, it is determined that there is malicious information in the HTTP request; otherwise, it is said that the HTTP request is a non-malicious request.
[0078] The malicious request identification method provided in this application evaluates whether a multi-level prediction (i.e., whether a hybrid model needs to be called for hybrid prediction) is required based on dimensions such as the request's internal / external network environment, system risk sensitivity, system risk compatibility, the risk level of the request source, the importance of the request object, and the sensitivity of the interface. If hybrid prediction is not required, the n-Gram prediction model can be used directly, which can improve identification efficiency. If hybrid prediction is required, a model combining the target n-Gram prediction model and the target NNLM prediction model is used for prediction, which can improve identification accuracy.
[0079] like Figure 2 As shown in the figure, this application embodiment provides a malicious request identification device, the device comprising:
[0080] The acquisition module 11 is used to acquire network security information corresponding to the HTTP request and request object information of the HTTP request after receiving the HTTP request;
[0081] The first determining module 12 is used to determine the identification mode of the HTTP request based on network security information and request object information. The identification mode includes a first identification mode and a second identification mode. The identification mode is used to identify whether the HTTP request is a malicious request.
[0082] The first calling module 13 is used to call the pre-stored target n-Gram model to identify the HTTP request if it is determined to be the first identification mode, and obtain the first sequence information. The target n-Gram model is trained based on the training set, which is a collection of multiple HTTP request information without anomalies.
[0083] The second calling module 14 is used to call the pre-stored hybrid model to identify the HTTP request if the second recognition mode is determined, and obtain the second sequence information. Both the first sequence information and the second sequence information are used to indicate the correlation between each word information in the HTTP request and other word information in the HTTP request. The hybrid model is a hybrid model of the target n-Gram model and the target NNLM model. The hybrid model is trained based on the training set and the validation set. The validation set includes multiple HTTP request information without anomalies, and each HTTP request information includes corresponding word sequence annotation information. The word sequence annotation information is used to indicate the correlation between each word information and other word information.
[0084] The second determining module 15 is used to determine whether there is abnormal information in the HTTP request based on the first sequence information or the second sequence information.
[0085] In one embodiment, the second determining module 15 includes:
[0086] If there is a sequence of information in the first or second sequence of information with a correlation degree less than a preset threshold, then it is determined that there is malicious information in the HTTP request.
[0087] In one embodiment, network security information includes: internal and external network environment information of the HTTP request, current system risk sensitivity, current system risk compatibility, and the risk level of the HTTP request source; request object information includes: the importance of the HTTP request object and the sensitivity of the HTTP request interface.
[0088] In one embodiment, the apparatus further includes a training module 16, which is used for:
[0089] Obtain the dataset of HTTP requests, which includes a training set and a validation set;
[0090] The initial GloVe model, initial n-Gram model, and initial NNLM model were trained using the training set respectively to obtain the GloVe model, n-Gram model, and NNLM model.
[0091] Based on the GloVe model, n-Gram model, and NNLM model, determine the target n-Gram model.
[0092] In one embodiment, training module 16 is specifically used for:
[0093] The GloVe model and the n-Gram model are fused to obtain the first fused model;
[0094] The GloVe model and the NNLM model are fused to obtain a second fused model;
[0095] The first fusion model and the second fusion model are cross-trained using the validation set until the model accuracy of the first fusion model and the second fusion model reaches the corresponding target accuracy, thus obtaining the target n-Gram model corresponding to the first fusion model and the target NNLM model corresponding to the second fusion model.
[0096] In one embodiment, training module 16 is specifically used for:
[0097] The first fusion model and the second fusion model are trained using the validation set. If one of the first fusion model and the second fusion model reaches a preset first accuracy, the model that reaches the first accuracy is determined as the first reference model, and the model parameters of the first reference model are used as the model parameters of the other model to obtain the first updated model of the other model.
[0098] The first updated model and the first reference model are trained again using the validation set. If one of the first updated model and the first reference model reaches the preset second precision, the model that reaches the second precision is determined as the second reference model, and the model parameters of the second reference model are used as the model parameters of the other model to obtain the second updated model of the other model. The first precision is less than the second precision, and the second precision is less than the target precision.
[0099] Repeat the above operations until the first fusion model and the second fusion model reach the corresponding target accuracy.
[0100] In one embodiment, the training module 16 is further configured to:
[0101] Obtain the model parameters of the target n-Gram model and the target NNLM model to obtain the first model parameters and the second model parameters;
[0102] After assigning weights to the first model parameters and the second model parameters respectively, a weighted linear combination is performed to obtain the hybrid model parameters, and a hybrid model is obtained based on the hybrid model parameters.
[0103] The malicious request identification device provided in this embodiment can execute the method embodiment described above, and its implementation principle and technical effects are similar, so they will not be repeated here. Specific limitations on the malicious request identification device can be found in the limitations on the malicious request identification method described above, and will not be repeated here.
[0104] The execution subject of the malicious request identification method provided in this application embodiment can be an electronic device, computer device, terminal device, server or server cluster, and this application embodiment does not specifically limit it.
[0105] Figure 3 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of this application. Figure 3 As shown, the electronic device includes a processor and a memory connected via a system bus. The processor provides computing and control capabilities. The memory may include a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. These computer programs can be executed by the processor to implement the steps of the malicious request identification methods provided in the various embodiments above. The internal memory provides a cached runtime environment for the operating system and computer programs in the non-volatile storage medium.
[0106] Those skilled in the art will understand that Figure 3 The diagram shown is an internal structure diagram of an electronic device, which is only a block diagram of a part of the structure related to the present application and does not constitute a limitation on the electronic device to which the present application is applied. A specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.
[0107] In another embodiment of this application, a computer-readable storage medium is also provided, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the malicious request identification method as described in the embodiments of this application are implemented.
[0108] In another embodiment of this application, a computer program product is also provided, which includes computer instructions that, when run on a server, cause an electronic device to execute each step of the malicious request identification method in the method flow shown in the above method embodiments.
[0109] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).
[0110] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0111] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.
Claims
1. A method for identifying malicious requests, characterized in that, The method includes: Upon receiving an HTTP request, obtain the network security information corresponding to the HTTP request and the request object information of the HTTP request; Based on the network security information and the request object information, the identification mode of the HTTP request is determined. The identification mode includes a first identification mode and a second identification mode. The identification mode is used to identify whether the HTTP request is a malicious request. If the first identification pattern is determined, the pre-stored target n-Gram model is invoked to identify the HTTP request and obtain the first sequence information. The target n-Gram model is trained based on a training set, which is a collection of multiple HTTP request information without anomalies. If the HTTP request is identified as the second identification mode, the pre-stored hybrid model is invoked to identify the HTTP request and obtain second sequence information. Both the first and second sequence information are used to indicate the correlation between each word in the HTTP request and other words in the HTTP request. The hybrid model is a hybrid model of the target n-Gram model and the target NNLM model. The hybrid model is trained based on the training set and the validation set. The validation set includes multiple HTTP request messages without anomalies, and each HTTP request message includes corresponding word sequence annotation information. The word sequence annotation information is used to indicate the correlation between each word and other words. Determine whether there is any abnormal information in the HTTP request based on the first sequence information or the second sequence information.
2. The method according to claim 1, characterized in that, The step of determining whether there is abnormal information in the HTTP request based on the first sequence information or the second sequence information includes: If the correlation between the first sequence information and the second sequence information is less than a preset threshold, then it is determined that there is malicious information in the HTTP request.
3. The method according to claim 1, characterized in that, The network security information includes: internal and external network environment information of the HTTP request, current system risk sensitivity, current system risk compatibility, and the risk level of the HTTP request source; The request object information includes: the importance of the request object of the HTTP request, and the sensitivity of the interface of the HTTP request.
4. The method according to claim 1, characterized in that, Before receiving the HTTP request, the method further includes: Obtain the dataset of HTTP requests, the dataset including the training set and the validation set; The preset initial GloVe model, initial n-Gram model, and initial NNLM model are trained using the training set respectively to obtain the GloVe model, n-Gram model, and NNLM model. The target n-Gram model is determined based on the Glove model, the n-Gram model, and the NNLM model.
5. The method according to claim 4, characterized in that, The step of determining the target n-Gram model based on the GloVe model, the n-Gram model, and the NNLM model includes: The Glove model and the n-Gram model are fused to obtain a first fused model; The Glove model and the NNLM model are fused to obtain a second fused model; The first fusion model and the second fusion model are cross-trained using the validation set until the model accuracy of the first fusion model and the second fusion model reaches the corresponding target accuracy, thereby obtaining the target n-Gram model corresponding to the first fusion model and the target NNLM model corresponding to the second fusion model.
6. The method according to claim 5, characterized in that, Cross-training the first fusion model and the second fusion model using the validation set includes: The first fusion model and the second fusion model are trained using the validation set respectively. If one of the first fusion model and the second fusion model reaches a preset first accuracy, the model that reaches the first accuracy is determined as the first reference model, and the model parameters of the first reference model are used as the model parameters of the other model to obtain the first updated model of the other model. The first updated model and the first reference model are trained again using the validation set. If one of the first updated model and the first reference model reaches a preset second precision, the model that reaches the second precision is determined as the second reference model, and the model parameters of the second reference model are used as the model parameters of the other model to obtain the second updated model of the other model; wherein, the first precision is less than the second precision, and the second precision is less than the target precision; Repeat the above operations until the first fusion model and the second fusion model reach the corresponding target accuracy.
7. The method according to claim 5, characterized in that, After obtaining the target n-Gram model corresponding to the first fusion model and the target NNLM model corresponding to the second fusion model, the method further includes: Obtain the model parameters of the target n-Gram model and the model parameters of the target NNLM model to obtain the first model parameters and the second model parameters; After assigning weights to the first model parameters and the second model parameters respectively, a weighted linear combination is performed to obtain the hybrid model parameters, and the hybrid model is obtained based on the hybrid model parameters.
8. A device for identifying malicious requests, characterized in that, The device includes: The acquisition module is used to acquire network security information corresponding to the HTTP request and request object information of the HTTP request after receiving the HTTP request; The first determining module is used to determine the identification mode of the HTTP request based on the network security information and the request object information. The identification mode includes a first identification mode and a second identification mode. The identification mode is used to identify whether the HTTP request is a malicious request. The first calling module is used to call a pre-stored target n-Gram model to identify the HTTP request if it is determined to be the first identification mode, and obtain the first sequence information. The target n-Gram model is trained based on a training set, which is a collection of multiple HTTP request information without anomalies. The second calling module is used to, if determined to be the second recognition mode, call the pre-stored hybrid model to identify the HTTP request and obtain second sequence information. Both the first sequence information and the second sequence information are used to indicate the correlation between each word information in the HTTP request and other word information in the HTTP request. The hybrid model is a hybrid model of the target n-Gram model and the target NNLM model. The hybrid model is trained based on the training set and the validation set. The validation set includes multiple HTTP request information without anomalies, and each HTTP request information includes corresponding word sequence annotation information. The word sequence annotation information is used to indicate the correlation between each word information and other word information. The second determining module is used to determine whether there is abnormal information in the HTTP request based on the first sequence information or the second sequence information.
9. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program that, when executed by the processor, implements the method for identifying malicious requests as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method for identifying malicious requests as described in any one of claims 1-7.