Web application attack detection method and device, equipment and storage medium

Abstract

The invention discloses a Web application attack detection method and device, equipment and a storage medium, relates to the technical field of network security, and can improve the accuracy and efficiency of Web application attack detection and the detection of unknown attacks. According to the specific scheme, the method comprises the steps of obtaining a to-be-detected http request, wherein the http request comprises a request method; after the http request is preprocessed, target request information is obtained, and the target request information comprises a target label of a request method; respectively inputting the target request information into a preset TF-IDF algorithm and a target FastTest model for feature extraction, and respectively obtaining a corresponding first feature vector and a corresponding second feature vector; performing feature fusion on the first feature vector, the second feature vector and the target label to obtain a target feature vector; and carrying out attack detection based on the target feature vector to obtain a detection result.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment and storage medium for detecting Web application attacks. Background Art

[0002] In recent years, the number of dynamic website applications that provide services to the public has increased day by day. People often need to use a large number of Web applications in their daily work and life, such as logging into online banking, conducting remote work, and querying personal social security information through computers and mobile phones. Therefore, network data security protection of Web applications is undoubtedly a very important topic.

[0003] Web attacks are attacks on users' online behaviors or devices such as website servers, such as implanting malicious code, modifying website permissions, obtaining website users' private information, etc. Traditional rule-based or signature-based methods are often difficult to cope with the ever-changing attack methods and complex network environments, so a more effective detection method for Web application attacks is urgently needed. Summary of the invention

[0004] The present application provides a method, apparatus, device and storage medium for detecting Web application attacks, which can improve the accuracy and efficiency of Web application attack detection.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect of an embodiment of the present application, a method for detecting a Web application attack is provided, the method comprising:

[0007] Obtaining an http request to be detected, wherein the http request includes a request method;

[0008] After preprocessing the http request, target request information is obtained, wherein the target request information includes a target tag of the request method;

[0009] Input the target request information into a preset TF-IDF algorithm and a target FastTest model respectively for feature extraction, and obtain corresponding first feature vectors and second feature vectors respectively;

[0010] Performing feature fusion on the first feature vector, the second feature vector, and the target label to obtain a target feature vector;

[0011] Attack detection is performed based on the target feature vector to obtain a detection result.

[0012] As a possible implementation manner, performing attack detection based on the target feature vector to obtain a detection result includes:

[0013] The target feature vector is input into a preset target LightGBM detection model for attack detection to obtain the detection result of the http request; the target LightGBM detection model is trained based on a sample set, and the sample set includes multiple target feature vectors and attack types corresponding to each target feature vector.

[0014] As a possible implementation, before obtaining the http request to be detected, the method includes:

[0015] Obtaining a training set, wherein the training set includes multiple target request information and attack types corresponding to each target request information, wherein the target request information is information after http request is preprocessed;

[0016] The preset initial FastTest model is trained using the training set until the initial FastTest model meets the preset conditions, thereby obtaining the target FastTest model.

[0017] As a possible implementation manner, before inputting the target feature vector into a preset target LightGBM detection model for attack detection, the method further includes:

[0018] Acquire the sample set;

[0019] The initial LightGBM detection model is trained using the sample set until the accuracy of the LightGBM detection model reaches a preset threshold, thereby obtaining the target LightGBM detection model.

[0020] As a possible implementation, the http request further includes: a URL, a request header and a data body; after preprocessing the http request, the target request information is obtained, including:

[0021] After labeling and encoding / decoding the request method in sequence, the target label is obtained;

[0022] Extracting a parameter set of the URL, and obtaining a target URL after encoding and decoding the parameter set, wherein the parameter set includes parameter names in the URL and parameter values ​​corresponding to each parameter name;

[0023] Extracting the field value in the request header, and performing encoding and decoding processing on the field value to obtain the target request header;

[0024] Performing encoding and decoding processing on the data body to obtain a target data body;

[0025] The target tag, the target URL, the target request header and the target data body are sequentially concatenated to obtain the target request information.

[0026] As a possible implementation method, the target request information is input into a preset TF-IDF algorithm for feature extraction, including:

[0027] Performing dimensionality reduction processing on the target request information to obtain dimensionality reduction request information;

[0028] Using the three feature extraction modes included in the TF-IDF algorithm, feature extraction is performed on the target request information respectively to obtain three corresponding first sub-feature vectors;

[0029] Performing dimensionality reduction processing on the three first sub-feature vectors to obtain corresponding first reduced-dimensionality sub-feature vectors;

[0030] The first feature vector is obtained by concatenating the three first dimension-reduced sub-feature vectors.

[0031] As a possible implementation method, the target request information is input into the target FastTest model for feature extraction, including:

[0032] After inputting the target request information into the target FastTest model, the target FastTest model loads the training data set and generates a second initial feature vector of the target request information based on the training data set;

[0033] After generating the second initial feature vector of the target request information based on the training data set, the method further includes: performing dimensionality reduction processing on the second initial feature vector to obtain the second feature vector.

[0034] In a second aspect of an embodiment of the present application, a device for detecting a Web application attack is provided, the device comprising:

[0035] An acquisition module, used for acquiring an http request to be detected, wherein the http request includes a request method;

[0036] A processing module, used for pre-processing the http request to obtain target request information, wherein the target request information includes a target tag of the request method;

[0037] An extraction module, used for inputting the target request information into a preset TF-IDF algorithm and a target FastTest model for feature extraction, respectively, to obtain corresponding first feature vectors and second feature vectors;

[0038] A fusion module, used for performing feature fusion on the first feature vector, the second feature vector and the label code to obtain a target feature vector;

[0039] The detection module is used to perform attack detection based on the target feature vector to obtain a detection result.

[0040] According to a third aspect of an embodiment of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the method for detecting Web application attacks in the first aspect of the embodiment of the present application is implemented.

[0041] According to a fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for detecting Web application attacks in the first aspect of the embodiments of the present application is implemented.

[0042] The beneficial effects brought by the technical solution provided by the embodiment of the present application include at least:

[0043] A method for detecting a Web application attack in an embodiment of the present application obtains an http request to be detected, wherein the http request includes a request method, and after preprocessing the http request, obtains target request information, wherein the target request information includes a target tag of the request method; the target request information is respectively input into a preset TF-IDF algorithm and a target FastTest model for feature extraction, and the corresponding first feature vector and second feature vector are respectively obtained; the first feature vector, the second feature vector and the target tag are feature-fused to obtain a target feature vector; attack detection is performed based on the target feature vector to obtain a detection result. By fusing TF-IDF and FastText feature vectors to detect Web application attacks, the accuracy and efficiency of Web application attack detection and the detection of unknown attacks can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flowchart of a method for detecting a Web application attack provided in an embodiment of the present application;

[0045] Figure 2 A schematic diagram of an http request provided in an embodiment of the present application Figure 1 ;

[0046] Figure 3 A schematic diagram of an http request provided in an embodiment of the present application Figure 2 ;

[0047] Figure 4A structural diagram of a Web application attack detection device provided in an embodiment of the present application;

[0048] Figure 5 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "plurality" means two or more.

[0051] Additionally, the use of “based on” or “according to” is meant to be open and inclusive, as a process, step, calculation, or other action “based on” or “according to” one or more conditions or values ​​may, in practice, be based on additional conditions or beyond values.

[0052] In recent years, the number of dynamic website applications that provide services to the public has increased day by day. People often need to use a large number of Web applications in their daily work and life, such as logging into online banking, conducting remote work, and querying personal social security information through computers and mobile phones. Therefore, the network data security protection of Web applications is undoubtedly a very important topic. Web attacks are attacks on users' online behavior or devices such as website servers, such as implanting malicious code, modifying website permissions, and obtaining website users' privacy information.

[0053] Modern network security and web application protection (WAF) technologies have some obvious limitations and shortcomings. Currently, the more advanced technologies include the following: traditional signature matching, rule-based detection, machine learning technology, behavioral analysis and AI, and hybrid solutions.

[0054] Among them, the shortcomings of traditional signature matching include: relying on a signature library of known attack patterns, unable to effectively respond to new attacks or zero-day vulnerabilities; and limited detection effects on variant attacks and encrypted traffic.

[0055] Rule-based detection: It requires a lot of manual maintenance and rule adjustment, and is difficult to cope with complex attack patterns and large-scale Web application scenarios.

[0056] Machine learning technology can learn attack patterns from a large amount of data and has a certain ability to deal with unknown and complex attacks. However, it requires a large amount of training data and computing resources to train the model; the model has poor interpretability, making it difficult to accurately understand and adjust the classification logic; and it is easily affected by adversarial samples and data skew.

[0057] Behavioral analysis and AI can detect abnormal activities and zero-day attacks by analyzing user behavior and access patterns. However, they are sensitive to behavioral changes in normal traffic and may produce false positives or false negatives. They require complex models and algorithm support, which increases the difficulty of deployment and maintenance.

[0058] In order to solve the above problems, the present application embodiment provides a method for detecting Web application attacks, such as Figure 1 As shown, the method comprises the following steps:

[0059] Step 101: Obtain an http request to be detected, wherein the http request includes a request method.

[0060] Each http request data includes: request method, URL (request address and parameters), request headers, and data body. Figure 2 As shown in the figure, it is the request data format of the GET request, such as Figure 3 As shown, this is the request data format of the POST request.

[0061] Step 102: After preprocessing the http request, target request information is obtained, and the target request information includes a target tag of the request method.

[0062] The preprocessing includes data cleaning and data encoding and decoding. The target label of the request method is obtained by labeling and encoding and decoding the request method in sequence. The labeling process refers to assigning a corresponding string or a corresponding value to each request method.

[0063] Step 103: Input the target request information into a preset TF-IDF algorithm and a target FastTest model respectively for feature extraction, and obtain corresponding first feature vectors and second feature vectors respectively.

[0064] Among them, TF-IDF (Term Frequency-Inverse Document Frequency) technology converts text data into sparse numerical feature vectors. TF-IDF determines the weight of each word in the text by calculating its importance, and then constructs the feature vector of each text. Then PCA dimension reduction is used to convert the sparse matrix output by TF-IDF into a dense matrix. In HTTP request packet analysis, the TF-IDF algorithm can be used to extract keywords or phrases in the request to help identify the characteristics of malicious requests.

[0065] FastText feature extraction uses the FastText model to embed words into texts and represent each text as a dense feature vector. FastText can capture the semantic information and contextual relationships of words, improving the expressiveness of text features. FastText can be used to learn the feature vector representation of HTTP request packets and convert the request content into a dense vector representation, which helps to perform more efficient model training and prediction.

[0066] The feature vectors generated based on TF-IDF and FastText are fused to obtain a richer and more comprehensive text feature representation. The fusion can be done in a simple concatenation method or a more complex weighted average strategy to improve the accuracy and generalization ability of the classification model.

[0067] Step 104: perform feature fusion on the first feature vector, the second feature vector and the target label to obtain a target feature vector.

[0068] The feature vectors generated based on TF-IDF and FastText and the target labels of the request methods are fused to obtain a richer and more comprehensive text feature representation. The fusion can adopt a simple splicing method or a more complex weighted average strategy to improve the accuracy and generalization ability of target feature vector attack detection.

[0069] Step 105: Perform attack detection based on the target feature vector to obtain a detection result.

[0070] The detection results include: whether there are malicious requests, if there are malicious requests, the type of malicious requests, and the confidence level corresponding to the type.

[0071] A method for detecting a Web application attack in an embodiment of the present application obtains an http request to be detected, wherein the http request includes a request method, and after preprocessing the http request, obtains target request information, wherein the target request information includes a target tag of the request method; the target request information is respectively input into a preset TF-IDF algorithm and a target FastTest model for feature extraction, and the corresponding first feature vector and second feature vector are respectively obtained; the first feature vector, the second feature vector, and the target tag are feature-fused to obtain a target feature vector; attack detection is performed based on the target feature vector to obtain a detection result. By fusing TF-IDF and FastText feature vectors to detect Web application attacks, the accuracy and efficiency of Web application attack detection can be effectively improved.

[0072] Optionally, performing attack detection based on the target feature vector to obtain a detection result includes:

[0073] The target feature vector is input into a preset target LightGBM detection model for attack detection to obtain the detection result of the http request; the target LightGBM detection model is trained based on a sample set, and the sample set includes multiple target feature vectors and attack types corresponding to each target feature vector.

[0074] Among them, LightGBM (Light Gradient Boosting Machine) is used as the trainer of the classification model. LightGBM is an efficient machine learning algorithm based on the gradient boosting framework, which can handle large-scale data sets and high-dimensional features, and provides fast and accurate classification capabilities. In the attack classification of HTTP request packets, LightGBM can be used to train and optimize the attack classification model. It can process high-dimensional sparse feature vectors and can effectively capture the patterns and types of malicious requests.

[0075] It can be understood that the above process uses TF-IDF technology to extract keywords or phrases from HTTP request packets, sparse word frequency vectors and generate dense matrix feature vectors through dimensionality reduction, uses FastText to convert HTTP request content into feature vectors generated by the FastText model, and concatenates the dense matrix feature vectors generated by TF-IDF and the feature vectors generated by FastText to form the final feature representation. The fused feature vectors are trained using machine learning algorithms such as LightGBM to build an attack classification model. The performance of the model is evaluated through cross-validation and other technologies, and in the actual environment, it is predicted whether a new HTTP request packet contains malicious attacks.

[0076] Traditional malicious attack detection usually relies on predefined rules and signatures to identify known attack types (such as SQL injection, XSS, etc.). This approach has obvious limitations when facing new and unknown attacks because they cannot adapt to the attackers' evolving strategies and techniques. By introducing the machine learning models TF-IDF, FastText, and LightGBM, a powerful HTTP request packet attack classification model can be built and applied to various network security scenarios to improve security incident response capabilities and the accuracy of malicious attack detection. It is not only a breakthrough in the detection of known attacks, but more importantly, it can effectively respond to unknown attacks and achieve more comprehensive and intelligent malicious attack detection and protection capabilities.

[0077] The detection method for Web application attacks provided in the embodiment of the present application can identify unknown attack types by learning a large amount of data, discovering and understanding the patterns and characteristics of new attacks. For example, even without clear rule definitions, the model can rely on hidden patterns in the data to identify potential malicious behaviors. And through continuous training and optimization, it can adapt to emerging attack technologies and strategies. Compared with traditional rule-based detection methods, it can respond to changing threats more flexibly.

[0078] Optionally, the http request further includes: a URL, a request header and a data body; after preprocessing the http request, the target request information is obtained, including:

[0079] The request method is labeled and encoded and decoded in sequence to obtain the target tag; the parameter set of the URL is extracted, and the parameter set is encoded and decoded to obtain the target URL, wherein the parameter set includes the parameter name in the URL and the parameter value corresponding to each parameter name; the field value in the request header is extracted, and the field value is encoded and decoded to obtain the target request header; the data body is encoded and decoded to obtain the target data body; the target tag, the target URL, the target request header and the target data body are sequentially concatenated to obtain the target request information.

[0080] In the actual execution process, the process of preprocessing the http request to obtain the target request information can be: each HTTP request data contains the following key parts: request method (method), URL (request address and parameters), request header (Headers) and data body (Body).

[0081] After labeling and encoding / decoding the request method, the target label is obtained and stored in the training data set as the feature dimension of the training data set. Figure 2 and Figure 3Mark part 1 in the middle.

[0082] Extract the parameter name and the value corresponding to the parameter name from the parameter part of the URL, encode and decode the name and value respectively, and restore the data to the real data. The cleaned URL data is defined as url_clean, which is the target URL. Figure 2 In the figure, id marked with 3 is the parameter name, 1%27+or+%27%27%3D%27 marked with 4 is the value corresponding to the parameter name, Submit marked with 5 is the parameter name, and Submit marked with 6 is the parameter value.

[0083] Extract the field values ​​in the request header, encode and decode them respectively, and restore the real data. The Referer field value needs to be processed separately in the URL, and the processed Referer parameter value and other request header parameter values ​​are combined into one data. The processed request header data is defined as heasers_clean, which is the target request header. Figure 2 The 8 parts marked in the figure include Referer, and the value part structure corresponding to Referer is consistent with the URL.

[0084] Encode and decode the parameters in the data body, and output the decoded body data, which is defined as body_clean. This is the target data body. Figure 3 Note 9 in the section.

[0085] The target tag, url_clean, heasers_clean and body_clean data are concatenated into a long text data defined as all_clean, which is the target request information.

[0086] Optionally, the target request information is input into a preset TF-IDF algorithm for feature extraction, including: using three feature extraction modes included in the TF-IDF algorithm to perform feature extraction on the target request information respectively to obtain three corresponding first sub-feature vectors; performing dimensionality reduction processing on the three first sub-feature vectors to obtain corresponding first reduced dimensionality sub-feature vectors; and concatenating the three first reduced dimensionality sub-feature vectors to obtain the first feature vector.

[0087] During the actual execution process, TF-IDF feature extraction is performed on the target request information, and PCA is used for dimensionality reduction. For example, the dimension after dimensionality reduction is 32. Finally, the feature vector after dimensionality reduction is converted into a two-dimensional array and stored in the training data set as the feature dimension of the training data set. In TF-IDF feature extraction, feature vector processing is performed in three modes: analyzer=word, analyzer=char, and analyzer=char_wb. PAC dimensionality reduction processing is performed accordingly to convert it into a dense matrix. The dimension of the first feature vector obtained in total is 96 dimensions. Of course, the dimension of the feature vector finally generated can be set according to the usage scenario, and this application does not make specific restrictions on this.

[0088] It should be noted that TF-IDF usually requires the input to be a collection or list of texts rather than a single text sample when performing feature extraction. However, the http request to be detected has only one piece of data, so we load the training data set to fit the text data, generate the word-level TF-IDF vectorizer Tf_word and the Svd_word object after PCA dimensionality reduction, and then hand over the http request to be detected to the Tf_word vectorizer and Svd_word object, so that the data to be predicted is put into a data set and the TF-IDF feature vector of this data is generated according to the data set context.

[0089] Among them, non-zero elements: non-zero elements refer to elements with actual values ​​in the matrix, that is, elements that are not equal to zero. For example, in a matrix, if the element at a certain position is not zero, it is called a non-zero element. Zero elements: zero elements refer to elements in the matrix with a value of zero. In many matrix applications, most elements may be zero, and such matrices are called sparse matrices. There are relatively few non-zero elements in a sparse matrix, and most elements are zero.

[0090] Sparse Matrix: In a sparse matrix, most elements are zero. Only non-zero elements and their position information are stored. This saves memory space, especially when the proportion of non-zero elements in the matrix is ​​very low (such as when the sparsity is high).

[0091] Dense Matrix: In a dense matrix, most elements are non-zero. Each element is stored, usually as a floating point number. Each element takes up memory space, so for large matrices, more memory is required. It is suitable for data with dense elements.

[0092] PCA (Principal Component Analysis): is a commonly used data dimensionality reduction technique, whose main purpose is to project data into a low-dimensional space through linear transformation while retaining as many data features as possible.

[0093] Tf_word: is a TfidfVectorizer object, which is used to calculate the word-level TF-IDF (TermFrequency-Inverse Document Frequency) features, fit the text data, and generate a word-level TF-IDF vectorizer. It is responsible for converting text data into word-level TF-IDF feature representations and converting text data into numerical feature vectors so that machine learning algorithms can process and analyze them.

[0094] Svd_word: is a PCA object used to reduce the high-dimensional word-level TF-IDF feature vector to a lower dimension. It is responsible for performing principal component analysis (PCA) on the generated word-level TF-IDF features to reduce the dimensionality of the features while retaining as much information as possible for subsequent processing and analysis.

[0095] Optionally, inputting the target request information into the target FastTest model for feature extraction includes:

[0096] After the target request information is input into the target FastTest model, the target FastTest model loads the training data set and generates a second initial feature vector of the target request information based on the training data set.

[0097] After generating the second initial feature vector of the target request information based on the training data set, the method further includes: performing dimensionality reduction processing on the second initial feature vector to obtain the second feature vector.

[0098] In the actual execution process, FastText feature extraction is performed on the target request information, and the extraction dimension is 100 (which can be customized according to the capitalization of the data). The extracted features are saved in the training data set, and the all_clean data is used to train the FastText model so that it can be used for text feature extraction in the later prediction data.

[0099] Finally, step 104 , feature fusion is performed on the first feature vector, the second feature vector and the target label to obtain a target feature vector.

[0100] The first feature vector and the second feature vector are directly connected to form a larger feature vector. TF-IDF generates a first feature vector with 32*3 dimensions (which can be customized according to the capitalization of the data), and FastText generates a second feature vector with 100 dimensions (which can be customized according to the capitalization of the data). Adding the target label, the final target feature vector can be 197 dimensions.

[0101] Optionally, before obtaining the http request to be detected, the method includes:

[0102] Obtain a training set, wherein the training set includes multiple target request information and attack types corresponding to each target request information, wherein the target request information is information after preprocessing of the http request; use the training set to train a preset initial FastTest model until the initial FastTest model meets preset conditions, thereby obtaining the target FastTest model.

[0103] For example, the attack type may also be referred to as a malicious behavior type, and the attack type may be: SQL injection, cross-site scripting attack, etc.

[0104] Optionally, before inputting the target feature vector into a preset target LightGBM detection model for attack detection, the method further includes:

[0105] Acquire the sample set; use the sample set to train an initial LightGBM detection model until the accuracy of the LightGBM detection model reaches a preset threshold, and then obtain the target LightGBM detection model.

[0106] In the actual execution process, the fused feature vector with classification labels is used as the sample set for model training. Stratified cross-validation of the sample set helps to ensure that the target variable category distribution in each training fold is similar to the category distribution in the overall dataset, thereby improving the accuracy and generalization ability of model training. In each fold, the dataset is split into a training set and a validation set based on the index. Tune the model's hyperparameters, set the accuracy, use cross-validation technology, divide the dataset into multiple folds, and adopt multi-classification. Save the model and save the trained model object as a .pkl format file. Each cross-validation fold corresponds to a model file.

[0107] The detection method of Web application attacks provided in the embodiment of the present application can effectively capture the semantic and structural information in HTTP requests by combining TF-IDF and FastText technology. TF-IDF is used to capture the importance of keywords, while FastText can process subwords and word order information, thereby improving the richness and expressiveness of features. In addition, the FastText model trained with the training set data is used to extract features from the predicted data: Richness of semantic information: If a trained FastText model is used, it can capture the semantic information and contextual relationships of words. Therefore, the features extracted by the model may be richer and more semantic, and can better express the meaning of the text, making up for the fact that TF-IDF can only capture word frequency or statistical information and lacks semantic associations between words. Generalization ability: A trained FastText model can usually generalize well to new text data because it has learned extensive semantic information and word relationships on a large-scale corpus. This means that the features extracted by the model may have better adaptability to unseen prediction data. The model can provide a richer and more semantic feature representation, which helps to improve the performance and generalization ability of natural language processing tasks. Although directly extracting features without using a model is simple and fast, it may be restricted by the limitations of traditional feature extraction methods when dealing with complex semantic tasks.

[0108] Advantages of the LightGBM model: Efficient training and prediction: As an optimized implementation of the gradient boosting decision tree, LightGBM has the ability to handle large-scale data and high-dimensional features. Its fast training speed and efficient memory utilization allow the model to be trained and predicted in a relatively short time, making it suitable for application scenarios with high real-time requirements. Attack detection capabilities: Ability to process and identify complex attack patterns and variants that may be difficult to capture through traditional rules or signature detection. Large amounts of data can be analyzed and abnormal patterns can be identified to discover hidden attack behaviors. In response to unknown attacks, it is possible to discover previously unknown forms of attack by learning the patterns and features of the data. This capability is particularly important for responding to increasingly complex and rapidly changing network attacks, and traditional methods may not be able to effectively respond to these new types of attacks.

[0109] like Figure 4 As shown, an embodiment of the present application provides a detection device for a Web application attack, the device comprising:

[0110] The acquisition module 11 is used to acquire the http request to be detected, wherein the http request includes a request method;

[0111] The processing module 12 is used to obtain target request information after preprocessing the http request, wherein the target request information includes a target tag of the request method;

[0112] An extraction module 13 is used to input the target request information into a preset TF-IDF algorithm and a target FastTest model for feature extraction, and obtain corresponding first feature vectors and second feature vectors respectively;

[0113] A fusion module 14 is used to perform feature fusion on the first feature vector, the second feature vector and the label code to obtain a target feature vector;

[0114] The detection module 15 is used to perform attack detection based on the target feature vector to obtain a detection result.

[0115] In one embodiment, the detection module 15 is specifically used for:

[0116] The target feature vector is input into a preset target LightGBM detection model for attack detection to obtain the detection result of the http request; the target LightGBM detection model is trained based on a sample set, and the sample set includes multiple target feature vectors and attack types corresponding to each target feature vector.

[0117] In one embodiment, the apparatus further comprises a training module 16, wherein the training module 16 is configured to:

[0118] Obtaining a training set, wherein the training set includes multiple target request information and attack types corresponding to each target request information, wherein the target request information is information after http request is preprocessed;

[0119] The preset initial FastTest model is trained using the training set until the initial FastTest model meets the preset conditions, thereby obtaining the target FastTest model.

[0120] In one embodiment, the training module 16 is specifically used for:

[0121] Acquire the sample set;

[0122] The initial LightGBM detection model is trained using the sample set until the accuracy of the LightGBM detection model reaches a preset threshold, thereby obtaining the target LightGBM detection model.

[0123] In one embodiment, the http request further includes: a URL, a request header and a data body; the processing module 12 is specifically used to:

[0124] After labeling and encoding / decoding the request method in sequence, the target label is obtained;

[0125] Extracting a parameter set of the URL, and obtaining a target URL after encoding and decoding the parameter set, wherein the parameter set includes parameter names in the URL and parameter values ​​corresponding to each parameter name;

[0126] Extracting the field value in the request header, and performing encoding and decoding processing on the field value to obtain the target request header;

[0127] Performing encoding and decoding processing on the data body to obtain a target data body;

[0128] The target request method, the target URL, the target request header and the target data body are sequentially concatenated to obtain the target request information.

[0129] In one embodiment, the extraction module 13 is specifically used for:

[0130] Using the three feature extraction modes included in the TF-IDF algorithm, feature extraction is performed on the target request information respectively to obtain three corresponding first sub-feature vectors;

[0131] Performing dimensionality reduction processing on the three first sub-feature vectors to obtain corresponding first reduced-dimensionality sub-feature vectors;

[0132] The first feature vector is obtained by concatenating the three first dimension-reduced sub-feature vectors.

[0133] In one embodiment, the extraction module 13 is specifically used for:

[0134] After inputting the target request information into the target FastTest model, the target FastTest model loads the training data set and generates a second initial feature vector of the target request information based on the training data set;

[0135] The extraction module 13 is further used to obtain the second feature vector after performing dimensionality reduction processing on the second initial feature vector.

[0136] The Web application attack detection device provided in this embodiment can execute the above-mentioned Web application attack detection method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail here.

[0137] The specific definition of the detection device for Web application attacks can be found in the definition of the detection method for Web application attacks in the above text, and will not be repeated here. Each module in the above-mentioned detection device for Web application attacks can be implemented in whole or in part by software, hardware, and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor of the electronic device in the form of hardware, or can be stored in the memory of the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0138] The execution subject of the Web application attack detection method provided in the embodiment of the present application may be an electronic device, which may be a computer device, a terminal device, a server or a server cluster, and the embodiment of the present application does not specifically limit this.

[0139] Figure 5 This is a schematic diagram of the internal structure of an electronic device provided in an embodiment of the present application. Figure 5 As shown, the electronic device includes a processor and a memory connected via a system bus. The processor is used to provide computing and control capabilities. The memory may include a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The computer program can be executed by the processor to implement the steps of the detection method for Web application attacks provided in the above embodiments. The internal memory provides a cached operating environment for the operating system and the computer program in the non-volatile storage medium.

[0140] Those skilled in the art will understand that Figure 5 The internal structure diagram of the electronic device shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0141] In another embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for detecting Web application attacks in the embodiment of the present application are implemented.

[0142] In another embodiment of the present application, a computer program product is further provided. The computer program product includes computer instructions. When the computer instructions execute the steps of the method for detecting Web application attacks in the method flow shown in the above method embodiment,

[0143] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer execution instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more servers that can be integrated with a medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0144] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0145] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for detecting a Web application attack, characterized in that: The method comprises: Obtaining an http request to be detected, wherein the http request includes a request method; After preprocessing the http request, target request information is obtained, wherein the target request information includes a target tag of the request method; Input the target request information into a preset TF-IDF algorithm and a target FastTest model respectively for feature extraction, and obtain corresponding first feature vectors and second feature vectors respectively; Performing feature fusion on the first feature vector, the second feature vector, and the target label to obtain a target feature vector; Attack detection is performed based on the target feature vector to obtain a detection result.

2. The method according to claim 1, characterized in that The attack detection is performed based on the target feature vector to obtain a detection result, including: Input the target feature vector into the preset target LightGBM detection model for attack detection to obtain the detection result of the http request; Among them, the target LightGBM detection model is obtained based on the training of the sample set, and the sample set includes multiple target feature vectors and the attack type corresponding to each target feature vector.

3. The method according to claim 1, characterized in that Before obtaining the http request to be detected, the method includes: Obtaining a training set, wherein the training set includes multiple target request information and attack types corresponding to each target request information, wherein the target request information is information after http request is preprocessed; The preset initial FastTest model is trained using the training set until the initial FastTest model meets the preset conditions, thereby obtaining the target FastTest model.

4. The method according to claim 2, characterized in that: Before inputting the target feature vector into a preset target LightGBM detection model for attack detection, the method further includes: Acquire the sample set; The initial LightGBM detection model is trained using the sample set until the accuracy of the LightGBM detection model reaches a preset threshold, thereby obtaining the target LightGBM detection model.

5. The method according to claim 1, characterized in that The http request also includes: URL, request header and data body; after preprocessing the http request, the target request information is obtained, including: After labeling and encoding / decoding the request method in sequence, the target label is obtained; Extracting a parameter set of the URL, and obtaining a target URL after encoding and decoding the parameter set, wherein the parameter set includes parameter names in the URL and parameter values ​​corresponding to each parameter name; Extracting the field value in the request header, and performing encoding and decoding processing on the field value to obtain the target request header; Performing encoding and decoding processing on the data body to obtain a target data body; The target tag, the target URL, the target request header and the target data body are sequentially concatenated to obtain the target request information.

6. The method according to claim 1, characterized in that The target request information is input into a preset TF-IDF algorithm for feature extraction, including: Using the three feature extraction modes included in the TF-IDF algorithm, feature extraction is performed on the target request information respectively to obtain three corresponding first sub-feature vectors; Performing dimensionality reduction processing on the three first sub-feature vectors to obtain corresponding first reduced-dimensionality sub-feature vectors; The first feature vector is obtained by concatenating the three first dimension-reduced sub-feature vectors.

7. The method according to claim 3, characterized in that Inputting the target request information into the target FastTest model for feature extraction, including: After inputting the target request information into the target FastTest model, the target FastTest model loads the training data set and generates a second initial feature vector of the target request information based on the training data set; After generating the second initial feature vector of the target request information based on the training data set, the method further includes: performing dimensionality reduction processing on the second initial feature vector to obtain the second feature vector.

8. A detection device for Web application attacks, characterized in that: The device comprises: An acquisition module, used for acquiring an http request to be detected, wherein the http request includes a request method; A processing module, used for pre-processing the http request to obtain target request information, wherein the target request information includes a target tag of the request method; An extraction module, used for inputting the target request information into a preset TF-IDF algorithm and a target FastTest model for feature extraction, respectively, to obtain corresponding first feature vectors and second feature vectors; A fusion module, used for performing feature fusion on the first feature vector, the second feature vector and the label code to obtain a target feature vector; The detection module is used to perform attack detection based on the target feature vector to obtain a detection result.

9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the method for detecting a Web application attack according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the method for detecting a Web application attack according to any one of claims 1 to 7 is implemented.

Images