Unknown Web attack detection method based on Transform

Abstract

The invention provides an unknown Web attack detection method based on Transform, and the method comprises the steps: collecting an HTTP (Hyper Text Transfer Protocol) request in real time, and preprocessing the HTTP request into a tag sequence; inserting a special mark at the beginning of the mark sequence, converting each mark in the expanded mark sequence into an embedded representation, and encoding the embedded representation by using a multi-layer Transform encoder to obtain an intermediate representation of each mark; taking the intermediate representation as an initial hidden state of the GRU decoder, and performing sequence decoding on the GRU decoder to generate a reconstruction mark sequence; and judging whether the given HTTP request accords with the mode characteristics of the normal HTTP request or not by comparing the reconstruction error of the original mark sequence and the reconstruction mark sequence. Through an unsupervised learning mode, under the condition of not depending on manual rules or annotation data, detection of unknown Web attacks can be achieved, the structure information of the HTTP request can be effectively captured, and modeling of a normal behavior mode of Web application is achieved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a Transformer-based unknown Web attack detection method. Background Art

[0002] With the development of network technology, Web applications have become one of the most important applications on the Internet. They can be used for website backends or provide application programming interfaces for other services. Currently, various organizations, including large Internet companies and government agencies, have provided Web application services to the outside world. While providing large-scale services, attacks against Web applications are also emerging in an endless stream, such as SQL injection and cross-site scripting (XSS). Attackers launch attacks by sending carefully constructed malicious requests to Web servers. These attacks may lead to multiple serious consequences, such as arbitrary file reading and writing and malicious command execution.

[0003] The current mainstream way to defend against Web attacks is to deploy a Web Application Firewall (WAF). Any Web request will be submitted to the Web server for processing only after it is determined to be legitimate by the security mechanism of the WAF, otherwise it will be blocked by the WAF. The traditional WAF is a rule-based attack detection system. It can only match known attack methods by manually adding rules, and cannot detect unknown attacks. It also relies on a high-quality rule base, which usually requires professional security operation and maintenance personnel to write and regularly maintain, such as adding and modifying rules based on threat intelligence. At the same time, WAF also has certain restrictions on the number of configured rules. If the number of rules is too large, it will significantly increase the computing overhead, resulting in low detection efficiency.

[0004] In addition to rule-based detection, with the development of machine learning technology in recent years, machine learning methods have also been widely used in Web attack detection. This method can be divided into supervised and unsupervised methods. Supervised methods require training data to include at least two types of annotations: normal or attack. Its effectiveness is highly dependent on the quality of the labeled data. Specifically, supervised methods limit the prior knowledge about attacks in training data, so it is still impossible to identify unknown attacks outside the distribution of training data; unsupervised methods use the idea of ​​anomaly detection, which only requires normal category data to model the normal behavior pattern of Web applications, and identify samples that deviate from the normal request pattern as attacks. However, existing unsupervised methods do not take into account the structural information of HTTP requests, so they cannot effectively model the normal behavior pattern of Web applications, resulting in low detection accuracy. Summary of the invention

[0005] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0006] To this end, the purpose of this application is to propose a Transformer-based unknown Web attack detection method, which realizes the detection of unknown Web attacks through unsupervised learning without relying on artificial rules or labeled data, and by proposing a new unsupervised learning model based on an improved Transformer, it can effectively capture the structural information of HTTP requests and realize the modeling of normal behavior patterns of Web applications.

[0007] To achieve the above objectives, the present application embodiment proposes a Transformer-based unknown Web attack detection method, including:

[0008] S1: collects HTTP requests in real time and preprocesses them into token sequences;

[0009] S2: insert a special token at the beginning of the token sequence, convert each token in the expanded token sequence into an embedded representation, encode the embedded representation using a multi-layer Transformer encoder, and obtain an intermediate representation of each token;

[0010] S3: using the intermediate representation as the initial hidden state of the GRU decoder, and generating a reconstructed tag sequence by sequentially decoding the GRU decoder;

[0011] S4: By comparing the reconstruction error between the original tag sequence and the reconstructed tag sequence, it is determined whether the given HTTP request conforms to the pattern characteristics of a normal HTTP request.

[0012] Optionally, the real-time collection of HTTP requests and preprocessing the HTTP requests into a tag sequence may include:

[0013] Extract the request method, URL path, URL request parameters and request body from each HTTP request according to the HTTP protocol, and combine the extracted information into a string according to a specific template;

[0014] The character string is segmented based on reserved characters, English punctuation characters and blank characters of the HTTP protocol to obtain the tag sequence.

[0015] Optionally, inserting a special marker at the beginning of the marker sequence and converting each marker in the expanded marker sequence into an embedded representation comprises:

[0016] For a tag sequence X = { <encoder>, x1, x2, ..., x n }, inserts a special tag at the beginning of the tag sequence <encoder>, and obtain the expanded tag sequence { <encoder>, x1, x2, ..., x n };

[0017] For the expanded token sequence { <encoder>, x1, x2, ..., x n }, convert it into an embedding representation composed of word embedding and position embedding, expressed as:

[0018]

[0019] Here, e is a combination of word embedding and position embedding.

[0020] Optionally, encoding the embedded representation using a multi-layer Transformer encoder to obtain an intermediate representation of each tag includes:

[0021] The embedded representation is encoded using a multi-layer Transformer encoder to obtain the context representation vector for each token, expressed as:

[0022]

[0023] Among them, let the total number of layers of the multi-layer Transformer encoder be L, H represents the context representation vector of each tag, and H( L ) represents the calculation result of the Lth layer, and h ＜encoder> as an intermediate representation for each token.

[0024] Optionally, the calculation result of each layer in the multi-layer Transformer encoder is expressed as:

[0025] H (l) =TransformerLayer (l) (H (l-1) ),

[0026] Where l = 1, 2, ..., L, H (0) =E, TransformerLayer represents the operation function of each layer of Transformer, including the self-attention mechanism and the feedforward neural network. The calculation expression of the self-attention mechanism is:

[0027]

[0028] Among them, Q, K, V are input by H (l-1) The query, key, and value matrices obtained through different linear transformations;

[0029] The output of the self-attention mechanism is further processed by a feedforward neural network, expressed as:

[0030] FFN(H)=ReLU(HW1+b1)W2+b2,

[0031] Among them, W1, W2, b1, b2 are trainable parameters.

[0032] Optionally, the using the intermediate representation as an initial hidden state of a GRU decoder and generating a reconstructed tag sequence by sequentially decoding the GRU decoder includes:

[0033] The middle representation h <enncoder>< / enncoder> As the initial hidden state h0 of the GRU decoder;

[0034] At each time step t, the GRU decoder generates a label y based on the previous time step. t-1 and the hidden state h at the previous time step t-1 Generate a new hidden state h t , the expression is:

[0035] h t =GRUCell(y t-1 ,h t-1 )

[0036] The hidden state h at each time step t Mapped to the output dimension through a linear layer, the probability distribution of the output tag is obtained, and the reconstructed tag sequence is generated by sampling in the probability distribution.

[0037] Optionally, the trained Transformer-based unsupervised autoencoder model performs steps S2 and S3, wherein the training process of the Transformer-based unsupervised autoencoder model is:

[0038] Collect log data of a certain Web application within a period of time, and extract all plaintext HTTP requests in the log data within the period of time as original training data;

[0039] Extracting a request method, a URL path, a URL request parameter, and a request body from each HTTP request in the original training data according to the HTTP protocol, and combining the extracted information into a string sample according to a specific template;

[0040] Segment the string sample based on reserved characters, English punctuation characters, and blank characters of the HTTP protocol to obtain a tag sequence sample;

[0041] The sequence autoencoder model is trained using labeled sequence samples. The training goal is to make the reconstructed labeled sequence samples output by the model as consistent as possible with the original labeled sequence samples. The loss function is as follows:

[0042]

[0043] Where T j represents the unique hot encoding corresponding to the jth labeled sequence sample in the dataset, f θ (T j ) represents the probability distribution output by the model for the jth labeled sequence sample, and the function R is the negative log-likelihood function;

[0044] After calculating the loss function, the model parameters of the sequence autoencoder model are iteratively updated according to the gradient descent method.

[0045] Optionally, the determining whether a given HTTP request conforms to a pattern feature of a normal HTTP request by comparing the reconstruction error between the original tag sequence and the reconstructed tag sequence includes:

[0046] The BLEU score between the original tag sequence and the reconstructed tag sequence is calculated. When the BLEU score is lower than a preset threshold, the detected HTTP request is judged to be an abnormal attack request, otherwise it is a normal request.

[0047] Optionally, the preset threshold is adjusted according to the false alarm rate and the missed alarm rate in an actual application scenario.

[0048] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0049] Through unsupervised learning, it is possible to detect unknown Web attacks without relying on artificial rules or labeled data. By proposing a new unsupervised learning model based on an improved Transformer, it is possible to effectively capture the structural information of HTTP requests and model the normal behavior patterns of Web applications.

[0050] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0052] Figure 1 It is a flowchart of a Transformer-based unknown Web attack detection method according to an embodiment of the present application;

[0053] Figure 2 It is an architecture diagram of an unsupervised autoencoder model based on Transformer according to an embodiment of the present application. DETAILED DESCRIPTION

[0054] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0055] The core idea of ​​this application is to model the semantics of normal HTTP requests by constructing a sequence autoencoder model. The sequence autoencoder includes two main modules: an encoder and a decoder. The encoder takes the original tag sequence of the original HTTP request after preprocessing as input and encodes it into an intermediate representation (latentrepresentation) in a latent space. The decoder then attempts to reconstruct the original tag sequence from the intermediate representation. Finally, by comparing the reconstructed tag error between the original tag sequence and the reconstructed sequence, it is determined whether the given HTTP request meets the pattern characteristics of a normal HTTP request.

[0056] Since HTTP requests themselves have certain structural information, such as correlations between URL parameters, in order to ensure modeling results, the dependencies between different fields need to be considered when encoding the original sequence. The Transformer architecture helps solve this problem. Unlike traditional sequence models such as recurrent neural networks, the Transformer treats the entire sequence as a whole and can capture the dependencies between any two tags through the self-attention mechanism. At the same time, compared with traditional sequence models such as recurrent neural networks, it can process data in parallel, which can further increase detection efficiency.

[0057] However, the Transformer's own encoding and decoding mechanism cannot be used to train the sequence autoencoder model, because the decoder uses a cross attention structure to take the encoder's output at each time step as input. This process does not compress the feature dimension, so it is impossible to effectively learn the feature expression of the latent space, which is reflected in the detection results and will cause the model's ability to detect attacks to decrease. For this reason, this application proposes a new Transformer-based unsupervised autoencoder model, which first inserts a special " <encoder>"Tag, the new tag sequence is encoded by Transformer, " <encoder>The representation vector corresponding to the "mark is extracted for decoding; in the decoding stage, this application abandons the inherent decoder of Transformer and chooses to use the gated recurrent unit (GRU) for decoding. This application uses " <encoder>The representation vector corresponding to the "mark" is used as the initial state of GRU to generate a reconstructed mark sequence.

[0058] A Transformer-based unknown Web attack detection method according to an embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0059] Figure 1 is a flowchart of a Transformer-based unknown Web attack detection method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0060] Step S1: Collect HTTP requests in real time and preprocess them into tag sequences.

[0061] In the embodiment of the present application, for each collected HTTP request, the following pre-processing steps are performed:

[0062] According to the HTTP protocol, the request method, URL path, URL request parameters and request body are extracted from each HTTP request, and the extracted information is combined into a string according to a specific template; the string is segmented based on the reserved characters, English punctuation characters and blank characters of the HTTP protocol to obtain a token sequence.

[0063] In a possible embodiment, the specific template can be expressed as:

[0064] "Method:{request method}Path:{URL path}Para:{URL request parameter}body:{request body}"

[0065] It is understood that whitespace characters include line break characters and space characters, etc.

[0066] Step S2: insert a special token at the beginning of the token sequence, convert each token in the expanded token sequence into an embedded representation, and encode the embedded representation using a multi-layer Transformer encoder to obtain an intermediate representation of each token.

[0067] It is understandable that the Transformer's own encoding and decoding mechanism cannot be used to train the sequence autoencoder model, because the decoder uses a cross-attention structure to take the output of the encoder at each time step as input. This process does not compress the feature dimension, so it is impossible to effectively learn the feature expression of the latent space, which is reflected in the detection results and will cause the model's detection ability for attacks to decrease. Therefore, in this embodiment of the application, for the tag sequence X={ <encoder>, x1, x2, ..., x n }, insert a special tag at the beginning of the tag sequence <encoder>, and obtain the expanded tag sequence { <encoder>, x1, x2, ..., x n }; and, for the expanded token sequence { <encoder>, x1, x2, ..., x n } each tag (including <encoder>), convert it into an embedding representation composed of word embedding and position embedding, the expression is:

[0068]

[0069] Here, e is a combination of word embedding and position embedding.

[0070] Furthermore, a multi-layer Transformer encoder is used to encode the embedded representation.

[0071] In some embodiments of the present application, if the total number of layers of the multi-layer Transformer encoder is L, the calculation result of each layer is expressed as:

[0072] H (l) =TransformerLayer (l) (H (l-1) ),

[0073] Where l = 1, 2, ..., L, H (0) =E, TransformerLayer represents the operation function of each layer of Transformer, including self-attention mechanism and feedforward neural network.

[0074] The calculation expression of the self-attention mechanism is:

[0075]

[0076] Among them, Q, K, V are input by H( l-1 )Query, key, and value matrices obtained through different linear transformations.

[0077] Moreover, the output of the self-attention mechanism is further processed by the feedforward neural network, and the expression is:

[0078] FFN(H)=ReLU(HW1+b1)W2+b2,

[0079] Among them, W1, W2, b1, b2 are trainable parameters.

[0080] Finally, after being encoded by multiple layers of Transformer encoders, the output is the context representation vector of each token (including <encoder>),Right now:

[0081]

[0082] Among them, H represents the context representation vector of each token, H( L ) represents the calculation result of the Lth layer.

[0083] In the present embodiment, h ＜enncoder> as an intermediate representation for each token.

[0084] Step S3: Use the intermediate representation as the initial hidden state of the GRU decoder, and generate a reconstructed tag sequence by sequentially decoding the GRU decoder.

[0085] It should be noted that this application abandons the inherent decoder of Transformer in the decoding stage, and instead chooses to use the gated recurrent unit (GRU) for decoding.

[0086] Specifically, first, the intermediate representation h <encoder>< / encoder> As the initial hidden state h0 of the GRU decoder; then at each time step t, the GRU decoder generates the tag y according to the previous time step t-1 and the hidden state h at the previous time step t-1 Generate a new hidden state h t , the expression is:

[0087] h t =GRUCell(y t-1 ,h t-1 )

[0088] Finally, the hidden state h of each time step is t Mapped to the output dimension through a linear layer, the probability distribution of the output tag is obtained, and the reconstructed tag sequence is generated by sampling in the probability distribution.

[0089] It can be understood that the above steps S2 and S3 are essentially the online deployment stage of the Transformer-based unsupervised autoencoder model proposed in this application, which is responsible for predicting real-time HTTP traffic to identify attacks. The architecture diagram of the Transformer-based unsupervised autoencoder model is as follows: Figure 2 shown.

[0090] In the embodiment of the present application, the training process of the Transformer-based unsupervised autoencoder model is:

[0091] Collect log data of a certain Web application within a period of time, extract all plaintext HTTP requests in the log data within the period of time as original training data; extract the request method, URL path, URL request parameters and request body from each HTTP request in the original training data according to the HTTP protocol, and combine the extracted information into a string sample according to a specific template; segment the string sample based on the reserved characters, English punctuation characters and blank characters of the HTTP protocol to obtain a labeled sequence sample; use the labeled sequence sample to train the sequence autoencoder model, and the training goal is to make the reconstructed labeled sequence sample output by the model as consistent as possible with the original labeled sequence sample, and the loss function is as follows:

[0092]

[0093] Where T j represents the unique hot encoding corresponding to the jth labeled sequence sample in the dataset, f θ (T j ) represents the probability distribution output by the model for the j-th labeled sequence sample, and the function R is the negative log-likelihood function. After calculating the loss function, the model parameters of the sequence autoencoder model are iteratively updated according to the gradient descent method.

[0094] In a possible embodiment, a specific template in the training process can be expressed as:

[0095] "Method: {request method} Path: {URL path} Para: {URL request parameter} body: {request body}"

[0096] It is understood that whitespace characters include line break characters and space characters, etc.

[0097] Step S4: By comparing the reconstruction error between the original tag sequence and the reconstructed tag sequence, it is determined whether the given HTTP request conforms to the pattern characteristics of a normal HTTP request.

[0098] Finally, after the above steps are completed to obtain the reconstructed tag sequence, the difference between the two sequences is measured by calculating the BLEU score between the original tag sequence and the reconstructed tag sequence.

[0099] Furthermore, when the BLEU score is lower than a preset threshold, the detected HTTP request is judged to be an abnormal attack request, otherwise it is a normal request.

[0100] Among them, the preset threshold is adjusted according to the false alarm rate and the missed alarm rate in the actual application scenario, and this application does not specifically limit the specific value of the preset threshold.

[0101] In general, the present invention is oriented to real Web applications and proposes an unsupervised detection method for unknown Web attacks, which can detect attacks without obtaining any prior knowledge about the attacks. And model training and deployment can be completed by only collecting log data of Web applications without manual labeling. In addition, the Transformer-based unsupervised autoencoder model proposed in the present invention can effectively take into account the structural information of HTTP requests, and then effectively learn the latent space intermediate representation of HTTP requests, and realize the modeling of normal HTTP request patterns.

[0102] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0103] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.< / encoder> < / encoder> < / encoder> < / encoder> < / encoder> < / encoder> < / encoder> < / encoder> < / encoder> < / encoder> < / encoder> < / encoder> < / encoder>

Claims

1. A Transformer-based unknown Web attack detection method, characterized in that: include: S1: collects HTTP requests in real time and preprocesses them into token sequences; S2: insert a special token at the beginning of the token sequence, convert each token in the expanded token sequence into an embedded representation, encode the embedded representation using a multi-layer Transformer encoder, and obtain an intermediate representation of each token; S3: using the intermediate representation as the initial hidden state of the GRU decoder, and generating a reconstructed tag sequence by sequentially decoding the GRU decoder; S4: By comparing the reconstruction error between the original tag sequence and the reconstructed tag sequence, it is determined whether the given HTTP request conforms to the pattern characteristics of a normal HTTP request.

2. The method according to claim 1, characterized in that The real-time collection of HTTP requests and preprocessing thereof into a tag sequence include: Extract the request method, URL path, URL request parameters and request body from each HTTP request according to the HTTP protocol, and combine the extracted information into a string according to a specific template; The character string is segmented based on reserved characters, English punctuation characters and blank characters of the HTTP protocol to obtain the tag sequence.

3. The method according to claim 1, characterized in that The inserting a special token at the beginning of the token sequence and converting each token in the expanded token sequence into an embedded representation comprises: For a tag sequence X = { <encoder>,x1,x2,…,x n }, inserts a special tag at the beginning of the tag sequence <encoder>, and obtain the expanded tag sequence { <encoder>,x1,x2,…,x n };< / encoder> < / encoder> < / encoder> For the expanded token sequence { <encoder>,x1,x2,…,x n }, convert it into an embedding representation composed of word embedding and position embedding, expressed as:< / encoder> Here, e is a combination of word embedding and position embedding.

4. The method according to claim 3, characterized in that The embedded representation is encoded using a multi-layer Transformer encoder to obtain an intermediate representation of each tag, including: The embedded representation is encoded using a multi-layer Transformer encoder to obtain the context representation vector for each token, expressed as: Among them, let the total number of layers of the multi-layer Transformer encoder be L, H represents the context representation vector of each tag, and H (L) Represents the calculation result of the Lth layer, and h ＜encodrr＞ as an intermediate representation for each token.

5. The method according to claim 4, characterized in that The calculation results of each layer in the multi-layer Transformer encoder are expressed as: H (l) =TransformerLayer (l) (H (l-1) ), Where l = 1, 2, ..., L, H (0) =E, TransformerLayer represents the operation function of each layer of Transformer, including the self-attention mechanism and the feedforward neural network. The calculation expression of the self-attention mechanism is: Among them, Q, K, V are input by H (l-1) The query, key, and value matrices obtained through different linear transformations; The output of the self-attention mechanism is further processed by a feedforward neural network, expressed as: FFN(H)=ReLU(HW1+b1)W2+b2, Among them, W1, W2, b1, b2 are trainable parameters.

6. The method according to claim 4, characterized in that The step of using the intermediate representation as an initial hidden state of a GRU decoder and performing sequence decoding on the GRU decoder to generate a reconstructed tag sequence includes: The middle representation h <encoder>< / encoder> As the initial hidden state h0 of the GRU decoder; At each time step t, the GRU decoder generates a label y based on the previous time step. t-1 and the hidden state h at the previous time step t-1 Generate a new hidden state h t , the expression is: h t =GRUCell(y t-1 ,h t-1 ) The hidden state h at each time step t Mapped to the output dimension through a linear layer, the probability distribution of the output tag is obtained, and the reconstructed tag sequence is generated by sampling in the probability distribution.

7. The method according to claim 6, characterized in that The trained Transformer-based unsupervised autoencoder model executes steps S2 and S3, wherein the training process of the Transformer-based unsupervised autoencoder model is: Collect log data of a certain Web application within a period of time, and extract all plaintext HTTP requests in the log data within the period of time as original training data; Extracting a request method, a URL path, a URL request parameter, and a request body from each HTTP request in the original training data according to the HTTP protocol, and combining the extracted information into a string sample according to a specific template; Segment the string sample based on reserved characters, English punctuation characters, and blank characters of the HTTP protocol to obtain a tag sequence sample; The sequence autoencoder model is trained using labeled sequence samples. The training goal is to make the reconstructed labeled sequence samples output by the model as consistent as possible with the original labeled sequence samples. The loss function is as follows: Where T j represents the unique hot encoding corresponding to the jth labeled sequence sample in the dataset, f θ (T j ) represents the probability distribution output by the model for the jth labeled sequence sample, and the function R is the negative log-likelihood function; After calculating the loss function, the model parameters of the sequence autoencoder model are iteratively updated according to the gradient descent method.

8. The method according to claim 1, characterized in that The step of comparing the reconstruction error between the original tag sequence and the reconstructed tag sequence to determine whether the given HTTP request conforms to the pattern characteristics of a normal HTTP request includes: The BLEU score between the original tag sequence and the reconstructed tag sequence is calculated. When the BLEU score is lower than a preset threshold, the detected HTTP request is judged to be an abnormal attack request, otherwise it is a normal request.

9. The method according to claim 8, characterized in that The preset threshold is adjusted according to the false alarm rate and the missed alarm rate in the actual application scenario.

Images