Network request processing method, device, equipment, medium and program product

Abstract

The embodiment of the invention provides a network request processing method and device, equipment, a medium and a program product. The method can be used in the network security technology field. The method comprises the following steps: determining at least one target model for network request identification from a pre-trained classification model, then intercepting a to-be-identified network request sent to a server, and obtaining corresponding to-be-detected information based on the network request; inputting the to-be-detected information into the target model, and outputting a corresponding detection result; and finally, processing the network request based on a detection result. According to the method, the problem that an XSS detection method in the prior art lacks detection and defense capabilities for unknown XSS attacks is solved, the accuracy and efficiency of network security protection are effectively improved, the false alarm rate and the missing report rate are reduced, and therefore the defense effect of network programs for defending the XSS attacks is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network request processing method, device, equipment, medium and program product. Background Art

[0002] XSS vulnerabilities (XSS stands for Cross-Site Scripting in English) are major influencers of WEB security vulnerabilities and have long been ranked in the top three in network application security risk reports. Their attack targets are users of Web programs. XSS attacks are usually difficult to fully defend against due to factors such as developers' lack of attention, differences in browser security mechanisms, different programming language features, server configuration differences, and diverse attack methods. The existence of XSS vulnerabilities poses a serious threat to corporate and personal privacy information, but a unified and effective defense system has not yet been formed.

[0003] Related technologies, XSS detection methods usually rely on rules, features or pattern matching, but such methods can only process network requests corresponding to identified XSS attacks, lack detection and defense against unknown XSS attacks, and are prone to missed reports, making the defense capabilities against XSS attacks insufficient. Summary of the invention

[0004] The embodiments of the present application provide a network request processing method, apparatus, device, medium and program product to solve the problem that the XSS detection method in the related art lacks the ability to detect and defend against unknown XSS attacks, so as to improve the defense effect of network programs against XSS attacks.

[0005] In a first aspect, an embodiment of the present application provides a network request processing method, comprising the following steps:

[0006] Determine at least one target model for network request recognition from pre-trained classification models, the classification models include a primary classification model and a secondary classification model, the recognition accuracy of the primary classification model is higher than that of the secondary classification model, and the classification model is trained based on data that does not contain attack behaviors and data that contains attack behaviors;

[0007] Intercept the network request to be identified sent to the server, and obtain the corresponding information to be detected based on the network request;

[0008] Input the information to be detected into the target model and output the corresponding detection results;

[0009] Based on the detection results, the network request is processed.

[0010] In one possible implementation, at least one target model for performing network request recognition is determined from pre-trained classification models, including: determining a primary classification model as a target model; or, determining a secondary classification model as a target model; or, determining both the primary classification model and the secondary classification model as target models.

[0011] In a possible implementation, a network request to be identified that is sent to a server is intercepted, and corresponding information to be detected is obtained based on the network request, including: intercepting a network request to be identified that is sent to a server; extracting key information in the network request, the key information including a request line, a request header, and parameters and values ​​in a request body in the network request; determining associated information of the key information based on a source of the network request, the associated information also including tag keywords corresponding to the network request, descriptive keywords, and parameter values ​​in a request body in a network request message; and concatenating the key information and the associated information to obtain the information to be detected.

[0012] In a possible implementation, the network request is processed based on the detection result, including: if the detection result is that the network request is an attack behavior, blocking the network request; or if the detection result is that the network request is not an attack behavior, sending the network request to the server.

[0013] In one possible implementation, the classification model is trained in the following manner: obtaining general model training data that does not contain attack behaviors, special domain data associated with data in a server, and malicious data that contains attack behaviors; adding labels to the general model training data, special domain data, and malicious data according to the type of data, and using the labeled data as training samples; generating the training samples into corresponding training sets and test sets based on the number of classification models; inputting the training set into a pre-trained language model, training the pre-trained language model, and obtaining a trained model; extracting the output result of the last encoding layer in the trained model, and performing cluster analysis based on the node embedding information in the output result to obtain at least one cluster center; inputting the test set into the trained model respectively, and determining the trained model with the highest recognition accuracy as the primary classification model; and obtaining a secondary classification model based on at least one cluster center, the node embedding information, and the trained model.

[0014] In one possible implementation, the output result of the last coding layer in the trained model is extracted, and cluster analysis is performed based on the node embedding information in the output result to obtain at least one cluster center, including: extracting the output result of the last coding layer in the trained model to obtain a semantic feature vector set corresponding to the node embedding information; clustering the semantic feature vector set based on a clustering algorithm to obtain cluster centers corresponding to three types of data, and using the cluster centers as the cluster center set of the trained model; repeating the step of determining the cluster centers until the semantic feature vector sets and cluster center sets of all trained models are obtained.

[0015] In one possible implementation, a secondary classification model is obtained based on at least one cluster center, node embedding information and a trained model, including: determining the similarity between each semantic feature vector set and each cluster center in the corresponding cluster center set, and using the similarity calculation result corresponding to each semantic feature vector set as the entire similarity set; based on the entire similarity set, extracting a first training similarity set and a test similarity set; inputting the first training similarity set into each trained model respectively, and performing secondary training on the trained model; obtaining an optimized training set based on the calculation result corresponding to the malicious data in the first training similarity set; and determining the secondary classification model based on the optimized training set and the secondary trained model.

[0016] In a second aspect, an embodiment of the present application provides a network request processing device, including:

[0017] A preparation module, used to determine at least one target model for network request recognition from pre-trained classification models, the classification models include a primary classification model and a secondary classification model, the recognition accuracy of the primary classification model is higher than that of the secondary classification model, and the classification model is trained based on data that does not contain attack behaviors and data that contains attack behaviors;

[0018] An interception module is used to intercept the network request to be identified sent to the server, and obtain the corresponding information to be detected based on the network request;

[0019] The recognition module is used to input the information to be detected into the target model and output the corresponding detection results;

[0020] The processing module is used to process the network request based on the detection result.

[0021] In a possible implementation, the preparation module is specifically used to determine the primary classification model as the target model; or, determine the secondary classification model as the target model; or, determine the primary classification model and the secondary classification model as the target model.

[0022] In one possible implementation, the interception module is specifically used to intercept a network request to be identified that is sent to a server; extract key information in the network request, the key information including the request line, request header, parameters and values ​​in the request body in the network request; determine associated information of the key information based on the source of the network request, the associated information also including tag keywords corresponding to the network request, descriptive keywords and parameter values ​​in the request body in the network request message; and concatenate the key information and the associated information to obtain the information to be detected.

[0023] In a possible implementation, the processing module is specifically configured to, if the detection result shows that the network request belongs to an attack behavior, block the network request; or, if the detection result shows that the network request does not belong to an attack behavior, send the network request to the server.

[0024] In one possible implementation, the preparation module is specifically used to train a classification model in the following manner: obtaining general model training data that does not contain attack behaviors, special domain data associated with data in a server, and malicious data that contains attack behaviors; adding labels to the general model training data, special domain data, and malicious data according to the type of data, and using the labeled data as training samples; based on the number of classification models, generating the training samples into corresponding training sets and test sets; inputting the training set into a pre-trained language model, training the pre-trained language model, and obtaining a trained model; extracting the output result of the last encoding layer in the trained model, and performing cluster analysis based on the node embedding information in the output result to obtain at least one cluster center; inputting the test set into the trained model respectively, and determining the trained model with the highest recognition accuracy as the primary classification model; and obtaining a secondary classification model based on at least one cluster center, the node embedding information, and the trained model.

[0025] In one possible implementation, the preparation module is specifically used to extract the output result of the last encoding layer in the trained model to obtain a semantic feature vector set corresponding to the node embedding information; cluster the semantic feature vector set based on a clustering algorithm to obtain cluster centers corresponding to the three types of data, and use the cluster centers as the cluster center set of the trained model; repeat the step of determining the cluster centers until the semantic feature vector sets and cluster center sets of all trained models are obtained.

[0026] In a possible implementation, the preparation module is specifically used to determine the similarity between each semantic feature vector set and each cluster center in the corresponding cluster center set, and use the similarity calculation result corresponding to each semantic feature vector set as the entire similarity set; based on the entire similarity set, extract a first training similarity set and a test similarity set; input the first training similarity set into each trained model respectively, and perform secondary training on the trained model; based on the calculation results corresponding to the malicious data in the first training similarity set, obtain an optimized training set; based on the optimized training set and the secondary trained model, determine a secondary classification model.

[0027] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0028] Memory stores computer-executable instructions;

[0029] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0030] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0031] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0032] The network request processing method, apparatus, device, medium and program product provided in the embodiments of the present application, by determining at least one target model for network request identification from a pre-trained classification model, then intercepting the network request to be identified sent to the server, and obtaining the corresponding information to be detected based on the network request; then inputting the information to be detected into the target model, outputting the corresponding detection result; finally, processing the network request based on the detection result. Thus, by jointly training the model with data that does not contain and contains attack behaviors, the classification model's ability to identify XSS attack behaviors is improved. By intercepting the information to be detected of the network request to be identified, inputting the target model to obtain the detection result, and processing the network request accordingly, the accuracy and efficiency of network security protection are effectively improved, and the false alarm and missed alarm rates are reduced, thereby effectively improving the defense effect of the network program against XSS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0034] Figure 1 An application scenario diagram of the network request processing method provided by the embodiment of the present disclosure;

[0035] Figure 2 A flowchart of a network request processing method provided by an embodiment of the present disclosure;

[0036] Figure 3a A flowchart of a network request processing method provided by another embodiment of the present disclosure;

[0037] Figure 3b for Figure 3a A flow chart of a method for determining a cluster center set provided in the illustrated embodiment;

[0038] Figure 3c for Figure 3a A flow chart of a method for determining a sub-classification model provided in the illustrated embodiment;

[0039] Figure 4 A schematic diagram of the structure of a network request processing device provided by another embodiment of the present disclosure;

[0040] Figure 5 A schematic structural diagram of an electronic device provided in yet another embodiment of the present disclosure.

[0041] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0042] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0043] First, the terms involved in this application are explained:

[0044] XSS attack: refers to a "cross-site scripting attack" based on network requests. When an XSS vulnerability exists, the network program or its server will allow attackers to inject malicious scripts into web pages that other users can view. When these malicious scripts are executed, they can run on the victim's browser, which may lead to security issues such as theft of user's personal information, session hijacking, and tampering of web page content.

[0045] In the field of network security, XSS vulnerabilities have become a problem that cannot be ignored due to their serious threat and wide range of attacks. As a major influencer of WEB security vulnerabilities, XSS attacks have long been at the forefront of network application security risk reports. Their targets are users of Web programs, and they can steal users' sensitive information, tamper with web page content, or conduct phishing attacks, etc., posing a huge threat to corporate and personal privacy information. However, there are many reasons why XSS attacks are difficult to defend against. Developers may not pay attention to secure coding, resulting in vulnerabilities; there are differences in browser security mechanisms, which makes some attack methods effective in some browsers but ineffective in other browsers; programming language characteristics and server configuration differences also provide opportunities for attackers. In addition, XSS attacks are diverse and constantly evolving, making defense more difficult.

[0046] In the related technologies, most of the XSS detection methods rely on rules, features or pattern matching. Although these methods can handle known attacks, they lack effective detection and defense means for unknown XSS attacks, which easily leads to missed reports and insufficient defense capabilities against XSS attacks. Therefore, how to improve the defense effect against XSS attacks and achieve detection and defense against unknown attacks has become an urgent problem to be solved in the current network security field.

[0047] The network request processing method provided in the present application selects a target model with high recognition accuracy to identify network requests through a main classification model and a secondary classification model jointly trained with data containing and attacking behaviors, and performs blocking processing when it is identified as an XSS attack. Thus, network requests can be jointly identified through one or more classification models to improve the accuracy of identifying the similarity between network requests and XSS attacks, thereby improving the accuracy of identifying XSS attacks and thus improving network security.

[0048] Specific application scenarios of the present application The application scenarios of the embodiments of the present disclosure are explained below:

[0049] Figure 1 This is an application scenario diagram of the network request processing method provided by the embodiment of the present disclosure. Figure 1 As shown, during the network request processing process, when the defense program 100 detects the network request 120 sent to the server 110, it will intercept and identify the network request 120. If it is identified as an XSS attack, it will be blocked. If it is identified as a non-XSS attack, it will be sent to the server 110, thereby completing the network request processing process.

[0050] It should be noted that Figure 1In the scenario shown, only one defense program, server, and network request is used as an example for illustration, but the present disclosure is not limited to this. That is, the number of defense programs, servers, and network requests can be arbitrary.

[0051] The network request processing method, device, equipment and medium provided in this application are intended to solve the above technical problems in the prior art.

[0052] It should be noted that the network request processing method and device of the present application can be used in the field of network security technology, and can also be used in any field except the field of network security. The application field of the network request processing method and device of the present application is not limited.

[0053] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0054] Figure 2 The following is a flow chart of a network request processing method provided by an embodiment of the present disclosure. Figure 2 As shown, the following steps are included:

[0055] Step S201: Determine at least one target model for network request recognition from pre-trained classification models.

[0056] Among them, the classification model includes a main classification model and a secondary classification model. The recognition accuracy of the main classification model is higher than that of the secondary classification model. The classification model is trained based on data that does not contain attack behaviors and data that contains attack behaviors.

[0057] Specifically, the execution subject of the embodiment of the present disclosure is the defense program corresponding to the network server.

[0058] This embodiment is used to describe the implementation process of the network request processing method.

[0059] Before processing network requests, you need to configure a defense strategy, that is, select one or more pre-trained classification models as the target model for network request recognition. Among them, the main classification model has a higher recognition accuracy rate for distinguishing whether the data of network requests contains attack behaviors.

[0060] On this basis, by adding a sub-classification model, it is helpful to identify unknown XSS attack behaviors that have XSS attack characteristics but are not very similar to training samples with XSS attack signature codes, thereby reducing missed reports.

[0061] Therefore, according to the security requirements, the target model can be selected from different classification models. The more target models selected, the better the defense effect.

[0062] Step S202: intercepting the network request to be identified sent to the server, and obtaining corresponding information to be detected based on the network request.

[0063] Specifically, after determining the defense mechanism, the defense program will monitor the traffic sent to the system in real time. When it detects that a client sends a network request to the server, it will intercept it in real time, process the intercepted network request, and then hand it over to the target model for identification.

[0064] Network requests are usually HTTP / HTTPS request packets, which contain request-related messages, parameters, assignments, etc. By extracting these data, we can obtain the information to be detected that is input into the target model for identification.

[0065] Step S203: input the information to be detected into the target model and output the corresponding detection result.

[0066] Specifically, the network server inputs the extracted information to be detected into the previously determined target model. The target model can be a primary classification model, or a secondary classification model selected in a specific situation (for example, when the primary classification model cannot be used for some reason), or both models can work at the same time. When two models are selected as target models, the information to be detected will be input into both target models at the same time.

[0067] The target model processes the input information and outputs the corresponding detection results to indicate whether the network request contains attack behavior.

[0068] In some embodiments, when two target models are used and the output results are inconsistent (ie, one model believes that the network request contains an attack behavior), the target model can be directly determined to contain the attack behavior, thereby avoiding damage to the server caused by misidentification and improving security.

[0069] Step S204: Process the network request based on the detection result.

[0070] Specifically, based on the detection results of the target model, the network server will process the network request accordingly. If the detection result is normal (i.e., it does not contain attack behavior), the server will process the request according to the normal process, such as sending the network request to the server so that the server performs the requested operation and returns the corresponding data. If the detection result is abnormal (i.e., it contains attack behavior), the server will take defensive measures, such as blocking the execution of the request, recording attack information, triggering an alarm, etc., to ensure the security of the system.

[0071] The network request processing method provided by the embodiment of the present disclosure determines at least one target model for network request identification from a pre-trained classification model, then intercepts the network request to be identified that is sent to the server, and obtains the corresponding information to be detected based on the network request; then the information to be detected is input into the target model, and the corresponding detection result is output; finally, the network request is processed based on the detection result. Thus, by jointly training the model with data that does not contain and contains attack behaviors, the classification model's ability to identify XSS attack behaviors is improved. By intercepting the information to be detected of the network request to be identified, inputting the target model to obtain the detection result, and processing the network request accordingly, the accuracy and efficiency of network security protection are effectively improved, and the false alarm and missed alarm rates are reduced, thereby effectively improving the defense effect of the network program against XSS attacks.

[0072] Furthermore, in the above embodiment, the target model determination in step 201, that is, determining at least one target model for network request recognition from the pre-trained classification model, can be performed in the following manner:

[0073] The primary classification model is determined as the target model; or, the secondary classification model is determined as the target model; or, the primary classification model and the secondary classification model are determined as the target model.

[0074] Specifically, only one of the primary classification model and the secondary classification model can be selected to work (i.e., as the target model), or both models can be selected to work at the same time. When both models are in working state, the two models independently identify the detection information without exchanging data with each other.

[0075] Exemplarily, only activating the primary classification model can be used as a primary defense mechanism, only activating the secondary classification model can be used as a secondary defense mechanism, and activating both models simultaneously can be used as a tertiary defense mechanism.

[0076] By selecting different defense mechanisms, the flexibility and reliability of XSS attack defense can be increased, so that the corresponding defense method can be selected according to the actual needs of the user, and the defense effect can be guaranteed when needed (after turning on the third-level defense mechanism).

[0077] In some embodiments, the information to be detected may be processed in the following manner:

[0078] Step A1: intercepting a network request to be identified and sent to a server.

[0079] Specifically, through the real-time network monitoring function, the HTTP / HTTPS request message sent by the client to the Web server, that is, the network request, can be intercepted in real time.

[0080] Step A2: extract key information from the network request.

[0081] Among them, key information includes the request line in the network request, the request header, and the parameters and values ​​in the request body.

[0082] Specifically, by collecting and processing data on network requests, key information in the request message can be extracted, including the HTTP request line in the network request, the HTTP request header, and the concatenation of parameters and values ​​in the HTTP request body that may insert the XSS attack payload (i.e., malicious code).

[0083] Step A3: Determine the associated information of the key information based on the network request source.

[0084] The associated information also includes tag keywords corresponding to the network request, descriptive keywords, and parameter values ​​in the request body in the network request message.

[0085] Specifically, the source address of the network request can be determined, so the associated information associated with the request message can be extracted from the webpage source code and other information associated with the network request message, including the form tag keywords corresponding to the network request, the form field descriptive keywords and the request body parameter value in the request message. By splicing these information, the associated information can be obtained.

[0086] Step A4: combine the key information and the associated information to obtain the information to be detected.

[0087] Specifically, the information to be detected can be obtained by splicing various information obtained in the above steps.

[0088] Determining the information to be detected through the above steps can make the information to be detected better reflect the characteristics of the network request, thereby ensuring the accuracy and reliability of the target model in identifying and classifying the network request.

[0089] In some embodiments, after the detection result is identified, the network request may be processed in the following manner:

[0090] If the detection result shows that the network request is an attack behavior, block the network request; or,

[0091] If the detection result is that the network request does not belong to an attack behavior, the network request is sent to the server.

[0092] Specifically, blocking a network request may include directly discarding the request (i.e., not passing the request message to the Web server and not sending any response to the client), sending an error response (i.e., sending an error page or status code, such as 403Forbidden, to the client to indicate that the request is rejected), or logging and blocking the network request.

[0093] In some embodiments, corresponding defense report information is also generated based on the detection results and processing results.

[0094] Exemplarily, the report is divided into three levels, among which the first-level report (Level-1 Report) is the information related to the network requests that are judged as XSS attacks and blocking operations by all the main classification models under the first-level defense mechanism (such as the information extracted from the aforementioned key information and related information); the second-level report (Level-2 Report) is the information related to the network requests that are judged as XSS attacks and blocking operations by all the secondary classification models under the second-level defense mechanism; the third-level report (Level-3Report) is a summary of the information related to the network requests that are judged as XSS attacks and blocking operations by all the main classification models under the third-level defense mechanism, and the information related to the network requests that are judged as XSS attacks and blocking operations by the secondary classification models.

[0095] The report content may include: report generation time, web page source URL + anchor text, web page title, form submission URL, form name, form submission method, XSS attack payload, form tag keywords with XSS attack payload, form field descriptive keywords with XSS attack payload, request body parameter name with XSS attack payload, request package source code and other information.

[0096] By generating defense report information, it is possible to update the XSS attack-related database based on the defense report, and then regularly update and train the classification model to continuously optimize the recognition effect.

[0097] Figure 3a A flow chart of the classification model training process in the network request processing method provided in this application, such as Figure 3a As shown, in this embodiment Figure 2 Based on the embodiment, the classification model training process is described in detail, and the process includes:

[0098] Step S301, obtaining general model training data that does not contain attack behaviors, special domain data associated with data in the server, and malicious data that contains attack behaviors.

[0099] Specifically, the data used for model training includes general model training data and special field data that do not contain attack behaviors, as well as malicious data that contain attack behaviors. Model trainers can fill in the data source of these data (such as address information), and then the program automatically obtains the corresponding data and processes it.

[0100] The following is a detailed description of these three types of data:

[0101] The first is general model training data, that is, normal data without attacking behavior, also known as positive sample big data. The data source is mainly the network text corpus compiled and published by authoritative institutions.

[0102] For example, the C4 (Colossal Clean Crawled Corpus in English) dataset can be selected as the general model training data. It is one of the largest online text corpora today and is a multi-domain unlabeled web data set mined through the Common Crawl web open data platform. The corresponding Hugging Face website comes with the C4 dataset with document classification already done, which can be directly obtained according to the data source address.

[0103] For this type of data, you only need to extract its text content, timestamp and corresponding address and create a corresponding data form.

[0104] The second is the specialized field data set, that is, the data set associated with the server. This type of data can be obtained by using crawler tools to crawl or directly collect the web page source code and access logs of servers and related Internet products from the network center, or by using crawler tools to crawl network text information, web page source code and request information from various network platforms. Extract all text fragments that users can input parameters.

[0105] Exemplarily, a domain-specific data set may include: personal information fields (such as name, address, email, phone number, etc.); names of documents, uploaded files and other data; questions or feedback submitted to administrators; messages, comments, questions, etc. sent to other users; any content recorded in the log and that may be displayed to the administrator (such as URL, user name, Referer and User-Agent, etc.); uploaded file content shared between users.

[0106] In some embodiments, for special field data sets, due to their complex sources, it is necessary to perform targeted processing on such data. The specific data processing method is as follows:

[0107] Case 1: For network text information: the processing method is the same as that of the C4 dataset.

[0108] Case 2: For web page source code: it is necessary to extract basic information of the web page (including: source URL + anchor text, web page type (url or form), parsed data (including web page title, outward link + anchor text, web page meta data, web page Base URL, web page text information), extract relevant information of the form in the web page (including: source URL + anchor text of the web page to which the form belongs, form submission URL, form submission method, form name, form label keywords, form field parameter name, form field descriptive keywords, default input value, option list), and add corresponding data tags according to the specific information type.

[0109] Case 3: For access logs or request information: Extract the HTTP / HTTPS request sent by the user to the server, and establish an association with the information extracted from the web page source code based on the requested link address, request method and other information.

[0110] Case 4: concatenate the form tag keywords, form field descriptive keywords and default input values, option lists, and request body parameter values ​​in the relevant information of the web page source code, using ":" as a separator.

[0111] As shown in the following table:

[0112] Table 1 Schematic diagram of processing results of special field data

[0113]

[0114]

[0115] For network request data in special field data, the parameters and values ​​in the HTTP request line, HTTP request header, and HTTP request body can be concatenated. The request header uses ":" as a separator, and the request line and request body use "=" as a separator, as shown in the following table:

[0116] Table 2 Schematic diagram of processing results of special field data

[0117]

[0118] Finally, for negative sample big data, that is, malicious data carrying XSS attack code.

[0119] For example, a crawler tool may be used to crawl the website http: / / xssed.com / to obtain negative sample big data, which is composed of payload (ie, malicious code) data.

[0120] By increasing the data set of negative sample big data, it helps to strengthen the large-scale language model's deep understanding of normal behavior and XSS attack behavior, and solve the problem of unsatisfactory detection effect caused by lack of sensitivity to specific contexts and domain knowledge when applying large-scale language models to XSS attack defense.

[0121] Step S302: according to the type of data, add labels to the general model training data, special field data and malicious data respectively, and use the labeled data as training samples.

[0122] Specifically, the positive sample big data and negative sample big data obtained in the previous step are divided into three categories: for example, the general model training data (i.e., C4 data set) in the positive sample big data is marked as 0, the special field data set is marked as 1, and the negative sample big data (i.e., malicious data) is marked as 2.

[0123] The above labeled data are training samples.

[0124] Step S303: Based on the number of classification models, the training samples are generated into corresponding training sets and test sets.

[0125] Specifically, there are usually multiple classification models used for training (such as k, and the specific value can be pre-configured by the developer). At this time, the training samples obtained in the previous steps can be randomly divided into two parts for each type of data, that is, each of the three types of samples is divided into two parts. At this time, one part can be randomly selected as the training set and the other part can be used as the test set.

[0126] Furthermore, each type of training set and test set is randomly divided into k parts (corresponding to the number of classification models used for training) to obtain k training subsets and k test subsets.

[0127] Then, each training subset and test subset can be combined in pairs in turn to obtain k groups of training sample sets and test sample sets of the classification model.

[0128] Step S304: input the training set into the pre-trained language model, train the pre-trained language model, and obtain a trained model.

[0129] Specifically, the pre-trained language model can adopt commonly used open source and training models, such as Roberta, Bert, GPT2, T5-base, etc.

[0130] In this embodiment, the Roberta model is used as the pre-trained language model for subsequent description.

[0131] After obtaining the training set in the above steps, the training set is input into the Roberta pre-trained model for fine-tuning training to obtain the trained model.

[0132] At this point, there are still multiple models after training, and the main classification model and the secondary classification model need to be determined from them.

[0133] Step S305: extract the output result of the last coding layer in the trained model, and perform cluster analysis based on the node embedding information in the output result to obtain at least one cluster center.

[0134] Specifically, the classification model generated in the pre-training stage, after being trained through the aforementioned steps, needs to be further screened and optimized to obtain the final main classification model and secondary classification model.

[0135] In one embodiment, if Figure 3b As shown, it is a flow chart of the method for determining the cluster center set. The probability density function can be determined in the following way:

[0136] Step S3051, extract the output result of the last encoding layer in the trained model to obtain a semantic feature vector set corresponding to the node embedding information.

[0137] Specifically, taking the Roberta pre-trained model as an example, by extracting the last_hidden_state of the model (i.e., the output result of the last encoding layer), a semantic feature vector set V based on token embedding (i.e., node embedding information) can be obtained.

[0138] Step S3052: Based on the clustering algorithm, the semantic feature vector set is clustered to obtain the cluster centers corresponding to the three types of data, and the cluster centers are used as the cluster center set of the trained model.

[0139] Specifically, based on the semantic feature vector set V, the K-Means algorithm is used to perform cluster analysis to extract three types of sample cluster centers H0, H1, and H2 (because there are three types of training data, there will also be three corresponding cluster centers).

[0140] Step S3053: Repeat the step of determining the cluster center until the semantic feature vector set and cluster center set of all trained models are obtained.

[0141] Specifically, by repeatedly polling the cluster centers corresponding to each training data set k times, that is, traversing each of the sample data, we can obtain the classification models C1, C2, ..., Ck (i.e., the trained models) and k semantic feature vector sets V1, V2, ..., Vk obtained by training the large-scale language model Roberta, as well as k cluster center sets {h0, h1, h2} 1 、{h0,h1,h2} 2 , …, {h0,h1,h2} k .

[0142] Step S306: input the test sets into the trained models respectively, and determine the trained model with the highest recognition accuracy as the main classification model.

[0143] Specifically, for each classification model C1, C2, ..., Ck, the corresponding test set T1, T2, ..., Tk can be put into the corresponding classification model for testing, and the recall rate Recall is calculated according to the classification result predicted by the model, that is, Recall = the number of samples correctly predicted as XSS attacks / the number of samples actually attacked by XSS, and then the classification model C with the highest Recall value is selected as the model output by the optimized large-scale language model training, referred to as the main classification model, where,

[0144]

[0145] By determining the main classification model through the above steps, the accuracy of the main classification model in identifying XSS attacks can be guaranteed.

[0146] Step S307: obtaining a sub-classification model based on at least one cluster center, node embedding information and the trained model.

[0147] Specifically, on the basis of obtaining the main classification model, since the detection effect of unknown XSS attacks cannot be guaranteed by relying solely on the main classification model, further fine-tuning is still needed to ensure the recognition ability of the secondary classification model.

[0148] The method is as follows: the test sample set divided into k parts (where the k value is selected by the user) is evenly divided into two parts to obtain k fine-tuning training sets and k fine-tuning test sets, and the k fine-tuning training sets are respectively put into the corresponding k candidate sub-classification models for training to obtain k groups of deviation sets of test samples that actually belong to XSS attacks but are not classified into category 2. After converting these offset data sets into normal distribution, the clustering range of category 2 is expanded according to the confidence selected by the user to obtain k candidate sub-classification models after the first round of optimization; then the k fine-tuning test sets are respectively put into the corresponding k candidate sub-classification models after the first round of optimization for testing, and the candidate sub-classification model with the highest recall rate in the test results is selected as the final sub-classification model.

[0149] The following is a detailed description:

[0150] In one embodiment, if Figure 3c As shown, it is a flow chart of the method for determining the sub-classification model. The probability density function can be determined in the following way:

[0151] Step S3071: determine the similarity between each semantic feature vector set and each cluster center in the corresponding cluster center set, and use the similarity calculation result corresponding to each semantic feature vector set as the complete similarity set.

[0152] Specifically, based on the aforementioned steps, the semantic feature vector sets V1, V2, ... Vk output by the embedding layer are extracted when the test sets T1, T2, ..., Tk are input into the classification models C1, C2, ..., Ck for testing.

[0153] Then, the similarity calculation method in the K-Means algorithm (Euclidean distance, cosine similarity, etc.) is used to calculate the semantic feature vector set V1, V2, ... Vk and the corresponding cluster center set {h0, h1, h2} 1 、{h0,h1,h2} 2 , …, {h0,h1,h2} k The similarity of each cluster center in is obtained, and the similarity set {S0,S1,S2} is obtained. 1 , {S0,S1,S2} 2 , …, {S0, S1, S2} k .

[0154] For example, the semantic feature vector set V1 corresponding to the test set T1 is {v1, v2, …, vn}, and its corresponding cluster center set is {h0, h1, h2} 1 , then the similarity between each test sample v1, v2, ..., vn and the three cluster centers h0, h1, h2 should be calculated to obtain the similarity set {S0, S1, S2} corresponding to the three cluster centers 1 .

[0155] Step S3072: Based on the entire similarity set, extract a first training similarity set and a testing similarity set.

[0156] Specifically, each similarity set in the entire similarity set is randomly divided into two parts, and the first training similarity set {S0, S1, S2} is obtained. 11 , {S0,S1,S2} 21 , …, {S0, S1, S2} k1 and the test similarity set {S0,S1,S2} 12 , {S0,S1,S2} 22 , …, {S0, S1, S2} k2 .

[0157] Step S3073: input the first training similarity set into each trained model respectively, and perform secondary training on the trained model.

[0158] Specifically, the first training similarity set can be input into each classification model for secondary training.

[0159] Step S3074: Obtain an optimized training set based on the calculation results corresponding to the malicious data in the first training similarity set.

[0160] Specifically, traverse each cluster center set, extract the similarity set {s0, s1, s2} corresponding to the samples actually marked as category 2 (i.e., negative samples) in the corresponding training similarity set, and filter out some similarity sets that satisfy (s0>s2)∪(s1>s2) to obtain the training similarity set corresponding to the missed samples (where s0, s1, and s2 can be the corresponding similarity values).

[0161] Then calculate the bias corresponding to the missed sample, the calculation method is:

[0162] bias = max{s0-s2,s1-s2};

[0163] Thus, the missed negative bias set B1, B2, ..., Bk (i.e., optimized data set) of missed negative samples corresponding to each classification model can be obtained.

[0164] Step S3075: Determine a secondary classification model based on the optimized training set and the secondary trained model.

[0165] Specifically, it is first necessary to check whether the k groups of discrete data corresponding to the underreporting deviation set B1, B2, ..., Bk conform to the normal distribution. If so, the critical value μ+1.96σ in the confidence interval (μ-1.96σ, μ+1.96σ) corresponding to the confidence level of 95% (the confidence level is pre-entered by the user, μ is the mathematical expectation, and σ is the standard deviation) is used as the maximum tolerance, and all samples with deviations less than the maximum tolerance are marked as XSS attacks (i.e., negative sample data marked as 2); if it does not conform to the normal distribution, the above discrete data can be processed by taking logarithms, square roots, taking inverses, removing outliers, BOX-COX conversion, Johnson conversion and other methods to convert non-normally distributed data into normally distributed data, and then the maximum tolerance is calculated according to the above method.

[0166] After obtaining the maximum tolerance, the labels of each sample are updated, and then the training data with updated labels are input into the classification model for training, and finally k K-Means classification models K1, K2, ..., Kk are obtained after being updated based on the samples corresponding to the maximum tolerance.

[0167] Then we can use the test similarity set {S0, S1, S2} obtained in the previous steps 12 , {S0,S1,S2} 22 , …, {S0, S1, S2}k2 The k expanded classification models are tested.

[0168] Then, the recall rate Recall is calculated based on the classification results predicted by the model, that is, Recall = the number of samples correctly predicted as XSS attacks / the number of samples actually attacked by XSS. The classification model K with the highest Recall value is selected as the model output by the optimized large-scale language model + K-Means algorithm training, referred to as the secondary classification model, where:

[0169]

[0170] The process of determining this part of the model is similar to that of determining the main classification model and will not be repeated here.

[0171] In summary, this solution provides a method for XSS attack defense with higher detection sensitivity for XSS attacks by utilizing the powerful contextual reasoning ability of large-scale language models trained based on huge cross-domain data sets, combined with the advantages of high computational efficiency and easy scalability of the K-Means algorithm. It can use the deep learning technology of large-scale language models to make a preliminary prediction on whether the request information to be detected belongs to XSS attack behavior, and use the K-Means algorithm combined with the characteristics of the normal distribution curve (i.e., densely distributed in a certain interval) to further fine-tune the relevant classification model according to the user's maximum tolerance requirements, and further analyze a part of the network requests to be identified whose categories are unclear, so as to identify unknown XSS attack behaviors that have XSS attack characteristics but are not highly similar to training samples with XSS attack signature codes, thereby reducing missed reports.

[0172] At the same time, it is also possible to use the universal characteristics of large-scale language models to accurately identify most normal behaviors, and then use the powerful generalization ability of large-scale language models to further train and fine-tune them based on special domain data sets (that is, text snippets obtained and extracted from the unit or other network platforms where users can input parameters) and XSS attack feature information (such as content related to the missed bias set), subdivide the detection categories, classify the general corpus, special domain data sets, and XSS attack feature information into different categories, and divide normal behaviors and attack behaviors in a more fine-grained manner, thereby improving the detection effect of large-scale language models on XSS attacks.

[0173] In addition, in the pre-training stage, this solution pre-trains the pre-selected large-scale language model based on the network text corpus, special field data set, and XSS attack feature information to generate a candidate classification model, and then enters the subsequent fine-tuning to finally obtain the main classification model and the secondary classification model. These data will continue to accumulate through user import or collection from various network platforms during the operation of the program system corresponding to the entire network request recognition and processing method. The more complete the normal information and attack information covered, the more it can strengthen the large-scale language model's in-depth understanding of normal and attack behaviors, prompting the main classification model and the secondary classification model to be continuously optimized, and the defense effect is getting better and better.

[0174] Finally, by identifying new XSS attack behaviors in the real-time traffic monitoring and defense stage, it can not only make up for the lack of testing experience and testing skills of security testers in the XSS attack defense process, but also help security testers expand their knowledge reserves of XSS attacks, and also help the program system to regularly optimize the classification model through self-learning.

[0175] The network request processing method provided by the embodiment of the present disclosure uses a language model to predict whether a network request contains an XSS attack, and then fine-tunes the classification model through the K-Means algorithm, so as to identify unknown XSS attacks with low similarity but attack characteristics, thereby reducing missed reports. At the same time, by utilizing the universality and generalization ability of the language model, combined with the special field data set and XSS attack feature information, the detection category is subdivided to improve the detection effect. And by continuously accumulating normal and attack information, optimizing the primary and secondary classification models, enhancing deep understanding, and continuously improving the defense effect against XSS attacks, thereby improving network security.

[0176] Figure 4 A schematic diagram of the structure of the network request processing device provided by this application, such as Figure 4 As shown, the network request processing device 400 provided in this embodiment includes:

[0177] A preparation module 410 is used to determine at least one target model for network request recognition from pre-trained classification models, the classification model includes a primary classification model and a secondary classification model, the recognition accuracy of the primary classification model is higher than that of the secondary classification model, and the classification model is trained based on data that does not contain attack behaviors and data that contains attack behaviors;

[0178] The interception module 420 is used to intercept the network request to be identified sent to the server, and obtain the corresponding information to be detected based on the network request;

[0179] The recognition module 430 is used to input the information to be detected into the target model and output the corresponding detection result;

[0180] The processing module 440 is used to process the network request based on the detection result.

[0181] In a possible implementation, the preparation module 410 is specifically configured to determine the primary classification model as the target model; or, determine the secondary classification model as the target model; or, determine the primary classification model and the secondary classification model as the target model.

[0182] In one possible implementation, the interception module 420 is specifically used to intercept a network request to be identified that is sent to a server; extract key information in the network request, the key information including the request line, request header, parameters and values ​​in the request body in the network request; determine the associated information of the key information based on the source of the network request, the associated information also including tag keywords corresponding to the network request, descriptive keywords and parameter values ​​in the request body in the network request message; and concatenate the key information and the associated information to obtain the information to be detected.

[0183] In a possible implementation, the processing module 440 is specifically configured to, if the detection result shows that the network request belongs to an attack behavior, block the network request; or, if the detection result shows that the network request does not belong to an attack behavior, send the network request to the server.

[0184] In a possible implementation, the preparation module 410 is specifically used to train a classification model in the following manner: obtain general model training data that does not contain attack behaviors, special domain data associated with data in the server, and malicious data that contains attack behaviors; add labels to the general model training data, special domain data, and malicious data according to the type of data, and use the labeled data as training samples; based on the number of classification models, generate the training samples into corresponding training sets and test sets; input the training set into a pre-trained language model, train the pre-trained language model, and obtain a trained model; extract the output result of the last encoding layer in the trained model, and perform cluster analysis based on the node embedding information in the output result to obtain at least one cluster center; input the test set into the trained model respectively, and determine the trained model with the highest recognition accuracy as the main classification model; based on at least one cluster center, node embedding information, and the trained model, obtain a secondary classification model.

[0185] In one possible implementation, the preparation module 410 is specifically used to extract the output result of the last encoding layer in the trained model to obtain a semantic feature vector set corresponding to the node embedding information; cluster the semantic feature vector set based on a clustering algorithm to obtain cluster centers corresponding to the three types of data, and use the cluster centers as the cluster center set of the trained model; repeat the step of determining the cluster centers until the semantic feature vector sets and cluster center sets of all trained models are obtained.

[0186] In a possible implementation, the preparation module 410 is specifically used to determine the similarity between each semantic feature vector set and each cluster center in the corresponding cluster center set, and use the similarity calculation result corresponding to each semantic feature vector set as the entire similarity set; based on the entire similarity set, extract a first training similarity set and a test similarity set; input the first training similarity set into each trained model respectively, and perform secondary training on the trained model; based on the calculation results corresponding to the malicious data in the first training similarity set, obtain an optimized training set; based on the optimized training set and the secondary trained model, determine a secondary classification model.

[0187] The network request processing device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0188] Figure 5 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0189] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0190] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0191] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0192] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0193] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0194] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0195] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0196] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0197] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0198] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0199] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0200] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0201] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0202] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0203] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A network request processing method, characterized in that: include: Determine at least one target model for network request recognition from pre-trained classification models, wherein the classification models include a primary classification model and a secondary classification model, the primary classification model has a higher recognition accuracy than the secondary classification model, and the classification model is trained based on data that does not contain attack behaviors and data that contains attack behaviors; Intercepting a network request to be identified sent to a server, and obtaining corresponding information to be detected based on the network request; Inputting the information to be detected into the target model and outputting the corresponding detection result; Based on the detection result, the network request is processed.

2. The method according to claim 1, characterized in that The step of determining at least one target model for performing network request recognition from the pre-trained classification models includes: determining the main classification model as the target model; or, determining the sub-classification model as the target model; or, The primary classification model and the secondary classification model are determined as the target models.

3. The method according to claim 1, characterized in that: The intercepting of the network request to be identified sent to the server, and obtaining corresponding information to be detected based on the network request, includes: Intercept network requests to be identified that are sent to the server; Extracting key information from the network request, the key information including a request line, a request header, and parameters and values ​​in a request body in the network request; Based on the source of the network request, determining the associated information of the key information, the associated information also includes tag keywords, descriptive keywords corresponding to the network request and parameter values ​​in the request body in the network request message; The key information and the associated information are concatenated to obtain the information to be detected.

4. The method according to claim 1, characterized in that The processing of the network request based on the detection result includes: If the detection result is that the network request is an attack behavior, blocking the network request; or, If the detection result is that the network request does not belong to an attack behavior, the network request is sent to the server.

5. The method according to any one of claims 1 to 4, characterized in that The classification model is trained in the following way: Obtaining general model training data that does not contain attack behaviors, special domain data associated with the data in the server, and malicious data that contains attack behaviors; According to the types of data, the general model training data, the special field data and the malicious data are respectively labeled, and the labeled data is used as a training sample; Based on the number of classification models, generating the training samples into corresponding training sets and test sets; Inputting the training set into a pre-trained language model, training the pre-trained language model, and obtaining a trained model; Extracting the output result of the last encoding layer in the trained model, and performing cluster analysis based on the node embedding information in the output result to obtain at least one cluster center; Inputting the test sets into the trained models respectively, and determining the trained model with the highest recognition accuracy as the main classification model; The sub-classification model is obtained based on the at least one cluster center, the node embedding information and the trained model.

6. The method according to claim 5, characterized in that The extracting the output result of the last encoding layer in the trained model and performing cluster analysis based on the node embedding information in the output result to obtain at least one cluster center includes: Extracting the output result of the last encoding layer in the trained model to obtain a semantic feature vector set corresponding to the node embedding information; Based on a clustering algorithm, the semantic feature vector set is clustered to obtain cluster centers corresponding to the three types of data, and the cluster centers are used as cluster center sets of the trained model; The step of determining the cluster centers is repeated until the semantic feature vector sets and cluster center sets of all trained models are obtained.

7. The method according to claim 6, characterized in that The obtaining the sub-classification model based on the at least one cluster center, the node embedding information and the trained model comprises: Determine the similarity between each semantic feature vector set and each cluster center in the corresponding cluster center set, and use the similarity calculation result corresponding to each semantic feature vector set as the complete similarity set; Based on the entire similarity set, extracting a first training similarity set and a testing similarity set; Inputting the first training similarity set into each trained model respectively, and performing secondary training on the trained model; Based on the calculation results corresponding to the malicious data in the first training similarity set, an optimized training set is obtained; The secondary classification model is determined based on the optimized training set and the secondary trained model.

8. A network request processing device, characterized in that: include: A preparation module, used to determine at least one target model for network request recognition from pre-trained classification models, wherein the classification model includes a primary classification model and a secondary classification model, the recognition accuracy of the primary classification model is higher than that of the secondary classification model, and the classification model is trained based on data that does not contain attack behaviors and data that contains attack behaviors; An interception module, used to intercept the network request to be identified sent to the server, and obtain corresponding information to be detected based on the network request; An identification module, used for inputting the information to be detected into the target model and outputting a corresponding detection result; A processing module is used to process the network request based on the detection result.

9. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the network request processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the network request processing method according to any one of claims 1 to 7.

Images