A method for intercepting illegal WEB requests based on artificial intelligence

Abstract

The present invention discloses a method for intercepting illegal WEB requests based on artificial intelligence, which relates to the field of network security. The method comprises: obtaining a request log file of an application, obtaining a recognition model based on the request log file, and applying the recognition model to the application; if the application receives a request, identifying the characteristics of the request based on the recognition model, and judging whether the request is legal based on the characteristics, and if so, passing the request to a server for response processing; otherwise, intercepting the request. The method can quickly identify illegal requests and has a high recognition rate for illegal requests.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an artificial intelligence-based interception method for illegal WEB requests. Background Art

[0002] With the rapid development of the Internet and the rise of social media, while bringing convenience, the security situation of cyberspace has become increasingly severe, and network security and user privacy issues have attracted more and more attention. A Web system needs to process a large number of user requests every day. In addition to reasonable user requests, there are also illegal requests, such as XSS (cross-site scripting) attack requests, CSRF (cross-site request forgery) and SQL injection vulnerabilities. In the face of complex network attacks, the current common solution is to use the relevant mechanisms and functions provided by the development framework to intercept them. However, since the relevant mechanisms and functions provided are not specifically used to intercept illegal requests such as malicious attacks, the recognition rate and efficiency of illegal requests are low, which leads to problems such as the user's WEB network space being invaded by viruses or the leakage of user privacy. Summary of the invention

[0003] In order to protect the network security and user privacy of WEB, the present invention provides a method for intercepting illegal WEB requests based on artificial intelligence, the method comprising: obtaining the request log file of the application, obtaining a recognition model based on the request log file, and applying the recognition model to the application; if the application receives a request, identifying the characteristics of the request based on the recognition model, judging whether the request is legal based on the characteristics, and if so, passing the request to the server for response processing; otherwise, intercepting the request. Obtaining the recognition model through the request log file of the application, and then applying the recognition model to the application, identifying the characteristics of the request through the recognition model, thereby judging whether the request is legal, the application of the recognition model can comprehensively and quickly parse the characteristics of the request, thereby improving the recognition rate and recognition efficiency of illegal requests.

[0004] In the process of implementing the above scheme, the applicant found that recognition models trained with different algorithms have different recognition effects. In order to select a better recognition model, the applicant optimized the steps of obtaining the recognition model, trained multiple different models through the request log file, and then tested the model with the test set to obtain the recognition result, and then compared the recognition result with the preset parameters to obtain the optimal model.

[0005] Furthermore, the specific steps of obtaining the recognition model based on the request log file include: preprocessing the request log file to obtain a data set, the data set including a number of legal request data and a number of illegal request data; performing feature extraction and feature construction on the data set to obtain a training set; selecting a number of first models based on preset parameters; training each of the first models based on the training set to cumulatively obtain a number of optimized models; testing each of the optimized models based on the test set to cumulatively obtain a number of test results; comparing each of the test results with preset indicators to obtain the optimal test result; and obtaining the recognition model based on the optimization model corresponding to the optimal test result. Preprocessing the request log file can improve the diversity and repeatability of the data set to improve the robustness of the model. Feature extraction and feature construction of the data set can improve the recognition performance and generalization ability of the recognition model. Iterative training of each of the first models using the training set can minimize the error between the prediction result of the optimization model and the true value. Each optimization model is evaluated using the test set, including the prediction performance, accuracy and generalization ability of each optimization model, and the optimization model with the best indicators is selected to obtain the recognition model, thereby improving the recognition rate and recognition efficiency of the recognition model.

[0006] In the process of implementing the above solution, the applicant found that the user's request was an illegal request, but the user needed relevant request data. In order to solve this problem, the applicant improved the method, obtained the request data of the request, and recommended data related to the user's request by extracting and matching keywords of the request data.

[0007] Furthermore, if the request is an illegal request, the method also includes: obtaining request data of the request, performing keyword extraction on the request data to obtain keywords; obtaining recommendation data matching the keywords, wherein the recommendation data is used to recommend data required by the user when the request is intercepted, and recommending data related to the request to the user while ensuring the user's network security, thereby improving the user's experience.

[0008] In the process of implementing the above solution, the applicant found that the recognition model would mistakenly identify certain user requests as illegal requests, and then intercept them, resulting in the user being unable to view the request data. In order to solve this problem, the applicant improved the method and recorded the URL corresponding to the request to the trust list, so that the user can view the request data.

[0009] Furthermore, if the request is an illegal request, the method further includes: recording the first URL corresponding to the request into a trust list, updating the request to a legal request, and the trust list is used to prevent the user from accessing the first URL in the event of an erroneous interception. Remedial measures for erroneous interception are added to improve the user experience.

[0010] In the process of implementing the above scheme, in order to reduce the number of false interceptions of the recognition model, the applicant improved the method, obtained the requests in the trust list, performed feature extraction on them, and obtained trust features. If the recognition model recognizes the trust features, it predicts that the request is a legitimate request, thereby reducing the number of false interceptions of the recognition model.

[0011] Furthermore, the method further includes: obtaining a number of the first URLs in the trust list, extracting features from each of the first URLs to obtain trust features; if the recognition model recognizes the trust features, predicting that the request is a legitimate request, thereby reducing the number of false interceptions and improving the user experience.

[0012] In the process of implementing the above scheme, the applicant found that although some requests were identified as legitimate requests, users hated them and added them to the blacklist. In order to solve this problem, the applicant improved the method, obtained the requests in the blacklist, extracted their features, and obtained the interception features. If the recognition model recognizes the interception features, it predicts that the request is an illegal request, thereby realizing automatic identification of requests that users hate and improving the user experience.

[0013] Furthermore, if the request is a legitimate request, the method further includes: obtaining a number of second URLs in the user's blacklist; extracting features from each of the second URLs to obtain interception features; and predicting that the request is an illegal request if the recognition model recognizes the interception features. Automatically identifying requests that users hate improves the user experience.

[0014] In the process of implementing the above scheme, the applicant found that some requests contained advertisements, and the advertisements occupied a large space on the web page, reducing the user's usage experience and viewing experience. Even when the user clicks on certain advertisements, the user will be redirected to other web pages, which will cause the user's network security to be attacked or the user's privacy to be leaked. In order to solve this problem, the applicant improved the method by further training the recognition model with web page data containing advertisements and web page data not containing advertisements, so that the recognition model can identify whether the request data of the request contains advertisements. If so, the advertising data will be deleted, thereby protecting the user's network security and privacy security.

[0015] Furthermore, if the request is a legitimate request, the method further includes: obtaining web page data of the application, the web page data including web page data containing advertisements and web page data not containing advertisements; extracting features from the web page data to obtain a web page training set, training the recognition model based on the web page training set, and the recognition model identifying whether the web page data contains advertisements. The recognition model is further improved to enhance the integrity and versatility of the recognition model.

[0016] Furthermore, the specific steps of the recognition model identifying whether the web page data contains advertisements include: obtaining the request data of the request; analyzing the request data based on the recognition model to obtain advertisement features, the advertisement features include several sub-features, each of which corresponds to a weight; accumulating the weight of each sub-feature to obtain the weight value of the advertisement feature; determining whether the weight value is greater than or equal to a threshold; if so, obtaining the advertisement data in the request data based on the advertisement feature; deleting the advertisement data to obtain filtered data; and updating the request data to the filtered data. Deleting advertisement data improves the user experience and reduces potential dangers.

[0017] In the process of implementing the above solution, the applicant found that in some scenarios, users need to view the interception records. The applicant improved the method and added the interception records to the interception list for users to view the interception records.

[0018] Furthermore, if the request is an illegal request, the method further includes: recording the request into an interception list.

[0019] In the process of implementing the above solution, the applicant found that the request data of some illegal requests contained malicious data. In order to solve this problem, the applicant improved the method by deleting or replacing the malicious data, so that the illegal requests were changed into legal requests, which can increase the available range of the request data while ensuring the user's network security.

[0020] Furthermore, if the request is an illegal request, the method further includes: obtaining request data of the request, cleaning the request data, obtaining a second request, changing the second request to a legal request, and updating the request to the second request. The available range of request data is increased, thereby improving the user experience.

[0021] In the process of implementing the above scheme, the applicant considers that when the application is attacked by illegal requests, the application should respond or take protective measures accordingly. The applicant has improved the method to determine the type of illegal requests and respond to different types with different mechanisms, thereby further protecting the user's network security or privacy.

[0022] Furthermore, if the request is an illegal request, the method further includes: analyzing the request based on the identification model to obtain the illegal request type of the request, and based on the illegal request type, initiating an emergency response mechanism corresponding to the illegal request type.

[0023] In the process of implementing the above scheme, the applicant took into account that some users do not want to leave request records, so the applicant improved the method. After the user closes the URL corresponding to the request, the request record is deleted to achieve invisible browsing and protect the user's privacy.

[0024] Furthermore, the method further includes: if the request ends, deleting the record of the request.

[0025] In the process of implementing the above scheme, the applicant took into account that some users wish to record their request records in a hidden space and do not want others to view them, so the applicant improved the method and set a verification code. Only when the verification code entered is consistent with the verification code set by the user, the hidden request records can be viewed, thereby improving the privacy of user privacy.

[0026] Furthermore, the method further includes: obtaining a verification code, determining whether the verification code is the same as a set verification code, and if so, obtaining a request record of the request.

[0027] In the process of implementing the above solution, the applicant found that some criminals would crawl users' web page data through the Internet. In order to solve this problem, the applicant improved the method by adding or replacing false request records in user request records, so that the user information obtained by criminals is wrong, thereby achieving the purpose of protecting privacy.

[0028] Furthermore, the method also includes: setting a false request record; and updating the request record of the request to the false request record.

[0029] One or more technical solutions provided by the present invention have at least the following technical effects or advantages:

[0030] 1. By training multiple models, the optimal recognition model is selected to improve the recognition rate and efficiency of illegal requests. 2. Analyze the request data corresponding to the intercepted illegal requests, recommend the user data related to the request data, ensure the user's network security and meet the user's request. 3. Identify whether the request data of the legitimate request contains advertisements, and delete the advertisement data to improve the user's network security. 4. Incognito browsing and verification code improve user privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of the present invention, and do not constitute a limitation on the embodiments of the present invention;

[0032] Figure 1 It is a flowchart of a method for intercepting illegal WEB requests based on artificial intelligence in the present invention;

[0033] Figure 2 It is a schematic diagram of the specific steps of obtaining a recognition model through a log file in a method for intercepting illegal WEB requests based on artificial intelligence in the present invention;

[0034] Figure 3 It is a flow chart of identifying whether a web page contains advertisements in a method for intercepting illegal WEB requests based on artificial intelligence in the present invention;

[0035] Figure 4 It is a schematic diagram of the processing flow of illegal requests and legal requests in an artificial intelligence-based WEB illegal request interception method in the present invention. DETAILED DESCRIPTION

[0036] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0037] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those within the scope of this description. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0038] Example 1

[0039] refer to Figure 1 and Figure 2In this embodiment, the request log file generated by the WEB application deployed on the public network is obtained, the request log file is parsed and then data cleaning is performed to remove noise, missing values ​​and duplicate values, etc., and then data integration is performed to integrate all the data into a data set, and the data in the data set is transformed to standardize and normalize the data to facilitate the use of the machine learning algorithm. The data is then reduced to reduce the size of the data set and improve the efficiency of the machine learning algorithm. Then, legal request data and illegal request data are manually sorted out and classified, and feature selection is performed separately. The selected features can be IP addresses, URI paths, response status codes, and traffic, etc., and then the number and diversity of the data sets are increased by adding noise, rotating and scaling, etc., to improve the machine learning algorithm. The robustness and generalization ability of the learning algorithm are learned. Then, the feature extraction and feature construction of the legal request data and the illegal request data are performed through regular expression matching to improve the recognition performance and generalization ability of the model and obtain the training set. Taking into account the data characteristics, model complexity and algorithm recognition efficiency, multiple suitable models are selected, such as the naive Bayes model, decision tree model, random forest model, neural network model and convolutional neural network, etc., and each model is trained with the training set. Then, the model parameters are optimized through iterative training to minimize the error between the model's prediction results and the true value. Then, each trained model is evaluated through the test set to evaluate the prediction performance, accuracy, efficiency and generalization ability of each model, and the model with the best indicators is selected to obtain the recognition model. The recognition model is integrated into the application. When the client sends a request to the application, the recognition model identifies the request and predicts and identifies it according to the characteristic parameters of different requests. If the characteristic parameters meet the illegal request characteristics, the request is intercepted. If not, the request is passed to the system for processing and then the required result is returned to the client. In this embodiment, the machine algorithm can be a decision tree algorithm, a neural network algorithm and an SVM (support vector machine) algorithm. The selected features can also be features related to WEB requests such as user agent, request frequency and request interval. The feature extraction and feature construction methods can also be through string processing, such as segmentation, truncation and replacement, or importing log data into the database for extraction and aggregation through SQL statements, or training and predicting features through machine learning algorithms, or preprocessing tools and other open source tools and frameworks, etc. The integration method can adopt RESTful API, provide service interface through http protocol or build the recognition model into the system, or call the API or SDK interface of the recognition model.

[0040] Example 2

[0041] Based on the above embodiments, the applicant found that the application of the recognition model can be used for defense, but it can also be used by attackers to attack. Attackers will try to confuse the recognition model to make it make incorrect classifications, misjudgments, or even completely destroy the recognition model. In order to solve this problem, the applicant has improved the method, which also includes: processing the training set to obtain an adversarial set; performing adversarial training on the recognition model based on the adversarial set, and the recognition model recognizes adversarial attacks. During training, the recognition model learns how to deal with adversarial attacks, which can improve its robustness and reduce the success rate of attackers attacking through adversarial samples.

[0042] The training set is slightly perturbed by the fast gradient sign method (FGSM) to generate adversarial samples, and the recognition model is trained using the adversarial samples so that the recognition model can recognize adversarial attacks. In this embodiment, FGSM can also be a gradient-based optimization method (BIM) or adversarial machine learning.

[0043] Example 3

[0044] On the basis of the above embodiments, the applicant found that the recognition model can identify currently known threats, and with the development of network technology, the attacker's attack methods are also constantly improving and optimizing, and new attack methods or malicious codes have emerged. These unknown threats cannot be identified by the recognition model. In order to solve this problem, the applicant has improved the method, which also includes: real-time detection of the request, extracting the monitoring indicators generated during the request process of the request, detecting and analyzing the monitoring indicators, and if the fluctuation range of the monitoring indicators is greater than the preset range, an abnormal warning is initiated. The fluctuation range refers to the distance between the peak and the trough formed by the fluctuation of the monitoring indicator within a certain period of time. For example, if the number of processes increases by 100 within 1 second, the fluctuation range is 100, and the preset range is 50. If 100 is greater than 50, an abnormal warning is initiated. Currently, there are two types of unknown threats. One is the one that can be predicted and can be prevented to a certain extent, called "known unknown threats", and the other is the one that cannot be predicted and makes people feel that there is no way to prevent it, called "unknown unknown threats". By converting "unknown unknown threats" into "known unknown threats", we can discover hacker intrusions by unknown means through real-time intrusion detection based on abnormal behavior, realize real-time intrusion detection and rapid response, and once an abnormal situation is found, millisecond-level alarm will be issued to improve the efficiency of unknown threat detection.

[0045] During the request process, a large number of monitoring indicators generated during the detection request process are extracted, and the indicators are continuously observed and analyzed, such as the number of file processes, host access frequency, and business relationships. If the fluctuation range of the monitoring indicators is greater than the preset range, such as the number of file processes increases rapidly and exceeds the threshold, the host is frequently accessed in a short period of time, or subroutines under other programs are called, an abnormal warning is quickly initiated. Monitoring intrusion behavior greatly ensures the accuracy and reliability of fighting against unknown threats.

[0046] Example 4

[0047] refer to Figure 4 On the basis of the above embodiment, in this embodiment, when a request is intercepted, the request data corresponding to the request is captured by a web crawler, the keywords are captured using a machine learning algorithm, and the data related to the keywords are obtained by a web crawler and displayed on the page to recommend data that the user may need. In this embodiment, the method of obtaining data can also be data mining analysis, acquisition through an API interface or other third-party tools, and the method of capturing keywords can also be regular expression matching, setting keyword screening rules or deep learning algorithms, etc.

[0048] Example 5

[0049] refer to Figure 4 Based on the above embodiment, in this embodiment, when a request is intercepted, when the user adds the URL corresponding to the request to the trust list, when the recognition model recognizes the request again, if the corresponding URL is matched in the trust list, the request is recognized as a legitimate request. At the same time, all the URLs in the trust list are obtained, and features are extracted from them through a machine learning algorithm to obtain trust features. When the recognition model recognizes the trust features when recognizing the request, the request is predicted to be a legitimate request.

[0050] Example 6

[0051] refer to Figure 4 On the basis of the above embodiment, in this embodiment, when a request is identified as a legitimate request but the URL corresponding to the request is blacklisted by the user, when the recognition model identifies the request again, if the corresponding URL is matched in the blacklist, the request is identified as an illegal request. At the same time, all the URLs in the blacklist are obtained, and features are extracted from them through a machine learning algorithm to obtain interception features. When the recognition model identifies the request and identifies the interception features, the request is predicted to be an illegal request.

[0052] Example 7

[0053] refer to Figure 3On the basis of the above embodiments, in this embodiment, a large amount of web page data is obtained through a web crawler, and the web page data is preprocessed, including data cleaning, data transformation and data classification, and is divided into web page data containing advertisements and web page data not containing advertisements, and feature selection is performed separately. The selected features may be links, text, image locations and source code tags, etc., and then the web page data containing advertisements and the web page data not containing advertisements are subjected to feature extraction and feature construction through regular expression matching to obtain a web page training set, and the recognition model is trained through the web page training set so that the model can identify whether the web page data contains advertisements. When the client sends a request to the application, the request data corresponding to the request is obtained through the web crawler, and the recognition model is used to analyze the request data. If advertising features are obtained, such as advertising tags, pop-up windows or image positions, the advertising features include several sub-features, each of which corresponds to a weight. For example, the advertising tag includes an ads tag and an iframe tag, and the weights of the ads tag and the iframe tag are 3 and 2 respectively. The weights of all sub-features are calculated to obtain the weight value, and it is determined whether the weight value is greater than or equal to the threshold. For example, if the weight value is 5, the threshold is set to 3, and 5 is greater than 3, it is determined that the request data contains advertisements, and then the advertisement data in the request data is obtained through the advertisement features. For example, the ads tag is matched through a regular expression, and the advertisement data corresponding to the ads tag is found and deleted to obtain filtered data, and the filtered data is returned to the client.

[0054] Example 8

[0055] refer to Figure 4 On the basis of the above embodiment, in this embodiment, when a request is identified as an illegal request, the request is recorded in the interception list, including the time of the request, the title of the request, and the corresponding URL, etc. If the user retains the request record, when the user needs to view the interception list, trust list, blacklist, and history record, etc., the user needs to enter the verification code, and can only view it when the verification code is consistent with the verification code set by the user; if the user does not retain the request record and sets it to incognito browsing, when the client obtains the result returned by the request, please delete the corresponding request record.

[0056] Example 9

[0057] refer to Figure 4 Based on the above embodiment, in this embodiment, when a request is identified as an illegal request, the corresponding request data is obtained through a network crawler, and then analyzed through a malicious code analysis method. If a characteristic string or characteristic code segment of malicious data is determined, such as <iframe src="http: / / www.xxx.com / muma.html" width="100height=100">< / iframe>, which is a network Trojan code, then the iframe can be extracted for analysis and identification, and the data corresponding to the characteristic string or characteristic code segment can be deleted. The malicious code analysis method can be an analysis method based on code features, an analysis method based on code semantics, or a static analysis tool, such as ollyDump (GigaPede2009), W32DASM (URSoftware2009), IDAPro (DataReseue2009), and HIEw (Suslikov2009).

[0058] Example 10

[0059] refer to Figure 4 On the basis of the above embodiments, in this embodiment, when a request is identified as an illegal request, the illegal request type is determined by the illegal request feature identified by the recognition model, and different emergency response mechanisms are responded to for different illegal request types. For example, if the illegal request feature is identified as an SQL statement, the illegal request is determined to be an SQL injection attack, and the WEB application firewall is immediately started; or if an illegal request is identified to enter the password multiple times, the illegal request feature is cracking, and the illegal request is determined to be a brute force cracking attack, and the user account is immediately locked.

[0060] Embodiment 11

[0061] On the basis of the above-mentioned embodiment, in this embodiment, other web page URLs are obtained by a web crawler, and the obtained URLs are randomly inserted into the user history records, or part of the user history records are directly replaced.

[0062] Example 12

[0063] On the basis of the above embodiments, the applicant found that although the current request is a legitimate request, the request data corresponding to the request contains other URLs or pictures, and some URLs and pictures contain viruses or Trojans. When users click to trigger these URLs and pictures, they may be attacked by the network. The method can only identify the current request, and cannot prevent requests corresponding to other URLs in the page in advance. In order to solve this problem, the applicant improved the method, which also includes obtaining the request data of the request; analyzing the request data to obtain the source code link; sending a simulated request to the application based on the source code link; the application receives the simulated request, and identifies the simulated features of the simulated request based on the recognition model; if the simulated features meet the illegal request features, the user is warned that the source code link is a dangerous link. The URL in the request data corresponding to the current request is simulated in advance to determine whether it is an illegal request. If so, the user is warned not to click on the URL to trigger viruses or Trojans, etc., to reduce network attacks and further protect network security.

[0064] The source code corresponding to the request is captured by a web crawler, and the URL address in the source code is obtained by regular expression matching, such as obtaining all URL addresses in the source code by matching keywords related to the URL address such as href, http or https, and constructing each URL address to obtain a simulated request, such as filling in the parameters of the simulated request through Python's requests module, including the request method, request URL address and request header, etc., specifically request(method, url,params, data, headers, cookies, files, auth, timeout, allow_redirects,proxies, hooks, stream, verify, cert, json), and sending a simulated request to the application. After the application receives the simulated request, the recognition model identifies the simulated request and predicts and identifies it according to its simulated feature parameters. If the simulated feature parameters meet the illegal request characteristics, the user is warned that the corresponding URL address is a dangerous link by highlighting or popping up a box.

[0065] Embodiment 13

[0066] On the basis of the above embodiments, the applicant found that programmers would also learn new technologies from the attackers' attack methods and apply the new technologies to the system or program. However, the request of the new technology cannot pass the recognition model due to its illegal features. In order to solve this problem, the applicant improved the method, which also includes: obtaining an update request containing illegal request features; analyzing the update request to obtain improved features; comparing the features with the improved features to obtain a comparison result, and judging whether the request is legal based on the comparison result. The features of the new technology containing illegal request features are analyzed and regarded as legal features. By comparing the legal features with the request features, the similarity between the two can be obtained, and then the request of the new technology can be judged whether it is legal. This method can be applied to the transformation of requests between legal and illegal.

[0067] Get an update request containing illegal request features, analyze the update request through a machine learning algorithm to obtain improved features, and then compare the features obtained through the recognition model with the improved features to obtain similarity. If the similarity is less than 80%, the request is judged to be an illegal request.

[0068] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0069] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for intercepting illegal WEB requests based on artificial intelligence, characterized in that: The method comprises: Obtain the request log file of the application, obtain the recognition model based on the request log file, and apply the recognition model to the application; if the application receives the request, identify the characteristics of the request based on the recognition model, and determine whether the request is legal based on the characteristics, and if so, pass the request to the server for response processing; otherwise, intercept the request; The method further comprises: If the request is an illegal request, and the user records the first URL corresponding to the request into a trust list, the request is updated to a legal request. The trust list is used for users to access the first URL in the case of mistaken interception. If the recognition model recognizes the request again and identifies the request as an illegal request, the URL corresponding to the request is matched with the URL in the trust list. If the match is successful, the request is identified as a legal request. At the same time, all the first URLs in the trust list are obtained, and features are extracted from all the first URLs to obtain trust features. If the recognition model recognizes the trust features, it is predicted that the request is a legal request. If the request is a legal request, and the user blacklists the URL corresponding to the request, the request is updated to an illegal request. If the recognition model recognizes the request again and identifies the request as a legal request, the URL corresponding to the request is matched with the URL in the blacklist. If the match is successful, the request is identified as an illegal request. At the same time, all second URLs in the blacklist are obtained, and features of all second URLs are extracted to obtain interception features. If the recognition model recognizes the interception features, it is predicted that the request is an illegal request. If the request is an illegal request, request data of the request is obtained, and keyword extraction is performed on the request data to obtain keywords. Recommendation data matching the keywords is obtained, and the recommendation data is used to recommend data required by the user when the request is intercepted. If the request is a legitimate request, obtaining web page data of the application, the web page data including web page data containing advertisements and web page data not containing advertisements; performing feature extraction on the web page data to obtain a web page training set, training the recognition model based on the web page training set, and the recognition model identifying whether the web page data contains advertisements; The specific steps of the recognition model identifying whether the web page data contains advertisements include: Obtain request data of the request; analyze the request data based on the recognition model to obtain advertising features, the advertising features include a number of sub-features, each of the sub-features corresponds to a weight; obtain a weight value of the advertising feature based on the weight accumulation of each of the sub-features; determine whether the weight value is greater than or equal to a threshold; if so, obtain the advertising data in the request data based on the advertising features; delete the advertising data to obtain filtered data; and update the request data to the filtered data.

2. According to the method for intercepting illegal WEB requests based on artificial intelligence in claim 1, it is characterized in that: The specific steps of obtaining the recognition model based on the request log file include: Preprocess the request log file to obtain a data set, which includes a number of legal request data and a number of illegal request data; perform feature extraction and feature construction on the data set to obtain a training set; select a number of first models based on preset parameters; train each of the first models based on the training set to cumulatively obtain a number of optimized models; test each of the optimized models based on the test set to cumulatively obtain a number of test results; compare each of the test results with preset indicators to obtain an optimal test result; and obtain the recognition model based on the optimization model corresponding to the optimal test result.

3. According to the method for intercepting illegal WEB requests based on artificial intelligence in claim 1, it is characterized in that: If the request is an illegal request, the method further includes: recording the request into an interception list.

4. According to the method for intercepting illegal WEB requests based on artificial intelligence in claim 1, it is characterized in that: If the request is an illegal request, the method further includes: Request data of the request is obtained, the request data is cleaned, a second request is obtained, the second request is changed into a legal request, and the request is updated into the second request.

5. According to the method of intercepting illegal WEB requests based on artificial intelligence in claim 1, it is characterized in that: If the request is an illegal request, the method further includes: The request is analyzed based on the identification model to obtain an illegal request type of the request, and based on the illegal request type, an emergency response mechanism corresponding to the illegal request type is initiated.

6. The method for intercepting illegal WEB requests based on artificial intelligence according to claim 1 is characterized in that: The method further includes: if the request ends, deleting the record of the request.

7. According to claim 1, a method for intercepting illegal WEB requests based on artificial intelligence is characterized in that: The method further includes: obtaining a verification code, determining whether the verification code is the same as a set verification code, and if so, obtaining a request record of the request.

8. The method for intercepting illegal WEB requests based on artificial intelligence according to claim 1 is characterized in that: The method further comprises: Setting a false request record; updating the request record of the request to the false request record.

Images