Aggression detection method, apparatus, electronic device, and computer program product

Abstract

The application discloses an attack detection method and device, electronic equipment and computer program product. The method comprises the following steps: receiving a resource acquisition request initiated by a terminal; using a keyword extraction module in a preset detection model to perform semantic extraction on a plurality of to-be-detected words in each to-be-detected field value in the resource acquisition request, and obtaining a plurality of to-be-detected keywords; using a pre-training semantic module in the preset detection model to perform semantic feature conversion on each to-be-detected keyword, and obtaining a keyword feature vector; using an attention mechanism module in the preset detection model to perform attention analysis on the plurality of keyword feature vectors in the resource acquisition request, and obtaining a resource request feature vector; and using a classifier in the preset detection model to classify the resource request feature vector, and obtaining an attack type of the resource acquisition request. The application solves the technical problem of low detection accuracy in the prior art for detecting web attacks on HTTP requests.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically, to an attack detection method, apparatus, electronic device, and computer program product. Background Technology

[0002] Web attacks refer to attacks that exploit vulnerabilities, weaknesses, or security flaws in websites, applications, or network services on the Internet in an illegal or malicious manner. These attacks aim to gain unauthorized access, steal sensitive information, destroy data, deny service, or carry out other malicious acts, potentially leading to serious security problems and losses.

[0003] With the widespread adoption of the internet and web applications, combating web attacks has become a significant challenge in the field of cybersecurity. First, as technology advances, the number and types of web attacks are constantly increasing, from traditional cross-site scripting (XSS) and SQL injection to newer attacks such as supply chain attacks and AI-driven attacks, making attack methods increasingly diverse and complex. Second, web attacks are no longer limited to websites of specific industries or sizes; various types of websites, applications, and online services can become targets, from personal blogs to enterprise-level applications. Finally, web attackers are often global and organized, utilizing various tools and resources to conduct long-term, organized cyberattacks, making it even more difficult to combat such behavior.

[0004] Web attack detection methods currently mainly include rule-based methods, behavior analysis-based methods, and machine learning-based methods. Rule-based methods use predefined rules or patterns to detect known web attack patterns, which may include specific attack signatures, malicious code patterns, etc.

[0005] However, current web attack detection methods all have some shortcomings. Rule-based web attack detection methods are limited by predefined rule sets, making them susceptible to new types of attacks and often resulting in high false positive rates and difficulty in dealing with complex attacks. Traditional machine learning models have relatively simple structures, a limited number of parameters, and require manually designed features, which necessitates the knowledge and experience of security experts and may also lead to information loss and incompleteness. Furthermore, existing deep learning-based methods treat HTTP requests simply as complete strings, failing to consider the structural information of HTTP requests and the semantic relationships between their fields. Therefore, current technologies for detecting web attacks using HTTP requests suffer from low detection accuracy.

[0006] The existing technologies for detecting web attacks on HTTP requests suffer from low accuracy, and no effective solution has yet been proposed. Summary of the Invention

[0007] This invention provides an attack detection method, apparatus, electronic device, and computer program product to at least solve the technical problem of low detection accuracy in existing technologies for detecting web attacks on HTTP requests.

[0008] According to one aspect of the present invention, an attack detection method is provided, comprising: receiving a resource acquisition request to be detected initiated by a terminal, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; using a keyword extraction module in a preset detection model to perform semantic extraction on multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value; using a pre-trained semantic module in the preset detection model to perform semantic feature transformation on each keyword to be detected to obtain a keyword feature vector for each keyword to be detected; using an attention mechanism module in the preset detection model to perform attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain a resource request feature vector for the resource acquisition request; and using a classifier in the preset detection model to classify the resource request feature vector to obtain an attack type of the resource acquisition request.

[0009] Optionally, after receiving a resource acquisition request to be detected initiated by the receiving terminal, the method further includes: obtaining a structured rule for the resource acquisition request, wherein the structured rule represents the structured distribution of the values ​​of the fields to be detected corresponding to multiple field names to be detected in the resource acquisition request; and extracting the value of the field to be detected corresponding to each field name to be detected from the resource acquisition request according to the structured rule.

[0010] Optionally, using the keyword extraction module in the preset detection model to semantically extract multiple words to be detected in each of the fields to be detected, and obtaining multiple keywords to be detected for each of the fields to be detected, includes: using the keyword extraction module to segment each of the fields to be detected, and obtaining multiple words to be detected corresponding to each field to be detected; filtering the multiple words to be detected corresponding to each field to be detected based on multiple preset words recorded in the preset vocabulary, and obtaining multiple target words corresponding to each field to be detected, wherein the target words are the same as the preset words; using the preset keyword extraction model to perform semantic analysis on each target word, and filtering multiple keywords to be detected corresponding to each field to be detected from the multiple target words corresponding to each field to be detected based on the semantic analysis results, wherein the keywords to be detected are the target words representing the semantic features of the field to be detected, and the preset keyword extraction model is trained by machine learning using multiple sets of first training data, each set of first training data including: a first sample field value containing multiple sample words, and sample keywords labeled in the multiple sample words.

[0011] Optionally, after performing semantic analysis on each target word using a preset keyword extraction model and filtering multiple keywords corresponding to each target word from the multiple target words corresponding to each target word based on the semantic analysis results, the method further includes: counting the number of keywords corresponding to each target word; detecting whether the number of keywords is higher than a preset number threshold; and selecting multiple keywords that are the same as the preset number threshold if the number of keywords is higher than the preset number threshold.

[0012] Optionally, performing semantic feature transformation on each keyword to be detected using the pre-trained semantic module in the preset detection model to obtain the keyword feature vector of each keyword to be detected includes: performing semantic feature transformation on each keyword to be detected using the pre-trained semantic model in the pre-trained semantic module to obtain the keyword feature vector of each keyword to be detected, wherein the pre-trained semantic model is: h i =GELU(0,att i W1+b1)W2+b2,h i For the keyword feature vector, we i =Embedding(k i Embedding is the word embedding layer of the pre-trained semantic model, k i The keyword to be detected is att i=MultiHead(we i MultiHead is the multi-head attention layer of the pre-trained semantic model, and GELU is an activation function based on the Gaussian error function. tanh is the hyperbolic tangent activation function. W1, W2, b1, and b2 are pre-trained using multiple sets of second training data through machine learning. Each set of second training data includes: sample keywords and corresponding sample feature vectors.

[0013] Optionally, using the attention mechanism module in the preset detection model to perform attention analysis on multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector includes: using a preset attention model in the attention mechanism module to perform attention analysis on multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector, wherein the preset attention model is: H attention For resource request feature vectors, Let tanh be the feature vector of multiple keywords in the resource acquisition request, and e be the hyperbolic tangent activation function. i These are the normalized attention weights corresponding to each keyword feature vector. and It is trained in advance using multiple sets of third training data through machine learning. Each set of third training data includes: sample feature vectors corresponding to multiple sample keywords in the resource acquisition request as samples, and corresponding sample request feature vectors.

[0014] Optionally, classifying the resource request feature vector using the classifier in the preset detection model to obtain the attack type of the resource acquisition request includes: classifying the resource request feature vector using a preset classification model in the classifier to obtain the attack type of the resource acquisition request, wherein the preset classification model is: For the attack type, This is the feature vector of the resource request. and It is trained in advance using multiple sets of fourth training data through machine learning. Each set of fourth training data includes: a sample request feature vector corresponding to a resource acquisition request as a sample, and a pre-labeled attack type label, which is used to represent the attack type.

[0015] Optionally, the method further includes: training the preset detection model using a preset imbalanced total loss function and multiple sets of fifth training data, wherein each set of fifth training data includes: multiple second sample field values ​​from a resource acquisition request as samples, and pre-labeled attack type labels, the attack type labels being used to represent the attack type of the resource acquisition request, and the preset imbalanced total loss function being: Total Loss = FL(p ik ,y ik )=-(1-p ik ) γ log(p ik Total Loss is the total loss value, FL(*) is the loss value corresponding to each resource acquisition request, and p ik This represents the predicted probability, y, that the preset detection model predicts the i-th resource acquisition request belongs to the k-th attack type. ik The attack type label indicates that the i-th resource acquisition request is the k-th attack type, N is the number of resource acquisition request samples in the multiple sets of the fifth training data, K is the number of attack types in the multiple sets of the fifth training data, and γ is a preset decay factor, which is a hyperparameter that controls the weight of difficult samples. The difficult samples represent resource acquisition requests that are difficult to classify correctly using the preset detection model.

[0016] Optionally, training the preset detection model using a preset imbalanced total loss function and multiple sets of fifth training data includes: after training the preset detection model using multiple sets of the fifth training data in each round, determining the total loss value using the preset imbalanced total loss function; propagating the total loss value to the preset detection model through a backpropagation algorithm to obtain the gradient value corresponding to the total loss value, wherein the gradient value represents the rate of change of the total loss value with respect to the model parameters in the preset detection model; and using an optimizer to adjust the model parameters based on the gradient value and a preset learning rate, wherein the preset learning rate is a pre-set hyperparameter used to control the update step size of the model parameters.

[0017] According to another aspect of the present invention, an attack detection device is also provided, comprising: a receiving module, configured to receive a resource acquisition request to be detected initiated by a terminal, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; an extraction module, configured to perform semantic extraction on multiple words to be detected in each of the multiple fields to be detected using a keyword extraction module in a preset detection model, to obtain multiple keywords to be detected for each field value; a conversion module, configured to perform semantic feature conversion on each keyword to be detected using a pre-trained semantic module in the preset detection model, to obtain a keyword feature vector for each keyword to be detected; an attention analysis module, configured to perform attention analysis on the multiple keyword feature vectors in the resource acquisition request using an attention mechanism module in the preset detection model, to obtain a resource request feature vector for the resource acquisition request; and a classification module, configured to classify the resource request feature vector using a classifier in the preset detection model, to obtain the attack type of the resource acquisition request.

[0018] According to another aspect of the present invention, a non-volatile storage medium is also provided, wherein a computer program is stored in the non-volatile storage medium, and the above-described attack detection method is executed by running the computer program in the device where the non-volatile storage medium is located.

[0019] According to another aspect of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described attack detection method through the computer program.

[0020] According to another aspect of the present invention, a computer program product is also provided, including computer instructions that, when executed by a processor, implement the steps of the above-described attack detection method.

[0021] In this embodiment of the invention, a receiving terminal initiates a resource acquisition request to be detected, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; the keyword extraction module in the preset detection model performs semantic extraction on multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value; the pre-trained semantic module in the preset detection model performs semantic feature transformation on each keyword to be detected to obtain a keyword feature vector for each keyword to be detected; the attention mechanism module in the preset detection model performs attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain a resource request feature vector; the classifier in the preset detection model classifies the resource request feature vector to obtain the attack type of the resource acquisition request. This allows for a better determination of the resource request feature vector representing the deep semantic features of the resource acquisition request, and thus, based on the resource request feature vector, more accurate attack detection of the resource acquisition request can be performed. This achieves the technical effect of improving the accuracy of attack detection of resource acquisition requests, thereby solving the technical problem of low detection accuracy in the existing technology for Web attack detection of HTTP requests. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0023] Figure 1 This is a flowchart of an attack detection method according to an embodiment of the present invention;

[0024] Figure 2 This is a schematic diagram of a BERT-based Web attack detection model KBBA according to an embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of a Web attack detection method based on the BERT model according to an embodiment of the present invention;

[0026] Figure 4 This is a schematic diagram of the attention weight heatmap between some keywords in one embodiment of the present invention;

[0027] Figure 5 This is a schematic diagram of the loss curves of a KBBA on the training and validation sets of a full traffic monitoring platform Web attack dataset according to an embodiment of the present invention;

[0028] Figure 6 This is a schematic diagram of an attack detection device according to an embodiment of the present invention;

[0029] Figure 7This is a structural block diagram of a computer terminal according to an embodiment of the present invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0033] BERT: Bidirectional Encoder Representation from Transformers, is a pre-trained language model designed to understand and learn the deeper meaning of language using the Transformer architecture.

[0034] Web attack: A web attack is an attack that targets a user's online behavior or website servers and other devices.

[0035] According to an embodiment of the present invention, an embodiment of an attack detection method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0036] Figure 1 This is a flowchart of an attack detection method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0037] Step S102: Receive a resource acquisition request to be detected initiated by the terminal, wherein the resource acquisition request carries multiple formatted field values ​​to be detected.

[0038] Step S104: Use the keyword extraction module in the preset detection model to perform semantic extraction on multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value.

[0039] Step S106: Use the pre-trained semantic module in the preset detection model to perform semantic feature transformation on each keyword to be detected, and obtain the keyword feature vector of each keyword to be detected.

[0040] Step S108: Use the attention mechanism module in the preset detection model to perform attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector of the resource acquisition request.

[0041] Step S110: Use the classifier in the preset detection model to classify the resource request feature vector to obtain the attack type of the resource acquisition request.

[0042] In this embodiment of the invention, a receiving terminal initiates a resource acquisition request to be detected, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; the keyword extraction module in the preset detection model performs semantic extraction on multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value; the pre-trained semantic module in the preset detection model performs semantic feature transformation on each keyword to be detected to obtain a keyword feature vector for each keyword to be detected; the attention mechanism module in the preset detection model performs attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain a resource request feature vector; the classifier in the preset detection model classifies the resource request feature vector to obtain the attack type of the resource acquisition request. This allows for a better determination of the resource request feature vector representing the deep semantic features of the resource acquisition request, and thus, based on the resource request feature vector, more accurate attack detection of the resource acquisition request can be performed. This achieves the technical effect of improving the accuracy of attack detection of resource acquisition requests, thereby solving the technical problem of low detection accuracy in the existing technology for Web attack detection of HTTP requests.

[0043] In step S102 above, the resource acquisition request can be an HTTP request, which refers to a request sent by a client terminal (such as a browser) to a server to obtain a specific resource (such as a webpage, image, video, etc.). An HTTP request typically includes a request method (GET, POST, etc.), request headers, and a request body. After receiving the request, the server processes it and returns a corresponding response. HTTP requests are data on the Internet.

[0044] In step S104 above, the keyword extraction module can use a preset keyword extraction model to perform semantic extraction, which can be the KeyBERT model.

[0045] Optionally, the KeyBERT model is a keyword extraction tool based on the BERT model. Its keyword extraction process is as follows:

[0046] Step S1041, text preprocessing, preprocessing the input text, including removing stop words, punctuation marks and other irrelevant information, and performing word segmentation on the text.

[0047] Step S1042, Embedding representation: The pre-trained BERT model is used to embed the pre-processed text to obtain the vector representation of each word.

[0048] Step S1043, text similarity calculation: By calculating the similarity between each word in the text and other words, the degree of association between words can be obtained.

[0049] Step S1044, keyword extraction: Based on the similarity calculation results between words, the most representative and important keywords in the text can be extracted using various methods (such as TextRank, KMeans, etc.).

[0050] Step S1045: Output keywords and return the extracted keywords as the extraction result.

[0051] In the above embodiments of the present invention, KeyBERT extracts keywords from text by utilizing the embedding representation of the BERT model and the text similarity calculation method, which can help users better understand the text content and topic.

[0052] Optionally, the BERT model, or Bidirectional Encoder Representations from Transformers, is a pre-trained natural language processing model that learns text representations through pre-training on large-scale unlabeled text data. The BERT model has achieved excellent performance on various natural language processing tasks and can be fine-tuned to adapt to different tasks. A key feature of the BERT model is its ability to understand contextual information bidirectionally, thereby better comprehending the meaning of language.

[0053] In step S106 above, the pre-trained semantic module can use the BERT model.

[0054] As an optional example, the BERT model mainly includes the following steps:

[0055] Step S1061, Pre-training Phase. The BERT model undergoes unsupervised pre-training on a large-scale text corpus. During the pre-training phase, BERT uses two tasks to learn lexical representations: Masked Language Model (MLM) and NextSentence Prediction (NSP). The MLM task requires the model to predict randomly masked words in order to infer the correct words from the context. The NSP task requires the model to determine whether two sentences are consecutive, thereby learning sentence-level representations.

[0056] Step S1062, Fine-tuning Phase. After pre-training, the BERT model can be adapted to different downstream tasks through supervised fine-tuning on specific tasks, such as text classification, named entity recognition, and question answering. During the fine-tuning phase, the BERT model can be used as a pre-trained feature extractor, or further trained on specific tasks to improve performance.

[0057] Step S1063, Inference Phase. After fine-tuning, the BERT model can be used to infer new text, such as text classification, text generation, and natural language understanding tasks. The BERT model learns text representations through a deep bidirectional Transformer structure, enabling it to better understand the semantics and context of language, thus performing excellently in various natural language processing tasks.

[0058] In the above embodiments of the present invention, the BERT model process includes a pre-training stage, a fine-tuning stage, and an inference stage. Through these steps, the BERT model can adapt to different natural language processing tasks and achieve excellent performance.

[0059] In step S110 above, the attack type is used to indicate at least that the resource acquisition request does not have a web attack, and in the case that the resource acquisition request has a web attack, there are multiple attack types, such as SQL injection, cross-site scripting (XSS), command execution, remote code execution, and directory traversal.

[0060] As an optional embodiment, after receiving the resource acquisition request to be detected initiated by the receiving terminal, the method further includes: obtaining the structured rules of the resource acquisition request, wherein the structured rules represent the structured distribution of the values ​​of the fields to be detected corresponding to the multiple field names to be detected in the resource acquisition request; and extracting the values ​​of the fields to be detected corresponding to each field name from the resource acquisition request according to the structured rules.

[0061] In the above embodiments of the present invention, the resource acquisition request includes multiple structured field values ​​to be detected. The structured distribution of the field values ​​to be detected in the resource acquisition request is such that each field value to be detected has a corresponding field name to be detected. The structured distribution of the field names to be detected is represented by structured rules. Therefore, when it is necessary to extract the field values ​​to be detected from the resource acquisition request, the field values ​​to be detected corresponding to each field name to be detected can be extracted according to the structured rules, thereby realizing the extraction of the field values ​​to be detected.

[0062] Optionally, the fields to be detected include: METHOD, USER-AGENT, URL, REFERER, and REQUEST BODY. METHOD represents the HTTP request operation method, such as GET, POST, PUT, DELETE, etc.; USER-AGENT represents the user agent that initiated the request, usually the identification information of the browser or other client; URL represents the resource address requested, i.e., the Uniform Resource Locator; REFERER represents the referrer address, i.e., the URL of the source page of the current request; and REQUEST BODY represents the HTTP request body, which is usually used to pass request parameters or data.

[0063] As an optional embodiment, the keyword extraction module in the preset detection model is used to semantically extract multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value. This includes: using the keyword extraction module to segment each field value to obtain multiple words to be detected corresponding to each field value; filtering the multiple words to be detected corresponding to each field value based on multiple preset words recorded in the preset vocabulary to obtain multiple target words corresponding to each field value, wherein the target words are the same as the preset words; performing semantic analysis on each target word using the preset keyword extraction model, and filtering multiple keywords to be detected corresponding to each field value from the multiple target words corresponding to each field value based on the semantic analysis results, wherein the keywords to be detected are target words representing the semantic features of the field value to be detected, and the preset keyword extraction model is trained by machine learning using multiple sets of first training data, each set of first training data including: a first sample field value containing multiple sample words, and sample keywords marked in the multiple sample words.

[0064] In the above embodiments of the present invention, when extracting keywords to be detected, multiple words to be detected in each field value can be segmented to obtain multiple words to be detected. Then, a preset word list is used to filter the words to be detected to find multiple keywords to be detected corresponding to each field value, thereby realizing the extraction of keywords to be detected from the field values.

[0065] Optionally, the preset vocabulary can be the BERT vocabulary, which contains 30,000 words and tokens used to train the BERT model. This vocabulary includes common words, punctuation marks, and special tokens, as well as other common tokens used for text processing and modeling. The BERT model uses this vocabulary to segment the text and convert it into an input format that the model can understand and process.

[0066] As an optional embodiment, after performing semantic analysis on each target word using a preset keyword extraction model and filtering multiple keywords corresponding to each target word from the multiple target words corresponding to each target word based on the semantic analysis results, the method further includes: counting the number of keywords corresponding to each target word; detecting whether the number of keywords is higher than a preset threshold; and selecting multiple keywords with the same number as the preset threshold if the number of keywords is higher than the preset threshold.

[0067] In the above embodiments of the present invention, when there are too many keywords to be detected, the preset detection model will reduce the efficiency of the keywords to be detected if it analyzes too many keywords. Therefore, after multiple keywords to be detected for each field value, the number of keywords to be detected can be detected, and when the number of keywords is too large, the keywords to be detected can be filtered to obtain multiple keywords to be detected that meet the preset number threshold.

[0068] As an optional embodiment, using the pre-trained semantic module in the preset detection model to perform semantic feature transformation on each keyword to be detected, and obtaining the keyword feature vector of each keyword to be detected, includes: using the pre-trained semantic model in the pre-trained semantic module to perform semantic feature transformation on each keyword to be detected, and obtaining the keyword feature vector of each keyword to be detected, wherein the pre-trained semantic model is: h i =GELU(0,att i W1+b1)W2+b2,h i For keyword feature vectors, we i =Embedding(k i Embedding is the word embedding layer of a pre-trained semantic model, k i The keyword to be detected is att. i =MultiHead(we i MultiHead is the multi-head attention layer of a pre-trained semantic model, and GELU is an activation function based on the Gaussian error function. tanh is the hyperbolic tangent activation function. W1, W2, b1, and b2 are pre-trained using multiple sets of second training data through machine learning. Each set of second training data includes: sample keywords and corresponding sample feature vectors.

[0069] In the above embodiments of the present invention, the pre-trained semantic module in the preset detection model can be used to perform semantic feature transformation on the keywords to be detected, so as to obtain the feature vector of each keyword, making the keyword feature vector most representative of the semantics of the field value to be detected.

[0070] As an optional embodiment, using the attention mechanism module in the preset detection model to perform attention analysis on multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector includes: using the preset attention model in the attention mechanism module to perform attention analysis on multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector, wherein the preset attention model is: H attention For resource request feature vectors, Let tanh be the feature vector of multiple keywords in the resource retrieval request, and e be the hyperbolic tangent activation function. i These are the normalized attention weights corresponding to the feature vectors of each keyword. and It is trained in advance using multiple sets of third training data through machine learning. Each set of third training data includes: sample feature vectors corresponding to multiple sample keywords in the resource acquisition request as samples, and corresponding sample request feature vectors.

[0071] In the above embodiments of the present invention, the attention mechanism module in the preset detection model can use the preset attention model to assign weights to each keyword feature vector in the resource acquisition request, and use a weighted method to obtain a resource request feature vector determined based on multiple keyword feature vectors. Furthermore, it can obtain the resource request feature vector that best represents the semantic features of the resource acquisition request, and thus obtain a more accurate detection result based on the resource request feature vector.

[0072] As an optional embodiment, classifying the resource request feature vector using a classifier in a preset detection model to obtain the attack type of the resource acquisition request includes: classifying the resource request feature vector using a preset classification model in the classifier to obtain the attack type of the resource acquisition request, wherein the preset classification model is: As an attack type, For resource request feature vectors, and It is trained in advance using multiple sets of fourth training data through machine learning. Each set of fourth training data includes: a sample request feature vector corresponding to the resource acquisition request as a sample, and a pre-labeled attack type label, which is used to represent the attack type.

[0073] In the above embodiments of the present invention, the classifier in the preset detection model can classify the resource request feature vector using the preset classification model, accurately determine the attack type of the resource acquisition request, and realize accurate detection of the resource acquisition request.

[0074] As an optional embodiment, the method further includes: training a preset detection model using a preset imbalanced total loss function and multiple sets of fifth training data, wherein each set of fifth training data includes: multiple second sample field values ​​from resource acquisition requests as samples, and pre-labeled attack type labels, the attack type labels being used to indicate the attack type of the resource acquisition request, and the preset imbalanced total loss function being:

[0075] FL(p ik ,y ik )=-(1-pik ) γ log(p ik TotalLoss is

[0076] Total loss value, FL(*) is the loss value corresponding to each resource acquisition request, p ik y represents the predicted probability that the i-th resource acquisition request belongs to the k-th attack type, as predicted by the preset detection model. ik The attack type label represents the i-th resource acquisition request as the k-th attack type. N is the number of resource acquisition request samples in the multiple sets of fifth training data. K is the number of attack types in the multiple sets of fifth training data. γ is a pre-set decay factor, which is a hyperparameter that controls the weight of difficult samples. Difficult samples represent resource acquisition requests that are difficult to classify correctly using the pre-set detection model.

[0077] In the above embodiments of the present invention, since the number of samples of various Web attacks in the real world and in the dataset is different, there will be a class imbalance problem. Such an imbalanced distribution will cause the model to tend to learn the features of the main class and ignore the features of the secondary class, thereby affecting the generalization ability of the model. This application introduces an additional decay factor in the loss function to alleviate the class imbalance problem.

[0078] As an optional embodiment, training a preset detection model using a preset imbalanced total loss function and multiple sets of fifth training data includes: after training the preset detection model using multiple sets of fifth training data in each round, determining the total loss value using the preset imbalanced total loss function; propagating the total loss value to the preset detection model through a backpropagation algorithm to obtain the gradient value corresponding to the total loss value, where the gradient value represents the rate of change of the total loss value with respect to the model parameters in the preset detection model; and using an optimizer to adjust the model parameters based on the gradient value and a preset learning rate, where the preset learning rate is a pre-set hyperparameter used to control the update step size of the model parameters.

[0079] In the above embodiments of the present invention, when training a preset detection model using multiple sets of fifth training data, the preset detection model can be iteratively trained using multiple sets of fifth training data. After each iteration, the attack type detected by the preset detection model and the actual attack type of the resource acquisition request in the fifth training data are calculated. The total loss value of the preset detection model in this round of training is obtained by using a preset imbalanced total loss function. The total loss value is then propagated to all nodes of the model through a backpropagation algorithm, and the model parameter values ​​are updated using the Adam optimizer. This achieves the adjustment of the model parameters of the preset detection model and completes the training of the preset detection model.

[0080] Optionally, a larger gradient value indicates a greater magnitude of adjustment to the model parameters when adjusting the model parameters of the preset detection model based on the total loss value.

[0081] Optionally, the preset learning rate is set to 3e-05.

[0082] As an optional example, the process of training a pre-defined detection model includes:

[0083] Step S1: Calculate the total loss value using a preset imbalanced total loss function. Based on the model's prediction results and the true labels, calculate the total loss value using a preset loss function, representing the model's prediction error.

[0084] Step S2, Backpropagation Algorithm. The total loss value is propagated to each node (neuron) of the model through the backpropagation algorithm, and the gradient value of the loss value with respect to the model parameters is calculated.

[0085] Step S3: Use an optimizer to adjust the model parameters. Based on the gradient values ​​and the preset learning rate, use an optimizer (such as Adam) to adjust the model parameters, update the model's weights and biases, and minimize the total loss.

[0086] Step S4, iterative training. Repeat the above steps to iteratively train the model until it converges or reaches a certain number of training iterations.

[0087] The embodiments described above in this application, through continuous optimization of model parameters, enable the model to gradually learn patterns and regularities in the data, thereby improving the model's performance and generalization ability. By reasonably setting hyperparameters such as the loss function, learning rate, and optimizer, the model can be effectively trained and good results can be achieved.

[0088] Figure 2 This is a schematic diagram of a BERT-based Web attack detection model KBBA according to an embodiment of the present invention, as shown below. Figure 2 As shown, this application provides a Web attack detection method based on the BERT model, using the BERT-based Web attack detection model KBBA. This model combines the keyword extraction model KeyBERT, the pre-trained semantic model BERT, and an attention mechanism module. BERT is a language model that has undergone large-scale unsupervised pre-training and possesses powerful syntactic analysis and semantic representation capabilities. KeyBERT is a BERT-based model used for keyword extraction and text summarization generation, boasting strong keyword extraction capabilities. The attention mechanism allows the model to dynamically focus on different parts of the input when processing it. KBBA can identify keywords in HTTP requests, thereby accurately identifying the characteristics of Web attack behaviors. Simultaneously, the attention mechanism further captures the dependencies between keywords and provides a degree of interpretability.

[0089] Figure 3 This is a schematic diagram of a web attack detection method based on the BERT model according to an embodiment of the present invention, as shown below. Figure 3 As shown, this method uses the BERT-based Web attack detection model KBBA, which can not only identify specific categories of Web attacks, but also, given an HTTP request, extract keywords and attention using KeyBERT. The detection process for whether an HTTP request is malicious includes the following steps:

[0090] Step S301: For an HTTP request, extract the field values ​​corresponding to the field names such as METHOD, USER-AGENT, URL, REFERER, and REQUEST BODY according to the structured characteristics of the HTTP request, and use KeyBERT to extract the keywords for each field value.

[0091] Alternatively, suppose that the word sequence X obtained after tokenizing the fields in an HTTP request is... i ={x i,1 ,x i,2 ,…,x i,n}, where i∈[0,4] represents the above 5 types of fields, n is the length of the word sequence, and x i,j The vocabulary V comes from BERT. The word sequence X... i As input to KeyBERT, the resulting keyword sequence is: Where, k i,j These are keywords extracted by KeyBERT. Keyword extraction captures key information for each request, which is helpful for subsequent classification tasks.

[0092] Step S302: Input the keyword sequence K of the HTTP request obtained in step S301 into the BERT model to obtain the feature vector H = {h1, h2, ..., h} for each keyword. n The specific calculation formula is as follows: we i =Embedding(k i ), att i =MultiHead(we i ), h i =GELU(0,att i W1+b1)W2+b2, where Embedding is the word embedding layer of the BERT model and MultiHead is the multi-head attention layer of the BERT model. d = 768, where d represents the hidden layer dimension of the BERT model in this application. Both W and b are learnable parameters. GELU is an activation function based on the Gaussian error function, and its calculation formula is as follows:

[0093] It should be noted that the feature vector of a keyword is a high-level abstraction of the keywords in an HTTP request, and has the ability to represent the key semantic representation of the HTTP request.

[0094] Step S303: After obtaining the keyword feature H in step S302, it is input into the attention mechanism module for attention calculation to obtain the HTTP request feature. The calculation formula of the attention mechanism module is as follows: in, d = 768, and All are learnable parameters, tanh is the hyperbolic tangent activation function, and e i These are the normalized attention weights. H attention It is the HTTP request feature vector calculated by the attention module.

[0095] It should be noted that the attention mechanism module can distinguish the importance of different keywords. By dynamically allocating attention, the model can better handle the dependencies between keywords.

[0096] Step S304: In step S303, the abstracted HTTP request feature vector H is obtained. attention We then continue using a classifier to categorize web attacks. The classifier calculation formula is as follows: in, d = 768, and All of these are learnable parameters.

[0097] It should be noted that the types of web attacks involved in this application include SQL injection, cross-site scripting (XSS), command execution, remote code execution, and directory traversal.

[0098] Step S305: For the predicted labels output by the model in step S304, calculate the loss of the samples in the Web attack detection set using Focal Loss.

[0099] It's important to note that due to the varying sample sizes of different web attacks in the real world and in datasets, class imbalance can occur. This imbalance causes models to tend to learn features of the primary class while neglecting features of the secondary class, thus affecting the model's generalization ability. Focal Loss mitigates this class imbalance problem by introducing an additional decay factor and focuses on handling difficult-to-classify samples.

[0100] Assuming there are K categories, the formula for calculating Focal Loss is as follows: FL(p ik ,y ik )=-(1-p ik ) γ log(p ik ), Where, p ik y represents the model's predicted probability that the i-th sample belongs to the k-th class. ik Let represent the true label of the i-th sample to the k-th class, γ be the decay factor, which is an adjustable hyperparameter used to control the weight of hard samples. In this application, γ is 0.5, and N is the number of samples.

[0101] Step S306 follows the calculation of the loss of samples in the Web attack dataset obtained in step S305. The loss value is then propagated to all nodes of the model using the backpropagation algorithm, and the model parameter values ​​are updated using the Adam optimizer. In this application, the learning rate of Adam is set to 3e-05.

[0102] Step S307: Steps S301-S306 above describe the training process for a specific Web attack dataset. This training process is repeated until the model's loss value converges. A similar strategy is used to detect unknown HTTP requests. The model generates a final prediction result, which is then used to determine whether the HTTP request is a Web attack and classify it accordingly. In practice, a continuous learning strategy can be used to add the sample to the training dataset for further training.

[0103] As an optional example, a real-world web attack case involving a full-traffic monitoring platform is used to clearly and completely describe the technical solutions in the embodiments of this application.

[0104] Table 1 is a schematic table illustrating the field values ​​of a real Web attack case in a full-traffic monitoring platform according to an embodiment of the present invention. As shown in Table 1, it represents the field values ​​of the HTTP request in the Web attack case. This Web attack case is a cross-site scripting (XSS) attack, which specifically includes the following steps:

[0105]

[0106] Table 1

[0107] Step S401: For an HTTP request, extract the field values ​​corresponding to the field names such as METHOD, USER-AGENT, URL, REFERER, and REQUEST BODY according to the structured characteristics of the HTTP request, and use KeyBERT to extract the keywords in each field value.

[0108] Table 2 is a schematic table of keywords for each field in a real Web attack case of a full traffic monitoring platform according to an embodiment of the present invention. As shown in Table 2, the keywords in Table 1 are extracted by KeyBERT.

[0109]

[0110]

[0111] Table 2

[0112] Step S402: Input the keyword sequence K of the HTTP request obtained in step S401 into the BERT model to obtain the feature vector of each keyword.

[0113] Step S403: After obtaining the keyword features in step S402, input them into the attention mechanism module to perform attention calculation and obtain the HTTP request features.

[0114] Figure 4 This is a schematic diagram of the attention weight heatmap between some keywords in one embodiment of the present invention, such as... Figure 4 The image shows the attention weight heatmap obtained through the attention mechanism module. Only a portion of the attention weights between keywords are shown here.

[0115] Step S404: In step S403, the abstracted HTTP request feature H is obtained. attention Continue using a classifier to categorize web attacks.

[0116] Table 3 is a schematic table of the probability distribution of a Web attack case classifier according to an embodiment of the present invention. As shown in Table 3, the probability distribution can be obtained by classifying Web attacks using a classifier. It can be seen from the table that cross-site scripting attacks have the highest probability, so the Web attack is classified as a cross-site scripting attack.

[0117]

[0118] Table 3

[0119] Step S405: After calculating the loss using Focal Loss, the loss value is propagated to all nodes of the model through the backpropagation algorithm, and the model parameter values ​​are updated using the Adam optimizer. The above training process is repeated until the model's loss value converges.

[0120] Figure 5 This is a schematic diagram of the loss curves of a KBBA according to an embodiment of the present invention on the training and validation sets of a web attack dataset of a full traffic monitoring platform, as shown below. Figure 5 As shown, this represents the loss curves of KBBA on the training and validation sets of the full traffic monitoring platform's Web attack dataset.

[0121] The Web Attack Detection and Recognition Model KBBA, as described in the embodiments of this application, is based on keyword extraction technology, the BERT model, and an attention mechanism. It uses Focal Loss to alleviate the sample imbalance problem. This algorithm can better detect and analyze the deep semantic features of Web HTTP requests, and the attention mechanism increases the model's interpretability. When a Web attack occurs, by analyzing a specific HTTP request, the features of each field value in the request are quickly extracted, and the KBBA algorithm is used to classify these features, achieving a rapid and efficient emergency response.

[0122] To verify the performance of the Web attack detection and identification model KBBA proposed in this application, the model was tested and compared with publicly available Web attack detection methods on the HTTP DATASETCSIC 2010 dataset and the full traffic monitoring platform Web attack dataset.

[0123] Table 4 is a schematic table illustrating the results of various models according to an embodiment of the present invention on the Web attack dataset of the full traffic monitoring platform. As shown in Table 4, the performance of the KBBA model in Web attack detection is detected based on the Web attack dataset of the full traffic monitoring platform under the evaluation system based on Accuracy, Macro-F1, Macro-Precision and Macro-Recall.

[0124]

[0125] Table 4

[0126] Table 5 is a schematic table of the results of various models according to an embodiment of the present invention on the HTTP DATASET CSIC 2010 dataset. As shown in Table 5, the performance of the KBBA model in Web attack detection is detected based on the HTTP DATASET CSIC 2010 dataset under the evaluation system based on Accuracy, Macro-F1, Macro-Precision and Macro-Recall.

[0127]

[0128]

[0129] Table 5

[0130] Based on Tables 4 and 5 above, and based on the analysis of actual results, KBBA shows a significant improvement compared to other models. On the Web attack dataset of the full traffic monitoring platform, KBBA improves by 7.60%, 7.00%, 7.46%, and 6.53% respectively compared to the best-performing Bi-LSTM network combined with attention (BiLSTM+Attention).

[0131] Table 6 is a schematic table illustrating the results of an ablation experiment of KBBA according to an embodiment of the present invention on a web attack dataset of a full traffic monitoring platform. As shown in Table 6, this application also conducted further ablation experiments to verify the role and importance of each module of KBBA. This application conducted three ablation experiments, removing the keyword extraction module and the attention mechanism module respectively, and removing both the keyword extraction module and the attention mechanism module simultaneously. The results show that the index decreased after deleting any one module, and the index decreased the most after deleting both simultaneously, indicating that the keyword extraction module and the attention mechanism module have a positive effect.

[0132]

[0133] Table 6

[0134] According to an embodiment of the present invention, an embodiment of an attack detection device is also provided. It should be noted that the attack detection device can be used to execute the attack detection method in the embodiment of the present invention, and the attack detection method in the embodiment of the present invention can be executed in the attack detection device.

[0135] Figure 6 This is a schematic diagram of an attack detection device according to an embodiment of the present invention, such as... Figure 6As shown, the device may include: a receiving module 602, used to receive a resource acquisition request to be detected initiated by a terminal, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; an extraction module 604, used to perform semantic extraction on multiple words to be detected in each field value using a keyword extraction module in a preset detection model, to obtain multiple keywords to be detected for each field value; a conversion module 606, used to perform semantic feature conversion on each keyword to be detected using a pre-trained semantic module in the preset detection model, to obtain a keyword feature vector for each keyword to be detected; an attention analysis module 608, used to perform attention analysis on the multiple keyword feature vectors in the resource acquisition request using an attention mechanism module in the preset detection model, to obtain a resource request feature vector; and a classification module 610, used to classify the resource request feature vector using a classifier in the preset detection model, to obtain the attack type of the resource acquisition request.

[0136] It should be noted that the receiving module 602 in this embodiment can be used to execute step S102 in this embodiment, the extraction module 604 in this embodiment can be used to execute step S104 in this embodiment, the conversion module 606 in this embodiment can be used to execute step S106 in this embodiment, the attention analysis module 608 in this embodiment can be used to execute step S108 in this embodiment, and the classification module 610 in this embodiment can be used to execute step S110 in this embodiment. The examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments.

[0137] In this embodiment of the invention, a receiving terminal initiates a resource acquisition request to be detected, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; the keyword extraction module in the preset detection model performs semantic extraction on multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value; the pre-trained semantic module in the preset detection model performs semantic feature transformation on each keyword to be detected to obtain a keyword feature vector for each keyword to be detected; the attention mechanism module in the preset detection model performs attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain a resource request feature vector; the classifier in the preset detection model classifies the resource request feature vector to obtain the attack type of the resource acquisition request. This allows for a better determination of the resource request feature vector representing the deep semantic features of the resource acquisition request, and thus, based on the resource request feature vector, more accurate attack detection of the resource acquisition request can be performed. This achieves the technical effect of improving the accuracy of attack detection of resource acquisition requests, thereby solving the technical problem of low detection accuracy in the existing technology for Web attack detection of HTTP requests.

[0138] As an optional embodiment, the apparatus further includes: an acquisition submodule, configured to acquire structured rules of the resource acquisition request after receiving a resource acquisition request to be detected initiated by the terminal, wherein the structured rules represent the structured distribution of the values ​​of the fields to be detected corresponding to multiple field names to be detected in the resource acquisition request; and an extraction submodule, configured to extract the values ​​of the fields to be detected corresponding to each field name to be detected from the resource acquisition request according to the structured rules.

[0139] As an optional embodiment, the extraction module includes: a word segmentation unit, used to segment each field value to be detected using a keyword extraction module to obtain multiple words to be detected corresponding to each field value; a filtering unit, used to filter the multiple words to be detected corresponding to each field value according to multiple preset words recorded in a preset word list to obtain multiple target words corresponding to each field value, wherein the target words are the same as the preset words; and a semantic analysis unit, used to perform semantic analysis on each target word using a preset keyword extraction model, and to filter multiple keywords to be detected corresponding to each field value from the multiple target words corresponding to each field value based on the semantic analysis results, wherein the keywords to be detected are target words representing the semantic features of the field value to be detected, and the preset keyword extraction model is trained by machine learning using multiple sets of first training data, each set of first training data including: a first sample field value containing multiple sample words, and sample keywords marked in the multiple sample words.

[0140] As an optional embodiment, the device further includes: a statistics unit, configured to perform semantic analysis on each target word using a preset keyword extraction model, and after filtering multiple keywords corresponding to each target word from the multiple target words corresponding to each target word value based on the semantic analysis results, count the number of keywords corresponding to each target word value; a detection unit, configured to detect whether the number of keywords is higher than a preset number threshold; and a selection unit, configured to select multiple keywords equal to the preset number threshold if the number of keywords is higher than the preset number threshold.

[0141] As an optional embodiment, the conversion module includes: a semantic conversion unit, used to perform semantic feature conversion on each keyword to be detected using a pre-trained semantic model in the pre-trained semantic module, to obtain a keyword feature vector for each keyword to be detected, wherein the pre-trained semantic model is: h i =GELU(0,att i W1+b1)W2+b2,h i For keyword feature vectors, we i =Embedding(k i Embedding is the word embedding layer of a pre-trained semantic model, k i The keyword to be detected is att. i =MultiHead(we i MultiHead is the multi-head attention layer of a pre-trained semantic model, and GELU is an activation function based on the Gaussian error function. tanh is the hyperbolic tangent activation function. W1, W2, b1, and b2 are pre-trained using multiple sets of second training data through machine learning. Each set of second training data includes: sample keywords and corresponding sample feature vectors.

[0142] As an optional embodiment, the attention analysis module includes: an attention analysis unit, used to perform attention analysis on multiple keyword feature vectors in the resource acquisition request using a preset attention model in the attention mechanism module, to obtain a resource request feature vector of the resource acquisition request, wherein the preset attention model is: H attention For resource request feature vectors, Let tanh be the feature vector of multiple keywords in the resource retrieval request, and e be the hyperbolic tangent activation function. i These are the normalized attention weights corresponding to the feature vectors of each keyword. and It is trained in advance using multiple sets of third training data through machine learning. Each set of third training data includes: sample feature vectors corresponding to multiple sample keywords in the resource acquisition request as samples, and corresponding sample request feature vectors.

[0143] As an optional embodiment, the classification module includes: a classification unit, used to classify the resource request feature vector using a preset classification model in the classifier to obtain the attack type of the resource acquisition request, wherein the preset classification model is: As the attack type, H attentionj For resource request feature vectors, and It is trained in advance using multiple sets of fourth training data through machine learning. Each set of fourth training data includes: a sample request feature vector corresponding to the resource acquisition request as a sample, and a pre-labeled attack type label, which is used to represent the attack type.

[0144] As an optional embodiment, the apparatus further includes: a training submodule, used to train a preset detection model using a preset imbalanced total loss function and multiple sets of fifth training data, wherein each set of fifth training data includes: multiple second sample field values ​​from resource acquisition requests as samples, and pre-labeled attack type labels, the attack type labels being used to indicate the attack type of the resource acquisition request, and the preset imbalanced total loss function being: FL(p ik ,y ik )=-(1-p ik ) γ log(p ik Total Loss is the total loss value, FL(*) is the loss value corresponding to each resource acquisition request, and p ik y represents the predicted probability that the i-th resource acquisition request belongs to the k-th attack type, as predicted by the preset detection model. ik The attack type label represents the i-th resource acquisition request as the k-th attack type. N is the number of resource acquisition request samples in the multiple sets of fifth training data. K is the number of attack types in the multiple sets of fifth training data. γ is a pre-set decay factor, which is a hyperparameter that controls the weight of difficult samples. Difficult samples represent resource acquisition requests that are difficult to classify correctly using the pre-set detection model.

[0145] As an optional embodiment, the training submodule includes: a first determination subunit, used to determine the total loss value using a preset imbalanced total loss function after training the preset detection model with multiple sets of fifth training data in each round; a second determination subunit, used to propagate the total loss value to the preset detection model through a backpropagation algorithm to determine the gradient value corresponding to the total loss value, wherein the gradient value represents the rate of change of the total loss value with respect to the model parameters in the preset detection model; and an adjustment subunit, used to adjust the model parameters using an optimizer based on the gradient value and a preset learning rate, wherein the preset learning rate is a pre-set hyperparameter used to control the update step size of the model parameters.

[0146] Embodiments of the present invention may provide an electronic device, which is a computer terminal, and the computer terminal may be any one of a group of computer terminal devices. Optionally, in this embodiment, the computer terminal may also be replaced by a mobile terminal or other terminal device.

[0147] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0148] In this embodiment, the computer terminal described above can execute the program code for the following steps in the attack detection method: receiving a resource acquisition request to be detected initiated by the terminal, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; using the keyword extraction module in the preset detection model to perform semantic extraction on multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value; using the pre-trained semantic module in the preset detection model to perform semantic feature transformation on each keyword to be detected to obtain a keyword feature vector for each keyword to be detected; using the attention mechanism module in the preset detection model to perform attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain a resource request feature vector for the resource acquisition request; and using the classifier in the preset detection model to classify the resource request feature vector to obtain the attack type of the resource acquisition request.

[0149] Figure 7 This is a structural block diagram of a computer terminal according to an embodiment of the present invention, such as... Figure 7 As shown, the computer terminal 70 may include one or more (only one is shown in the figure) processors 72 and memory 74.

[0150] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the attack detection method and apparatus in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned attack detection method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal 70 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0151] The processor can invoke information and applications stored in memory via a transmission device to perform the following steps: receiving a resource acquisition request to be detected initiated by a terminal, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; using the keyword extraction module in the preset detection model to perform semantic extraction on multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value; using the pre-trained semantic module in the preset detection model to perform semantic feature transformation on each keyword to be detected to obtain a keyword feature vector for each keyword to be detected; using the attention mechanism module in the preset detection model to perform attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain a resource request feature vector; and using the classifier in the preset detection model to classify the resource request feature vector to obtain the attack type of the resource acquisition request.

[0152] Optionally, the processor may also execute program code that performs the following steps: obtaining the structured rules of the resource acquisition request, wherein the structured rules represent the structured distribution of the values ​​of the fields to be detected corresponding to multiple field names to be detected in the resource acquisition request; and extracting the values ​​of the fields to be detected corresponding to each field name from the resource acquisition request according to the structured rules.

[0153] Optionally, the processor may also execute program code for the following steps: using a keyword extraction module to segment each field value to be detected, obtaining multiple words to be detected corresponding to each field value; filtering the multiple words to be detected corresponding to each field value based on multiple preset words recorded in a preset vocabulary, obtaining multiple target words corresponding to each field value, wherein the target words are the same as the preset words; performing semantic analysis on each target word using a preset keyword extraction model, and filtering multiple keywords to be detected corresponding to each field value from the multiple target words corresponding to each field value based on the semantic analysis results, wherein the keywords to be detected are target words representing the semantic features of the field value to be detected, and the preset keyword extraction model is trained by machine learning using multiple sets of first training data, each set of first training data including: a first sample field value containing multiple sample words, and sample keywords labeled in the multiple sample words.

[0154] Optionally, the processor may also execute program code that performs the following steps: counts the number of keywords corresponding to each field value to be detected; detects whether the number of keywords is higher than a preset threshold; and selects multiple keywords to be detected that are the same as the preset threshold if the number of keywords is higher than the preset threshold.

[0155] Optionally, the processor may also execute program code that performs semantic feature transformation on each keyword to be detected using the pre-trained semantic model in the pre-trained semantic module, to obtain a keyword feature vector for each keyword to be detected, wherein the pre-trained semantic model is: h i =GELU(0,att i W1+b1)W2+b2,h i For keyword feature vectors, we i =Embedding(k i Embedding is the word embedding layer of a pre-trained semantic model, k i The keyword to be detected is att. i =MultiHead(we i MultiHead is the multi-head attention layer of a pre-trained semantic model, and GELU is an activation function based on the Gaussian error function. tanh is the hyperbolic tangent activation function. W1, W2, b1, and b2 are pre-trained using multiple sets of second training data through machine learning. Each set of second training data includes: sample keywords and corresponding sample feature vectors.

[0156] Optionally, the processor may also execute program code that performs the following steps: It uses a preset attention model in the attention mechanism module to perform attention analysis on multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector, wherein the preset attention model is: H attention For resource request feature vectors, Let tanh be the feature vector of multiple keywords in the resource retrieval request, and e be the hyperbolic tangent activation function. i These are the normalized attention weights corresponding to the feature vectors of each keyword. and It is trained in advance using multiple sets of third training data through machine learning. Each set of third training data includes: sample feature vectors corresponding to multiple sample keywords in the resource acquisition request as samples, and corresponding sample request feature vectors.

[0157] Optionally, the processor may also execute program code that performs the following steps: classifies the resource request feature vector using a preset classification model in the classifier to obtain the attack type of the resource acquisition request, wherein the preset classification model is: As an attack type, For resource request feature vectors, and It is trained in advance using multiple sets of fourth training data through machine learning. Each set of fourth training data includes: a sample request feature vector corresponding to the resource acquisition request as a sample, and a pre-labeled attack type label, which is used to represent the attack type.

[0158] Optionally, the processor may also execute program code for the following steps: training a preset detection model using a preset imbalanced total loss function and multiple sets of fifth training data, wherein each set of fifth training data includes: multiple second sample field values ​​from resource acquisition requests as samples, and pre-labeled attack type labels, the attack type labels being used to indicate the attack type of the resource acquisition request, and the preset imbalanced total loss function being: FL(p ik ,y ik )=-(1-p ik ) γ log(p ik Total Loss is the total loss value, FL(*) is the loss value corresponding to each resource acquisition request, and p ik y represents the predicted probability that the i-th resource acquisition request belongs to the k-th attack type, as predicted by the preset detection model. ikThe attack type label represents the i-th resource acquisition request as the k-th attack type. N is the number of resource acquisition request samples in the multiple sets of fifth training data. K is the number of attack types in the multiple sets of fifth training data. γ is a pre-set decay factor, which is a hyperparameter that controls the weight of difficult samples. Difficult samples represent resource acquisition requests that are difficult to classify correctly using the pre-set detection model.

[0159] Optionally, the processor may also execute program code with the following steps: after training the preset detection model using multiple sets of fifth training data in each round, the total loss value is determined using a preset imbalanced total loss function; the total loss value is propagated to the preset detection model through a backpropagation algorithm to obtain the gradient value corresponding to the total loss value, where the gradient value represents the rate of change of the total loss value with respect to the model parameters in the preset detection model; the optimizer adjusts the model parameters based on the gradient value and the preset learning rate, where the preset learning rate is a pre-set hyperparameter used to control the update step size of the model parameters.

[0160] This invention provides an attack detection scheme. In this embodiment, a resource acquisition request initiated by a receiving terminal is received. The resource acquisition request carries multiple formatted field values ​​to be detected. A keyword extraction module in a preset detection model is used to semantically extract multiple words from each field value to obtain multiple keywords for each field value. A pre-trained semantic module in the preset detection model is used to perform semantic feature transformation on each keyword to obtain a keyword feature vector. An attention mechanism module in the preset detection model is used to perform attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain a resource request feature vector. A classifier in the preset detection model is used to classify the resource request feature vector to obtain the attack type of the resource acquisition request. This method can better determine the resource request feature vector representing the deep semantic features of the resource acquisition request, and thus, based on the resource request feature vector, it can more accurately detect attacks on resource acquisition requests. This achieves the technical effect of improving the accuracy of attack detection for resource acquisition requests, thereby solving the technical problem of low detection accuracy in existing technologies for Web attack detection of HTTP requests.

[0161] Those skilled in the art will understand that Figure 7 The structure shown is for illustrative purposes only. The computer terminal can also be a smartphone (such as an Android phone, an iOS phone, etc.), a tablet computer, a mobile internet device (MID), a PAD, and other terminal devices. Figure 7This does not limit the structure of the aforementioned electronic device. For example, the computer terminal 70 may also include components that are more... Figure 7 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 7 The different configurations shown.

[0162] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a computer program instructing the hardware related to the terminal device. The computer program can be stored in a non-volatile medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc.

[0163] Embodiments of the present invention also provide a non-volatile storage medium. Optionally, in this embodiment, the aforementioned non-volatile storage medium can be used to store the program code executed by the attack detection method provided in the above embodiments.

[0164] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0165] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: receiving a resource acquisition request to be detected initiated by a terminal, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; using the keyword extraction module in the preset detection model to perform semantic extraction on multiple words to be detected in each field value to obtain multiple keywords to be detected for each field value; using the pre-trained semantic module in the preset detection model to perform semantic feature transformation on each keyword to be detected to obtain a keyword feature vector for each keyword to be detected; using the attention mechanism module in the preset detection model to perform attention analysis on the multiple keyword feature vectors in the resource acquisition request to obtain a resource request feature vector for the resource acquisition request; and using the classifier in the preset detection model to classify the resource request feature vector to obtain the attack type of the resource acquisition request.

[0166] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: obtaining the structured rules of the resource acquisition request, wherein the structured rules represent the structured distribution of the values ​​of the fields to be detected corresponding to multiple field names to be detected in the resource acquisition request; and extracting the values ​​of the fields to be detected corresponding to each field name from the resource acquisition request according to the structured rules.

[0167] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: using a keyword extraction module to segment each field value to be detected to obtain multiple words to be detected corresponding to each field value; filtering the multiple words to be detected corresponding to each field value based on multiple preset words recorded in a preset vocabulary to obtain multiple target words corresponding to each field value, wherein the target words are the same as the preset words; performing semantic analysis on each target word using a preset keyword extraction model, and filtering multiple keywords to be detected corresponding to each field value from the multiple target words corresponding to each field value based on the semantic analysis results, wherein the keywords to be detected are target words representing the semantic features of the field value to be detected, and the preset keyword extraction model is trained by machine learning using multiple sets of first training data, each set of first training data including: a first sample field value containing multiple sample words, and sample keywords marked in the multiple sample words.

[0168] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: counting the number of keywords corresponding to each field value to be detected; detecting whether the number of keywords is higher than a preset threshold; and selecting multiple keywords to be detected that are the same as the preset threshold if the number of keywords is higher than the preset threshold.

[0169] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: performing semantic feature transformation on each keyword to be detected using a pre-trained semantic model in the pre-trained semantic module to obtain a keyword feature vector for each keyword to be detected, wherein the pre-trained semantic model is: h i =GELU(0,att i W1+b1)W2+b2,h i For keyword feature vectors, we i =Embedding(k i Embedding is the word embedding layer of a pre-trained semantic model, k i The keyword to be detected is att. i =MultiHead(we i MultiHead is the multi-head attention layer of a pre-trained semantic model, and GELU is an activation function based on the Gaussian error function. tanh is the hyperbolic tangent activation function. W1, W2, b1, and b2 are pre-trained using multiple sets of second training data through machine learning. Each set of second training data includes: sample keywords and corresponding sample feature vectors.

[0170] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: using a preset attention model in the attention mechanism module to perform attention analysis on multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector of the resource acquisition request, wherein the preset attention model is: H attention For resource request feature vectors, Let tanh be the feature vector of multiple keywords in the resource retrieval request, and e be the hyperbolic tangent activation function. i These are the normalized attention weights corresponding to the feature vectors of each keyword. and It is trained in advance using multiple sets of third training data through machine learning. Each set of third training data includes: sample feature vectors corresponding to multiple sample keywords in the resource acquisition request as samples, and corresponding sample request feature vectors.

[0171] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: classifying the resource request feature vector using a preset classification model in the classifier to obtain the attack type of the resource acquisition request, wherein the preset classification model is: As an attack type, For resource request feature vectors, and It is trained in advance using multiple sets of fourth training data through machine learning. Each set of fourth training data includes: a sample request feature vector corresponding to the resource acquisition request as a sample, and a pre-labeled attack type label, which is used to represent the attack type.

[0172] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: training a preset detection model using a preset imbalanced total loss function and multiple sets of fifth training data, wherein each set of fifth training data includes: multiple second sample field values ​​in a resource acquisition request as a sample, and a pre-labeled attack type label, the attack type label being used to indicate the attack type of the resource acquisition request, and the preset imbalanced total loss function being: FL(p ik ,y ik )=-(1-p ik ) γ log(p ik Total Loss is the total loss value, FL(*) is the loss value corresponding to each resource acquisition request, and p ik y represents the predicted probability that the i-th resource acquisition request belongs to the k-th attack type, as predicted by the preset detection model.ik The attack type label represents the i-th resource acquisition request as the k-th attack type. N is the number of resource acquisition request samples in the multiple sets of fifth training data. K is the number of attack types in the multiple sets of fifth training data. γ is a pre-set decay factor, which is a hyperparameter that controls the weight of difficult samples. Difficult samples represent resource acquisition requests that are difficult to classify correctly using the pre-set detection model.

[0173] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: after training the preset detection model using multiple sets of fifth training data in each round, the total loss value is determined using a preset imbalanced total loss function; the total loss value is propagated to the preset detection model through a backpropagation algorithm to obtain the gradient value corresponding to the total loss value, wherein the gradient value represents the rate of change of the total loss value with respect to the model parameters in the preset detection model; the optimizer adjusts the model parameters according to the gradient value and the preset learning rate, wherein the preset learning rate is a pre-set hyperparameter used to control the update step size of the model parameters.

[0174] Embodiments of the present invention also provide a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, it implements the steps of the attack detection method provided in the above embodiments.

[0175] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0176] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0177] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0178] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0179] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0180] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a non-volatile storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned non-volatile storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0181] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An attack detection method, characterized in that, include: A resource acquisition request to be detected is initiated by a receiving terminal, wherein the resource acquisition request carries multiple formatted field values ​​to be detected; The keyword extraction module in the preset detection model is used to perform semantic extraction on multiple words to be detected in each of the fields to be detected, so as to obtain multiple keywords to be detected for each of the fields to be detected. The pre-trained semantic module in the preset detection model is used to perform semantic feature transformation on each keyword to be detected, so as to obtain the keyword feature vector of each keyword to be detected. The attention mechanism module in the preset detection model is used to perform attention analysis on multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector of the resource acquisition request. The resource request feature vector is classified using the classifier in the preset detection model to obtain the attack type of the resource acquisition request; Specifically, the keyword extraction module in the preset detection model is used to perform semantic extraction on multiple words to be detected in each of the fields to be detected, resulting in multiple keywords to be detected for each of the fields to be detected, including: The keyword extraction module is used to segment each of the fields to be detected to obtain multiple words to be detected corresponding to each field value. Based on multiple preset words recorded in the preset word list, multiple words corresponding to each field value to be detected are filtered to obtain multiple target words corresponding to each field value to be detected, wherein the target words are the same as the preset words to be detected; A preset keyword extraction model is used to perform semantic analysis on each target word, and based on the semantic analysis results, multiple keywords corresponding to each target word corresponding to each target word are selected. The keywords to be detected are the target words that represent the semantic features of the target word. The preset keyword extraction model is trained by machine learning using multiple sets of first training data. Each set of first training data includes: a first sample field value containing multiple sample words, and sample keywords marked in the multiple sample words.

2. The method according to claim 1, characterized in that, After receiving the resource acquisition request to be detected initiated by the receiving terminal, the method further includes: Obtain the structured rules of the resource acquisition request, wherein the structured rules represent the structured distribution of the values ​​of the fields to be detected corresponding to multiple field names to be detected in the resource acquisition request; Based on the structured rules, the value of the field to be detected corresponding to each field name to be detected is extracted from the resource acquisition request.

3. The method according to claim 1, characterized in that, After performing semantic analysis on each target word using a preset keyword extraction model, and filtering multiple keywords corresponding to each target word from the multiple target words corresponding to each target word value based on the semantic analysis results, the method further includes: Count the number of keywords corresponding to each value of the field to be detected; Detect whether the number of keywords exceeds a preset threshold; If the number of keywords exceeds a preset threshold, select multiple keywords to be detected that are the same as the preset threshold.

4. The method according to claim 1, characterized in that, The pre-trained semantic module in the preset detection model is used to perform semantic feature transformation on each keyword to be detected, resulting in a keyword feature vector for each keyword to be detected, including: The pre-trained semantic model in the pre-trained semantic module is used to perform semantic feature transformation on each keyword to be detected, resulting in the keyword feature vector for each keyword to be detected. The pre-trained semantic model is: , The keyword feature vector, , It is the word embedding layer of the pre-trained semantic model. The keyword to be detected. , It is the multi-head attention layer of the pre-trained semantic model. It is an activation function based on the Gaussian error function. tanh is the hyperbolic tangent activation function. , , and It is trained in advance using multiple sets of second training data through machine learning, and each set of second training data includes: sample keywords and corresponding sample feature vectors.

5. The method according to claim 1, characterized in that, The attention mechanism module in the preset detection model is used to perform attention analysis on multiple keyword feature vectors in the resource acquisition request, resulting in a resource request feature vector including: The attention mechanism module uses a preset attention model to perform attention analysis on multiple keyword feature vectors in the resource acquisition request to obtain the resource request feature vector, wherein the preset attention model is: , , For resource request feature vectors, These are the feature vectors of the multiple keywords in the resource acquisition request. It is the hyperbolic tangent activation function. These are the normalized attention weights corresponding to each keyword feature vector. and It is trained in advance using multiple sets of third training data through machine learning. Each set of third training data includes: sample feature vectors corresponding to multiple sample keywords in the resource acquisition request as samples, and corresponding sample request feature vectors.

6. The method according to claim 1, characterized in that, The resource request feature vector is classified using the classifier in the preset detection model to obtain the attack types of the resource acquisition request, including: The resource request feature vector is classified using a preset classification model in the classifier to obtain the attack type of the resource acquisition request, wherein the preset classification model is: , For the attack type, This is the feature vector of the resource request. and It is trained in advance using multiple sets of fourth training data through machine learning. Each set of fourth training data includes: a sample request feature vector corresponding to a resource acquisition request as a sample, and a pre-labeled attack type label, which is used to represent the attack type.

7. The method according to claim 1, characterized in that, The method further includes: The preset detection model is trained using a preset imbalanced total loss function and multiple sets of fifth training data. Each set of fifth training data includes: multiple second sample field values ​​from a resource acquisition request as a sample, and a pre-labeled attack type label, which represents the attack type of the resource acquisition request. The preset imbalanced total loss function is: , , This is the total loss value. For each of the resource requests, obtain the corresponding loss value. This indicates that the preset detection model predicts the first... The resource acquisition request belongs to the first The predicted probability of each attack type. Indicates the first The resource acquisition request is the first one. The attack type label of the attack type, N is the number of resource acquisition request samples in the multiple sets of the fifth training data, K is the number of attack types in the multiple sets of the fifth training data, γ is a preset decay factor, the preset decay factor is a hyperparameter that controls the weight of difficult samples, the difficult samples represent resource acquisition requests that are difficult to classify correctly using the preset detection model.

8. The method according to claim 7, characterized in that, Training the preset detection model using a preset imbalanced total loss function and multiple sets of fifth training data includes: After training the preset detection model using multiple sets of the fifth training data in each round, the preset imbalanced total loss function is used to determine the total loss value. The total loss value is propagated to the preset detection model through a backpropagation algorithm to obtain the gradient value corresponding to the total loss value, wherein the gradient value represents the rate of change of the total loss value with respect to the model parameters in the preset detection model; The optimizer adjusts the model parameters based on the gradient value and the preset learning rate, where the preset learning rate is a pre-set hyperparameter used to control the update step size of the model parameters.

9. An attack detection device, characterized in that, include: A receiving module is used to receive a resource acquisition request to be detected initiated by a terminal, wherein the resource acquisition request carries multiple field values ​​to be detected with formatting. The extraction module is used to perform semantic extraction on multiple words to be detected in each of the fields to be detected using the keyword extraction module in the preset detection model, so as to obtain multiple keywords to be detected for each field to be detected. The conversion module is used to perform semantic feature conversion on each keyword to be detected using the pre-trained semantic module in the preset detection model, so as to obtain the keyword feature vector of each keyword to be detected. The attention analysis module is used to perform attention analysis on multiple keyword feature vectors in the resource acquisition request using the attention mechanism module in the preset detection model, so as to obtain the resource request feature vector of the resource acquisition request. The classification module is used to classify the resource request feature vector using the classifier in the preset detection model to obtain the attack type of the resource acquisition request; The extraction module includes: The word segmentation unit is used to segment each of the fields to be detected using the keyword extraction module to obtain multiple words to be detected corresponding to each field value to be detected. The filtering unit is used to filter multiple words corresponding to each field value to be detected based on multiple preset words recorded in a preset word list, so as to obtain multiple target words corresponding to each field value to be detected, wherein the target words are the same as the preset words to be detected; The semantic analysis unit is used to perform semantic analysis on each target word using a preset keyword extraction model, and to filter multiple keywords corresponding to each target word from the multiple target words corresponding to each target word based on the semantic analysis results. The keywords to be detected are the target words that represent the semantic features of the target word. The preset keyword extraction model is trained by machine learning using multiple sets of first training data. Each set of first training data includes: a first sample field value containing multiple sample words, and sample keywords labeled in the multiple sample words.

10. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores a computer program, wherein the device containing the non-volatile storage medium executes the attack detection method according to any one of claims 1 to 8 by running the computer program.

11. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the attack detection method according to any one of claims 1 to 8 through the computer program.

12. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the attack detection method according to any one of claims 1 to 8.

Images