Injection attack detection method and device

Abstract

The invention discloses an injection attack detection method and device. The method comprises the following steps: acquiring a network address to be detected; and inputting the to-be-detected network address into the detection model to obtain a detection result of the to-be-detected network address output by the detection model. Wherein the detection model is obtained by training after semantic codes of the network address and word vector features of the network address are fused, and the detection result represents whether the network address to be detected has aggressiveness or not. And if the detection result shows that the network address to be detected has aggressiveness, triggering an alarm. The semantic information and word vector features of the network address are combined, threat detection is performed, the understanding ability of a detection model for the network address is improved, and the accuracy of injection attack detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an injection attack detection method and device. Background Art

[0002] Nowadays, most companies provide Web services on the public network. While open Web services provide convenience, they also make them more vulnerable to hacker attacks. Injection attacks are one of the main threats facing Web applications.

[0003] Currently, the Web attack detection function is mainly integrated into the Web Application Firewall (WAF) to detect Web traffic in real time. Specifically, it uses data-driven solutions for detection; uses machine learning models for feature extraction and detection; and uses unsupervised learning for anomaly detection. However, the above solutions are prone to misjudgment and are not conducive to daily operations and maintenance.

[0004] Therefore, how to improve the accuracy of injection attack detection is a problem that needs to be solved urgently. Summary of the invention

[0005] An embodiment of the present invention provides an injection attack detection method and device, which is used to improve the detection model's ability to understand the network address by combining the semantic information of the network address with the word vector features, thereby improving the accuracy of injection attack detection.

[0006] In a first aspect, an embodiment of the present invention provides an injection attack detection method, comprising:

[0007] Get the network address to be detected;

[0008] Inputting the network address to be detected into the detection model, and obtaining the detection result of the network address to be detected output by the detection model; the detection model is trained based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, and the detection result represents whether the network address to be detected is offensive;

[0009] If the detection result indicates that the network address to be detected is aggressive, an alarm is triggered.

[0010] In the above technical solution, the network address to be detected can be obtained from network traffic data. The detection model is obtained by training based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, that is, the semantic information of the network address and the word vector information are combined for detection. The detection result can be a classification result of the network address, which classifies the network address as aggressive or non-aggressive. Therefore, the detection result represents whether the network address to be detected is aggressive. After the detection result indicates that it is aggressive, an alarm is issued to the monitoring personnel, thereby improving the accuracy of injection attack detection.

[0011] Optionally, the detection model is obtained by training based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, including:

[0012] Acquire a network address set, wherein the network address set includes an offensive network address and a non-aggressive network address;

[0013] Preprocessing the network addresses in the network address set to obtain a training set;

[0014] For any preprocessed network address in the training set, encoding is performed according to different characters in the preprocessed network address to obtain a semantic encoding of the preprocessed network address;

[0015] Extracting features of different characters in the preprocessed network address and vectorizing them to obtain word vector features of the preprocessed network address;

[0016] The neural network model is trained according to the semantic coding and word vector features of the network address preprocessed in the training set to obtain a detection model.

[0017] In the above technical solution, the network addresses in the network address set can be network addresses in attack traffic logs and normal traffic logs, or network addresses in public data sets and real online traffic data, or network addresses of artificially constructed attacks. The preprocessed network addresses are encoded and feature extracted respectively to obtain the semantic encoding and word vector features of each preprocessed network address. Training is performed based on the semantic encoding and word vector features of each preprocessed network address to obtain a detection model. This improves the detection model's ability to understand network addresses, thereby improving the accuracy of injection attack detection.

[0018] Optionally, preprocessing the network addresses in the network address set includes:

[0019] For any network address in the network address set, the network address is decoded, and a first character in the network address is filtered to obtain a filtered network address; the first character indicates a character in the network address that cannot constitute an attack;

[0020] Based on regular extraction, the filtered network address is segmented and generalized to obtain the pre-processed network address.

[0021] In the above technical solution, after preprocessing the network address, the hidden characters will be displayed, and the vocabulary size and model complexity will be reduced.

[0022] Optionally, encoding different characters in the preprocessed network address to obtain a semantic encoding of the preprocessed network address includes:

[0023] Calculating the encoding of the types of characters in the network address after the preprocessing to obtain different types of structural position encodings; the types include resource paths, identifiers, parameter names and parameter values;

[0024] Encoding the characters in the preprocessed network address based on the type of each character in the preprocessed network address to obtain relative position codes of different characters;

[0025] Based on the types to which different characters in the preprocessed network address belong, the relative position codes of the different characters are added to the structural position codes of the different types to obtain the semantic code of the preprocessed network address.

[0026] Optionally, the neural network model is trained according to the semantic encoding and word vector features of the preprocessed network addresses in the training set to obtain a detection model, including:

[0027] According to the semantic coding of each preprocessed network address in the training set, a semantic embedding matrix of each preprocessed network address in the training set is calculated;

[0028] According to the word vector features of each preprocessed network address in the training set, a word vector embedding matrix of each preprocessed network address in the training set is calculated;

[0029] The semantic embedding matrix of each preprocessed network address in the training set and the word vector embedding matrix are fused, and the neural network model is trained to obtain a detection model.

[0030] In a second aspect, an embodiment of the present invention provides an injection attack detection device, comprising:

[0031] An acquisition module, used to acquire the network address to be detected;

[0032] A processing module, used for inputting the network address to be detected into a detection model, and obtaining a detection result of the network address to be detected output by the detection model; the detection model is trained based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, and the detection result represents whether the network address to be detected is offensive;

[0033] If the detection result indicates that the network address to be detected is aggressive, an alarm is triggered.

[0034] Optionally, the processing module is specifically used for:

[0035] Acquire a network address set, wherein the network address set includes an offensive network address and a non-aggressive network address;

[0036] Preprocessing the network addresses in the network address set to obtain a training set;

[0037] For any preprocessed network address in the training set, encoding is performed according to different characters in the preprocessed network address to obtain a semantic encoding of the preprocessed network address;

[0038] Extracting features of different characters in the preprocessed network address and vectorizing them to obtain word vector features of the preprocessed network address;

[0039] The neural network model is trained according to the semantic coding and word vector features of the network address preprocessed in the training set to obtain a detection model.

[0040] Optionally, the processing module is specifically used for:

[0041] For any network address in the network address set, the network address is decoded, and a first character in the network address is filtered to obtain a filtered network address; the first character indicates a character in the network address that cannot constitute an attack;

[0042] Based on regular extraction, the filtered network address is segmented and generalized to obtain the pre-processed network address.

[0043] Optionally, the processing module is specifically used for:

[0044] Calculating the encoding of the types of characters in the network address after the preprocessing to obtain different types of structural position encodings; the types include resource paths, identifiers, parameter names and parameter values;

[0045] Encoding the characters in the preprocessed network address based on the type of each character in the preprocessed network address to obtain relative position codes of different characters;

[0046] Based on the types to which different characters in the preprocessed network address belong, the relative position codes of the different characters are added to the structural position codes of the different types to obtain the semantic code of the preprocessed network address.

[0047] Optionally, the processing module is specifically used for:

[0048] According to the semantic coding of each preprocessed network address in the training set, a semantic embedding matrix of each preprocessed network address in the training set is calculated;

[0049] According to the word vector features of each preprocessed network address in the training set, a word vector embedding matrix of each preprocessed network address in the training set is calculated;

[0050] The semantic embedding matrix of each preprocessed network address in the training set and the word vector embedding matrix are fused, and the neural network model is trained to obtain a detection model.

[0051] In a third aspect, an embodiment of the present invention further provides a computer device, including:

[0052] A memory for storing program instructions;

[0053] The processor is used to call the program instructions stored in the memory and execute the injection attack detection method according to the obtained program.

[0054] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned injection attack detection method.

[0055] In a fifth aspect, an embodiment of the present invention further provides a computer program product, wherein the computer program product includes an executable program, and the executable program is executed by a processor to implement the above-mentioned injection attack detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0057] Figure 1 A schematic diagram of a system architecture provided by an embodiment of the present invention;

[0058] Figure 2 A flowchart of an injection attack detection method provided by an embodiment of the present invention;

[0059] Figure 3 A schematic diagram of relative position coding provided by an embodiment of the present invention;

[0060] Figure 4 A schematic diagram of the structure of an injection attack detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] The application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions protected by the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those of ordinary skill in the art that with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. The terms "first" and "second" in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more.

[0063] Before introducing an injection attack detection method provided by an embodiment of the present application, in order to facilitate understanding, the following background technology and terms involved in the embodiment of the present application are first introduced.

[0064] Position Embedding: Position embedding is an additional embedding vector that represents the position information of each position in the input sequence. In Transformer, position embedding uses different mathematical functions (such as sine and cosine functions) to map the position information to a continuous vector space.

[0065] Transformer: This model is a neural network model based on the self-attention mechanism proposed by Google and is used to process sequence data. It contains multiple layers of encoders and decoders, and each layer consists of multiple attention mechanism modules and feedforward neural network modules.

[0066] Self-attention mechanism: The core of the Transformer model is the self-attention mechanism, which assigns a weight to each position in each input sequence and then outputs these weighted position vectors.

[0067] URL (Uniform Resource Locator): On the WWW, every information resource has a unified address on the Internet. This address is called URL, which is the uniform resource locator of the WWW, that is, the network address.

[0068] Nowadays, most companies provide web services on the public network. While open web services provide convenience, they also make them more vulnerable to hacker attacks. According to the OWASP report, injection attacks are one of the main threats facing web applications, such as cross-site scripting (XSS), SQL injection, server-side code injection, etc. Once hacked, the company will face the threat of sensitive data leakage and service unavailability. Therefore, web attack detection has become an important means to solve network security problems.

[0069] Currently, the Web attack detection function is mainly integrated into the Web Application Firewall (WAF) to detect Web traffic in real time. Traditional WAFs are often experience-driven and rely mainly on rules written by security experts. Although rules are generally more effective and easy to use, they have limited detection capabilities for unknown attacks and require high labor costs for rule maintenance. Recently, some WAF vendors have begun to use data-driven solutions, such as using Libinjection for SQL injection detection. This solution extracts features through syntax trees and learns malicious features from attack samples for detection. There are also many studies that use machine learning models for feature extraction and detection, such as using deep learning models CNN and LSTM for attack detection and classification, and have achieved good detection results. There are also literatures that propose the use of unsupervised learning for anomaly detection, such as using hidden Markov algorithms or Seq2Seq models to reconstruct URLs to detect anomalies in requests. Compared with regular expression-based rule detection, machine learning model detection has better generalization performance and a higher probability of detecting unknown threats. However, existing machine learning detection solutions have some problems in practical applications:

[0070] 1. Failure to utilize URL semantic information can easily lead to false positives, which is not conducive to daily operations and maintenance;

[0071] 2. Most machine learning models are black box methods with poor interpretability;

[0072] Figure 1A system architecture applicable to an embodiment of the present invention is exemplarily shown. The system architecture includes a server 100 . The server 100 may include a processor 110 , a communication interface 120 , and a memory 130 .

[0073] The communication interface 120 is used to transmit data.

[0074] The processor 110 is the control center of the server 100, and uses various interfaces and routes to connect various parts of the entire server 100, and executes various functions of the server 100 and processes data by running or executing software programs and / or modules stored in the memory 130, and calling data stored in the memory 130. Optionally, the processor 110 may include one or more processing units.

[0075] The memory 130 can be used to store software programs and modules. The processor 110 executes various functional applications and data processing by running the software programs and modules stored in the memory 130. The memory 130 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, etc.; the data storage area can store data created according to business processing, etc. In addition, the memory 130 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0076] It should be noted that the above Figure 1 The structure shown is only an example and is not limited to this embodiment of the present invention.

[0077] Based on the above description, Figure 2 A schematic flow chart of an injection attack detection method provided by an embodiment of the present invention is exemplarily shown, and the flow chart can be executed by an injection attack detection device.

[0078] like Figure 2 As shown in the figure, the process specifically includes:

[0079] Step 210: Obtain the network address to be detected.

[0080] In the embodiment of the present invention, the network address to be detected may be obtained from network traffic data, and the method for obtaining the network address is not specifically limited herein.

[0081] Step 220, input the network address to be detected into the detection model, and obtain the detection result of the network address to be detected output by the detection model; the detection model is trained based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, and the detection result represents whether the network address to be detected is aggressive.

[0082] In an embodiment of the present invention, after obtaining the network address to be detected, the network address will be input into the detection model to obtain the detection result of the detection model. Among them, the detection model is obtained by training based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, that is, the semantic information of the network address and the word vector information are combined for detection. The detection result can be the classification result of the network address to be detected, that is, the network address is classified as aggressive and non-aggressive, so the detection result can characterize whether the network address to be detected is aggressive. In some embodiments, the detection result can also be the offensiveness scoring result of the network address to be detected. If the offensiveness scoring result exceeds the threshold, it means that the network address is offensive. Therefore, the content of the detection result is not specifically limited here, as long as it can characterize whether the network address is aggressive.

[0083] The method for establishing the detection model specifically includes: obtaining a network address set. The network address set includes offensive network addresses and non-aggressive network addresses. Exemplarily, the network addresses in the network address set can be network addresses in attack traffic logs and normal traffic logs, or network addresses in public data sets and real online traffic data, or artificially constructed attack network addresses. It can be understood that the detection method in the present invention is mainly aimed at detecting network addresses, so the acquired training data needs to ensure that the attack payload is located in the network address.

[0084] Then, the network addresses in the network address set are preprocessed to obtain a training set. Specifically, for any network address in the network address set, the network address is decoded, and the first character in the network address is filtered to obtain the filtered network address. Among them, the decoding method may include one or more of the following: Base64 decoding, URL decoding, Html decoding, and Unicode decoding. Exemplarily, the original network address [ / test? i=1234&v=abMTAgYW5kIDE9MQ==&e=test] is decoded to obtain the decoded network address [ / test? i=1234&v=ab10 and 1=1&e=test]. It can be understood that decoding the network address can restore the attack fragment information in the network address to the greatest extent. The first character indicates the character in the network address that cannot constitute an attack. Filtering out the first character in the network address can reduce subsequent computing resource consumption.

[0085] Based on regular extraction, word segmentation and generalization are performed on the filtered network addresses to obtain the network addresses after preprocessing. Specifically, word segmentation is performed on the filtered network addresses based on regular extraction, and special characters are generalized. Exemplarily, the regular expressions used include special characters, character-digit combinations, hexadecimal-encoded strings, Chinese characters, etc. The generalization rules are shown in the following table:

[0086]

[0087]

[0088] For example, after generalizing the request fragment [v = ab10 and 1 = 1\x42你好] according to the above table, it becomes: v = ab10and <num> ＝ <num> <hex> <chinese>It can be understood that generalizing special strings can reduce the size of the vocabulary and reduce the complexity of the model. The general syntax format of a network address is: [protocol type]: / / [server address]:[port number] / [resource level UNIX file path][file name]? [query]#[fragment ID], and the final format after preprocessing is [resource path]? [parameter name]=[parameter value]&[parameter name]=[parameter value].

[0089] For any preprocessed network address in the training set, encode according to the different characters in the preprocessed network address to obtain the semantic encoding of the preprocessed network address. Specifically, the encoding of the type of characters in the preprocessed network address is calculated to obtain different types of structural position encodings. Among them, as shown in the above content, it can be seen that the types in the preprocessed network address include resource paths, identifiers, parameter names and parameter values. The identifier refers to the structural separator in the network address: [? =&], etc. Exemplarily, the arrays corresponding to the four types are [path, flag, args_name, args_value], and the structural position encoding of each type is shown in the following formula:

[0090] POS structure =2 10·n

[0091] Among them, pos structure is the structure position code, and n is the index of the type in the array. For example, the index of the resource path in the array is 0, and its structure position code is 2^(10·0)=1.

[0092] Then, the characters in the preprocessed network address are encoded based on the type of each character in the preprocessed network address to obtain relative position codes of different characters. The position codes of different types of characters need to be calculated from 0. For example, Figure 3 As shown, Figure 3 A schematic diagram of a relative position encoding provided as an example in an embodiment of the present invention. For example, the network address [ / test? i=1234&v=ab10 and 1=1&e=test] is generalized into [ / ,test,? ,i= <num>,v,=,ab10,and, <num> ,＝, <num>,e,=,test]. The figure shows the result of relative position encoding for the network address after the above word segmentation generalization. The circle in the figure represents the encoding of the character whose type is identifier, the square represents the encoding of the character whose type is resource path, the diamond represents the encoding of the character whose type is parameter name, and the triangle represents the encoding of the character whose type is parameter value.

[0093] Based on the types of different characters in the preprocessed network address, the relative position codes of different characters are added to the structural position codes of different types to obtain the semantic code of the preprocessed network address. Specifically, the relative position code of characters of the identifier type is added to the structural position code of the identifier, the relative position code of characters of the resource path type is added to the structural position code of the resource path, the relative position code of characters of the parameter name type is added to the structural position code of the parameter name, and the relative position code of characters of the parameter value type is added to the structural position code of the parameter value.

[0094] Then, features of different characters in the preprocessed network address are extracted and vectorized to obtain word vector features of the preprocessed network address.

[0095] Finally, the neural network model is trained according to the semantic coding and word vector features of the preprocessed network addresses in the training set to obtain a detection model. Specifically, according to the semantic coding of each preprocessed network address in the training set, the semantic embedding matrix of each preprocessed network address in the training set is calculated. Exemplarily, the semantic embedding matrix is ​​calculated based on the following formula:

[0096]

[0097] Among them, pos semantic is the semantic encoding of the network address, i is the dimension of the embedding vector, and d model Represents the total dimension of the embedding vector. The total dimension of the embedding vector is a value set based on experience, such as 128 or 512, and is not specifically limited here.

[0098] According to the word vector features of each preprocessed network address in the training set, the word vector embedding matrix of each preprocessed network address in the training set is calculated.

[0099] The semantic embedding matrix and the word vector embedding matrix of each preprocessed network address in the training set are fused, and the neural network model is trained to obtain a detection model. Exemplarily, after the semantic embedding matrix and the word vector embedding matrix of each preprocessed network address in the training set are fused, a multi-layer transformer encoder is used to extract features, and then prediction is performed through the classification layer, the transformer neural network model is trained, and the parameters are adjusted to obtain a detection model.

[0100] Step 230: If the detection result indicates that the network address to be detected is aggressive, an alarm is triggered.

[0101] In the embodiment of the present invention, after obtaining the detection result of the network address to be detected, if the detection result indicates that the network address to be detected is aggressive, an alarm is triggered. If the detection result indicates that the network address to be detected is not aggressive, the next network address to be detected is detected.

[0102] In an embodiment of the present invention, by combining the semantic encoding of the network address with the word vector features, model training is performed to obtain a detection model, which improves the detection model's understanding of the structure of the network address and improves the accuracy of injection attack detection.

[0103] Based on the same technical concept, Figure 4 The schematic diagram of the structure of an injection attack detection device provided by an embodiment of the present invention is exemplarily shown, and the device can execute the process of the injection attack detection method.

[0104] like Figure 4 As shown, the device specifically includes:

[0105] An acquisition module 410 is used to acquire a network address to be detected;

[0106] The processing module 420 is used to input the network address to be detected into the detection model, and obtain the detection result of the network address to be detected output by the detection model; the detection model is trained based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, and the detection result represents whether the network address to be detected is offensive;

[0107] If the detection result indicates that the network address to be detected is aggressive, an alarm is triggered.

[0108] Optionally, the processing module 420 is specifically used for:

[0109] Acquire a network address set, wherein the network address set includes an offensive network address and a non-aggressive network address;

[0110] Preprocessing the network addresses in the network address set to obtain a training set;

[0111] For any preprocessed network address in the training set, encoding is performed according to different characters in the preprocessed network address to obtain a semantic encoding of the preprocessed network address;

[0112] Extracting features of different characters in the preprocessed network address and vectorizing them to obtain word vector features of the preprocessed network address;

[0113] The neural network model is trained according to the semantic coding and word vector features of the network address preprocessed in the training set to obtain a detection model.

[0114] Optionally, the processing module 420 is specifically used for:

[0115] For any network address in the network address set, the network address is decoded, and a first character in the network address is filtered to obtain a filtered network address; the first character indicates a character in the network address that cannot constitute an attack;

[0116] Based on regular extraction, the filtered network address is segmented and generalized to obtain the pre-processed network address.

[0117] Optionally, the processing module 420 is specifically used for:

[0118] Calculating the encoding of the types of characters in the network address after the preprocessing to obtain different types of structural position encodings; the types include resource paths, identifiers, parameter names and parameter values;

[0119] Encoding the characters in the preprocessed network address based on the type of each character in the preprocessed network address to obtain relative position codes of different characters;

[0120] Based on the types to which different characters in the preprocessed network address belong, the relative position codes of the different characters are added to the structural position codes of the different types to obtain the semantic code of the preprocessed network address.

[0121] Optionally, the processing module 420 is specifically used for:

[0122] According to the semantic coding of each preprocessed network address in the training set, a semantic embedding matrix of each preprocessed network address in the training set is calculated;

[0123] According to the word vector features of each preprocessed network address in the training set, a word vector embedding matrix of each preprocessed network address in the training set is calculated;

[0124] The semantic embedding matrix of each preprocessed network address in the training set and the word vector embedding matrix are fused, and the neural network model is trained to obtain a detection model.

[0125] Based on the same technical concept, an embodiment of the present invention further provides a computer device, including:

[0126] A memory for storing program instructions;

[0127] The processor is used to call the program instructions stored in the memory and execute the injection attack detection method according to the obtained program.

[0128] Based on the same technical concept, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above injection attack detection method.

[0129] Based on the same technical concept, an embodiment of the present invention further provides a computer program product, characterized in that the computer program product includes an executable program, and the executable program is executed by a processor to perform the injection attack detection method.

[0130] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0131] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0132] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0133] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0134] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.< / num> < / num> < / num> < / chinese> < / hex> < / num> < / num>

Claims

1. A method for detecting injection attacks, characterized in that: include: Get the network address to be detected; Inputting the network address to be detected into the detection model, and obtaining the detection result of the network address to be detected output by the detection model; The detection model is obtained by training based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, and the detection result represents whether the network address to be detected is offensive; If the detection result indicates that the network address to be detected is aggressive, an alarm is triggered.

2. The method according to claim 1, characterized in that The detection model is obtained by training based on the fusion of the semantic encoding of the network address and the word vector features of the network address, and includes: Acquire a network address set, wherein the network address set includes an offensive network address and a non-aggressive network address; Preprocessing the network addresses in the network address set to obtain a training set; For any preprocessed network address in the training set, encoding is performed according to different characters in the preprocessed network address to obtain a semantic encoding of the preprocessed network address; Extracting features of different characters in the preprocessed network address and vectorizing them to obtain word vector features of the preprocessed network address; The neural network model is trained according to the semantic coding and word vector features of the network address preprocessed in the training set to obtain a detection model.

3. The method according to claim 2, characterized in that Preprocessing the network addresses in the network address set includes: For any network address in the network address set, the network address is decoded, and a first character in the network address is filtered to obtain a filtered network address; the first character indicates a character in the network address that cannot constitute an attack; Based on regular extraction, the filtered network address is segmented and generalized to obtain the pre-processed network address.

4. The method according to claim 2, characterized in that Encoding different characters in the preprocessed network address to obtain the semantic encoding of the preprocessed network address includes: Calculating the encoding of the types of characters in the network address after the preprocessing to obtain different types of structural position encodings; the types include resource paths, identifiers, parameter names and parameter values; Encoding the characters in the preprocessed network address based on the type of each character in the preprocessed network address to obtain relative position codes of different characters; Based on the types to which different characters in the preprocessed network address belong, the relative position codes of the different characters are added to the structural position codes of the different types to obtain the semantic code of the preprocessed network address.

5. The method according to claim 2, characterized in that The neural network model is trained according to the semantic coding and word vector features of the network address preprocessed in the training set to obtain a detection model, including: According to the semantic coding of each preprocessed network address in the training set, a semantic embedding matrix of each preprocessed network address in the training set is calculated; According to the word vector features of each preprocessed network address in the training set, a word vector embedding matrix of each preprocessed network address in the training set is calculated; The semantic embedding matrix of each preprocessed network address in the training set is fused with the word vector embedding matrix, and the neural network model is trained to obtain a detection model.

6. An injection attack detection device, characterized in that: include: An acquisition module, used to acquire the network address to be detected; A processing module, used for inputting the network address to be detected into a detection model, and obtaining a detection result of the network address to be detected output by the detection model; the detection model is trained based on the fusion of the semantic encoding of the network address and the word vector feature of the network address, and the detection result represents whether the network address to be detected is offensive; If the detection result indicates that the network address to be detected is aggressive, an alarm is triggered.

7. The device according to claim 6, characterized in that The processing module is specifically used for: Acquire a network address set, wherein the network address set includes an offensive network address and a non-aggressive network address; Preprocessing the network addresses in the network address set to obtain a training set; For any preprocessed network address in the training set, encoding is performed according to different characters in the preprocessed network address to obtain a semantic encoding of the preprocessed network address; Extracting features of different characters in the preprocessed network address and vectorizing them to obtain word vector features of the preprocessed network address; The neural network model is trained according to the semantic coding and word vector features of the network address preprocessed in the training set to obtain a detection model.

8. A computer device, characterized in that: include: A memory for storing program instructions; A processor, configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 5 according to the obtained program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method according to any one of claims 1 to 5.

10. A computer program product, characterized in that The computer program product comprises an executable program, which is executed by a processor to implement the method according to any one of claims 1 to 5.

Images