Web attack detection model debugging method, system and equipment and storage medium

Abstract

The embodiment of the invention provides a Web attack detection model debugging method, system and device and a storage medium, and relates to the technical field of network security. The method comprises the steps that HTTP logs are collected through a traffic collector, non-malicious logs are obtained through screening in the logs, and normal traffic logs with business behaviors within a traffic baseline range in the non-malicious logs are obtained; extracting a normal traffic log to obtain an effective load, taking the effective load as a white sample set, taking historical Web attack data as a black sample set, and combining the white sample set and the black sample set into a debugging data set; and using the debugging data set to locally debug a full connection layer of the pre-trained Web attack detection model so as to iteratively update neural network parameters of the pre-trained Web attack detection model. According to the method and the device, the consumption of a large amount of manpower for marking is avoided, only the effective load information is detected, the interference to the model is reduced, the complexity of the model is reduced, and the time and resources required for training the model from the beginning are saved by adopting a local fine tuning method.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a Web attack detection model debugging method, system, device and storage medium. Background Art

[0002] Attacks on web application services account for the vast majority of network attacks. Intrusion Prevention Systems (IPS) usually use artificial intelligence-based web attack detection models to detect HTTP / HTTPs logs, identify web attacks such as SQL injection, XSS injection, command injection, code execution, directory traversal, etc., and can protect web service security. However, due to changes in user behavior or changes in the model application environment, changes in the distribution of collected data will cause data drift, which violates the assumption that machine learning samples are independent and identically distributed, and will cause the generalization performance of models that are sensitive to changes in data distribution to deteriorate, leading to an increase in false positives or false negatives. Users will lose confidence in the model's predictions, reducing user trust and satisfaction.

[0003] Moreover, many data sets in machine learning require manual annotation, which is time-consuming and costly, especially for large-scale data sets. In the field of network security, domain experts are often required to perform annotation, which further increases the cost and time. Expert knowledge features are affected by the subjective judgment and personal experience of experts, and have certain subjectivity and limitations, which will lead to differences in feature selection and construction. In addition, expert knowledge features are manually designed and selected, which makes it difficult to adapt to different network environments and changing attack methods.

[0004] A common Web attack detection method based on machine learning for HTTP request text extracts the complete HTTP request text from network traffic as data input. However, HTTP messages are structured data. The request line in the HTTP request text contains the request method, URL, and the request header contains User-Agent, Cookie, etc. The request body usually contains request-related parameters or data, such as xml, json data, etc. Each field has different data types and content functions, but this solution does not distinguish and process different fields in the HTTP request text. HTTP messages that have not been preprocessed have a large amount of redundant text, and irrelevant or redundant features will introduce noise, affecting the robustness of the model. Summary of the invention

[0005] In order to solve one of the above technical defects, the embodiments of the present application provide a Web attack detection model debugging method, device and storage medium.

[0006] According to a first aspect of an embodiment of the present application, a Web attack detection model debugging method is provided, the method comprising:

[0007] Collect HTTP logs through traffic collectors, filter out non-malicious logs from HTTP logs, and obtain normal traffic logs whose business behaviors are within the traffic baseline range in the non-malicious logs;

[0008] Extract the payload from the normal traffic log, use the payload as the white sample set, use the historical Web attack data as the black sample set, and combine the white sample set and the black sample set into a debugging data set;

[0009] The debugging dataset is used to locally debug the fully connected layer of the pre-trained Web attack detection model to iteratively update the neural network parameters of the pre-trained Web attack detection model.

[0010] In an optional embodiment of the present application, the steps of collecting HTTP logs through a traffic collector, screening out non-malicious logs from the HTTP logs, and obtaining normal traffic logs of business behaviors within the traffic baseline range from the non-malicious logs further include:

[0011] When, in a business behavior, the number of times the length of the Web service request body when the source IP address briefly accesses an external IP address is greater than the length of the response body is within the flow baseline range, and the number of different response body lengths is within the flow baseline range, and the number of different Refer data is within the flow baseline range, the business behavior is considered to be within the flow baseline range.

[0012] In an optional embodiment of the present application, the steps of collecting HTTP logs through a traffic collector, screening out non-malicious logs from the HTTP logs, and obtaining normal traffic logs of business behaviors within the traffic baseline range from the non-malicious logs further include:

[0013] When the service behavior conforms to the UA-IP baseline rule or is any of the following: regular access services, high-frequency services, and services running on multiple hosts, the service behavior is considered to be within the traffic baseline range.

[0014] In an optional embodiment of the present application, the steps of collecting HTTP logs through a traffic collector, screening out non-malicious logs from the HTTP logs, and obtaining normal traffic logs of business behaviors within the traffic baseline range from the non-malicious logs further include:

[0015] The bag-of-words algorithm is used to extract features from normal traffic logs, and the isolation forest anomaly detection algorithm is used to eliminate abnormal logs and obtain low anomaly score logs to denoise normal traffic logs.

[0016] In an optional embodiment of the present application, the step of locally debugging the fully connected layer of the pre-trained Web attack detection model using the debugging data set to iteratively update the neural network parameters of the pre-trained Web attack detection model also includes:

[0017] Freeze the initial layer of the pre-trained Web attack detection model to prevent the initial layer from being updated during local debugging.

[0018] In an optional embodiment of the present application, the step of locally debugging the fully connected layer of the pre-trained Web attack detection model using the debugging data set to iteratively update the neural network parameters of the pre-trained Web attack detection model also includes:

[0019] Cross entropy is used as the loss function.

[0020] In an optional embodiment of the present application, the step of locally debugging the fully connected layer of the pre-trained Web attack detection model using the debugging data set to iteratively update the neural network parameters of the pre-trained Web attack detection model also includes:

[0021] When performing local debugging, the Dropout layer is used to reduce the overfitting of the Web attack detection model on the debugging dataset.

[0022] According to a second aspect of the embodiment of the present application, a Web attack detection model debugging system is provided, the system comprising a log screening module, a data set building module and a model debugging module; wherein,

[0023] The log screening module is used to collect HTTP logs through the traffic collector, screen the HTTP logs to obtain non-malicious logs, and obtain normal traffic logs of business behaviors within the traffic baseline range in the non-malicious logs;

[0024] The data set establishment module is used to extract the payload from the normal traffic log, use the payload as the white sample set, use the historical Web attack data as the black sample set, and combine the white sample set and the black sample set into a debugging data set;

[0025] The model debugging module is used to locally debug the fully connected layer of the pre-trained Web attack detection model using the debugging data set, so as to iteratively update the neural network parameters of the pre-trained Web attack detection model.

[0026] According to a third aspect of an embodiment of the present application, there is provided a computer device, including: a memory;

[0027] A processor; and a computer program; wherein the computer program is stored in a memory and is configured to be executed by the processor to implement a Web attack detection model debugging method as described in any one of the first aspects of the embodiments of the present application.

[0028] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored; the computer program is executed by a processor to implement a Web attack detection model debugging method as described in any one of the first aspects of the embodiments of the present application.

[0029] The Web attack detection model debugging method provided in the embodiment of the present application has the following beneficial effects:

[0030] This application filters normal traffic logs based on statistical baselines to avoid a lot of manual data labeling. This application only detects payload information, reduces unnecessary input, removes erroneous or irrelevant data, reduces interference with the model and reduces the complexity of the model, allowing the model to focus more on useful signals. In addition, this application uses a local fine-tuning method to reduce computing requirements by updating only the parameters of the selected part, saving the time and resources required to train the model from scratch. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0032] Figure 1 A flowchart of a Web attack detection model debugging method provided in an embodiment of the present application;

[0033] Figure 2 A local debugging structure diagram of a Web attack detection model provided in an embodiment of the present application;

[0034] Figure 3 A structural diagram of a Web attack detection model debugging system provided in an embodiment of the present application;

[0035] Figure 4 A schematic diagram of the computer device structure provided for one embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the technical solutions and advantages in the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than an exhaustive list of all the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0037] Web applications are attractive targets for cyber attackers. Common attacks such as SQL injection, cross-site scripting, and remote code execution can render Web services inoperable, steal user sensitive information, and cause significant economic losses to service providers and users.

[0038] Due to the lack of security awareness among programmers in various companies, server-side applications that process user HTTP requests often have a large number of vulnerabilities or security risks. These vulnerabilities and risks allow attackers to access a large amount of user personal information and sensitive data in the website backend, and even control the Web server by constructing or injecting malicious values ​​in the parameters or request body of the HTTP request.

[0039] Behavioral analysis is used to analyze the patterns and characteristics of network traffic to detect abnormal activities. Abnormal behavior is to find behaviors that do not conform to normal behavior patterns. Normal behavior is behavior that is within the model baseline. The baseline reflects the trend of traffic changes under normal network behavior and is an important traffic indicator. Once abnormal traffic occurs on the network, it will be directly reflected in the traffic changes. For example, a sudden increase in traffic may be a distributed denial of service (DDoS); an increase in traffic on unconventional ports may indicate malware; illegal or unusual session durations may indicate session hijacking; users logging in at abnormal times or locations, or downloading large amounts of data, may indicate that their accounts have been stolen.

[0040] Data drift refers to the change in statistical characteristics between training data and actual application data, which can have a significant impact on machine learning models. There are many reasons for data drift. For example, the sampling is not representative and cannot effectively represent the overall data, which may lead to distribution differences between the training set and the actual application data, thus causing data drift. It may also be because the data sampled from different time periods may have significant changes. Changes in user habits, changes in users' online habits or behavior patterns, may cause data feature drift.

[0041] This application proposes a Web attack detection model debugging method. Figure 1 For a flowchart of the Web attack detection model debugging method provided in the embodiment of the present application, please refer to Figure 1 :

[0042] S1: Collect HTTP (Hypertext Transfer Protocol) logs through a traffic collector, filter out non-malicious logs from the HTTP logs, and obtain normal traffic logs of business behaviors within the traffic baseline range in the non-malicious logs.

[0043] In the specific implementation, HTTP logs are collected through a traffic collector, and logs that do not contain valid attack keywords (echo, exec, eval, alert, bash, select, {jndi: / / *}, etc.) and whose source IP (Internet Protocol) addresses are not malicious IP addresses are screened out.

[0044] In some embodiments of the present application, when in a business behavior, the number of times the length of a Web service request body when a source IP address briefly accesses an external IP address is greater than the length of the response body is within the traffic baseline range, and the number of different response body lengths is within the traffic baseline range, and different Refer data (Refer data refers to a field in the HTTP request header used to indicate the source page of the current request) is within the traffic baseline range, the business behavior is considered to be within the traffic baseline range.

[0045] In some embodiments of the present application, when the business behavior conforms to the UA (User Agent)-IP baseline rule or is any of the access regularity business, high-frequency business, and business running on multiple hosts, the business behavior is considered to be within the traffic baseline range.

[0046] In a specific implementation, the present application filters normal traffic logs based on a statistical baseline. Specifically, the traffic logs are filtered by the following rules:

[0047] 1. Behavior within the baseline range: The number of times the request body length of the Web service when the source IP accesses the external IP for a short period of time is greater than the response body length is within the baseline, and the number of different response body lengths is within the baseline, and the number of different Refer data is within the baseline range;

[0048] 2. Regularly accessed services: websites with access regularity higher than a preset regularity threshold, or data during common time periods and normal business access time; specifically, the preset regularity threshold is a regularity index preset according to demand, the purpose of which is to screen websites with the top access regularity; data accessed during normal working hours includes but is not limited to HTTP log data generated by source IP accessing intranet Web services during common time periods on weekdays;

[0049] 3. High-frequency business: website traffic with a visit frequency higher than a preset frequency threshold; specifically, the preset frequency threshold is a frequency index preset according to demand, the purpose of which is to screen websites with the highest visit frequency; specifically, to screen websites with higher visit duration and URL frequency;

[0050] 4. Services running on multiple hosts: websites with a number of hosts greater than the preset number of hosts;

[0051] 5. Web pages that conform to the UA-IP baseline rule: There are multiple IPs and multiple UAs accessing the website, and there is no website that is accessed by a large number of UAs using a single IP.

[0052] Based on this, this application filters normal traffic logs based on statistical baselines, establishes a normal network baseline over the past period of time, and continuously studies various indicators of network traffic (number of visits, communication duration, traffic size, access frequency, access sequence, access range and other characteristics) data to establish a network traffic operation baseline and determine the baseline critical value. When the traffic behavior does not deviate from the normal network baseline, it is considered a normal traffic log, avoiding a lot of manual labeling.

[0053] In some embodiments of the present application, a bag-of-words algorithm is used to extract features from normal traffic logs, and an isolation forest anomaly detection algorithm is used to eliminate abnormal logs to obtain low anomaly score logs to denoise the normal traffic logs.

[0054] In the specific implementation, the bag-of-words algorithm TF (Term Frequency)-IDF (Inverse Document Frequency) is used to extract features for the filtered traffic log text, and the isolation forest iForest (Isolation Forest, iForest for short) anomaly detection algorithm is used to eliminate abnormal logs, and the remaining logs with low anomaly scores are used as normal traffic logs.

[0055] Please continue to see Figure 1 :

[0056] S2: Extract the payload from the normal traffic log, use the payload as the white sample set, use the historical Web attack data as the black sample set, and combine the white sample set and the black sample set into a debugging data set.

[0057] In the specific implementation, the payload information is extracted from the normal traffic log in step S2. Specifically, in the embodiment of the present application, in order to reduce noise, the payload information is extracted from different characters of the normal traffic log, and only the payload information is detected: url (uniform resource locator, uniform resource locator system) extraction, the parameter string after the question mark symbol is used as the payload, and if it does not contain a question mark, the entire url string is taken; the request header consists of a name followed by a colon, and the colon is followed by its specific value, which is used as the request header payload information; the request body is detected by extracting parameter values ​​according to different file contents, for example, dynamically identifying the request body as json (JavaScript Object Notation, JavaScript object representation), xml ((Extensible Markup Language, Extensible Markup Language), key (key) = value (value) & key = value and other structured data formats, and extracting parameter values ​​from different format data as payload information. If it does not belong to structured data, all request body information is used as payload.

[0058] In the specific implementation, the filtered white sample data and the black sample data of Web attacks collected by the laboratory are combined into a debugging data set, and the debugging data set is used to fine-tune the pre-trained Web attack detection model.

[0059] S3: Use the debugging dataset to locally debug the fully connected layer of the pre-trained Web attack detection model to iteratively update the neural network parameters of the pre-trained Web attack detection model.

[0060] In the specific implementation, the debugging data set is divided into a training set and a validation set, optionally in a ratio of 4:1. In the specific implementation, the model is debugged through the training set, and the model performance is evaluated through the validation set. In the specific implementation, only the fully connected layer is fine-tuned, i.e., local debugging.

[0061] In order to adapt the model to the changing data distribution, it is usually necessary to retrain the model so that it can adapt to the changes in the data distribution, but this process is computationally expensive and time-consuming. The pre-trained model has learned features from a large amount of data, such as Figure 2 As shown, using the local fine-tuning method, selective fine-tuning reduces the computational requirements by updating only the parameters of the selected part, saving the time and resources required to train the model from scratch.

[0062] In some embodiments of the present application, the initial layer of the pre-trained Web attack detection model is frozen to avoid updating of the initial layer during local debugging.

[0063] In the specific implementation, the initial layers of the model are frozen during fine-tuning and these layers will not be updated during training.

[0064] In some embodiments of the present application, cross entropy is used as the loss function.

[0065] In the specific implementation, cross entropy (CE) is used as the loss function, and regularization is used to increase model compatibility and retain pre-training information as much as possible. The loss function is as follows:

[0066]

[0067] In the formula, y i is the true value (0 or 1) corresponding to the i-th category, f i (x) is the output value corresponding to the model, w is the parameter that needs to be fine-tuned, and w pre-traing is the initial value of the parameter, that is, the parameter value of the pre-trained model; λ is the coefficient used to adjust the relationship between the empirical risk and the regularization term.

[0068] Furthermore, the adam (Adaptive Moment Estimation) algorithm is used to update the model parameters, and the learning rate is adjusted during training to promote faster convergence without manually adjusting the learning rate. In this embodiment, the model parameters are iterated according to the following formula:

[0069]

[0070] m k =β1m k-1 +(1-β1)g

[0071] v k =β2v k-1 +(1-β2)g⊙g

[0072]

[0073] In the formula, θ is the parameter of the neural network, CE(θ) is the cross entropy loss function, g is the gradient of the loss function with respect to the model parameters, and θ k is the parameter of the neural network for the kth iteration, m k and v k are estimates of the first and second moments of the gradient, respectively, and β1 and β2 are exponential decay rates. When the validation set loss does not decrease after 3 rounds, training is stopped.

[0074] Based on this, in an embodiment of the present application, the degree of fine-tuning of the layer is controlled, and a regularization term is added so that the fine-tuned parameters should be as close as possible to the original parameters, so as to retain the features previously learned by the pre-trained model, thereby retaining the knowledge captured by the pre-trained model.

[0075] In some embodiments of the present application, a Dropout layer is used during local debugging to reduce overfitting of the Web attack detection model on the debugging data set.

[0076] In the specific implementation, during the fine-tuning process, a Dropout layer is used, and some neurons are disabled in each iteration to ensure that the model does not rely heavily on any specific neurons and reduce overfitting.

[0077] Based on this, in an embodiment of the present application, a dropout layer is used to reduce overfitting of the model on the fine-tuning data set, and an adam adaptive learning rate algorithm is used to make the fine-tuning process more stable.

[0078] In summary, the embodiment of the present application first filters out normal traffic in real business scenarios based on statistical baselines according to indicators such as the number of visits, communication duration, traffic size, access frequency, access sequence, and access range, thereby reducing labor costs. The present embodiment extracts payload information, reduces interference to the model, and reduces the complexity of the model, so that the model can focus more on useful signals. The present embodiment forms a fine-tuning data set with normal traffic logs and black sample data of Web attacks collected in the laboratory, and then uses a local fine-tuning method to iteratively update some parameters of the neural network of the pre-trained Web attack model, and simultaneously freezes the initial layer of the model, uses cross entropy as the loss function, uses regularization, uses a Dropout layer, etc., to obtain a detection model with a low false alarm rate in real scenarios, which can retain the features previously learned by the pre-trained model, thereby retaining the knowledge captured by the pre-trained model, making the fine-tuning process more stable. The embodiment of the present application solves the problem of model failure caused by the distribution difference between the model training data and the real data of the model application environment.

[0079] It should be understood that, although the various steps in the flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0080] See also Figure 3 An embodiment of the present application provides a Web attack detection model debugging system, which includes a log screening module 10, a data set building module 20 and a model debugging module 30; wherein,

[0081] The log screening module 10 is used to collect HTTP logs through the traffic collector, screen the HTTP logs to obtain non-malicious logs, and obtain normal traffic logs in which the business behavior in the non-malicious logs is within the range of the traffic baseline;

[0082] The data set establishment module 20 is used to extract the payload from the normal traffic log, take the payload as the white sample set, take the historical Web attack data as the black sample set, and combine the white sample set and the black sample set into a debugging data set;

[0083] The model debugging module 30 is used to locally debug the fully connected layer of the pre-trained Web attack detection model using the debugging data set to iteratively update the neural network parameters of the pre-trained Web attack detection model.

[0084] For the specific definition of the above-mentioned Web attack detection model debugging system, please refer to the definition of the Web attack detection model debugging method above, which will not be repeated here. Each module in the above-mentioned Web attack detection model debugging system can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0085] In one embodiment, a computer device is provided, the internal structure diagram of which can be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above-mentioned Web attack detection model debugging method is implemented. It includes: a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the above-mentioned Web attack detection model debugging method is implemented.

[0086] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above Web attack detection model debugging method can be implemented.

[0087] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, C language, VHDL language, Verilog language, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0088] The present application is described with reference to the flowcharts and / or block diagrams of the systems and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0089] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0090] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0091] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0092] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A Web attack detection model debugging method, characterized in that: include: Collect HTTP logs through a traffic collector, filter out non-malicious logs from the HTTP logs, and obtain normal traffic logs in which business behaviors in the non-malicious logs are within the traffic baseline range; Extracting a payload from the normal traffic log, taking the payload as a white sample set, taking historical Web attack data as a black sample set, and combining the white sample set with the black sample set to form a debugging data set; The fully connected layer of the pre-trained Web attack detection model is locally debugged using the debugging data set to iteratively update the neural network parameters of the pre-trained Web attack detection model.

2. The Web attack detection model debugging method according to claim 1, characterized in that: The step of collecting HTTP logs by means of a traffic collector, screening out non-malicious logs from the HTTP logs, and obtaining normal traffic logs of business behaviors within the traffic baseline range from the non-malicious logs also includes: When, in the business behavior, the number of times the length of the Web service request body when the source IP address briefly accesses the external IP address is greater than the length of the response body is within the flow baseline range, and the number of different response body lengths is within the flow baseline range, and the number of different Refer data is within the flow baseline range, the business behavior is considered to be within the flow baseline range.

3. The Web attack detection model debugging method according to claim 2, characterized in that: The step of collecting HTTP logs by means of a traffic collector, screening out non-malicious logs from the HTTP logs, and obtaining normal traffic logs of business behaviors within the traffic baseline range from the non-malicious logs also includes: When the service behavior conforms to the UA-IP baseline rule or is any one of access regularity service, high-frequency service, and service running on multiple hosts, the service behavior is considered to be within the flow baseline range.

4. The Web attack detection model debugging method according to any one of claims 1 to 3, characterized in that: The step of collecting HTTP logs by means of a traffic collector, screening out non-malicious logs from the HTTP logs, and obtaining normal traffic logs of business behaviors within the traffic baseline range from the non-malicious logs also includes: The bag-of-words algorithm is used to extract features from the normal traffic log, and the isolation forest anomaly detection algorithm is used to eliminate abnormal logs to obtain low anomaly score logs, so as to denoise the normal traffic log.

5. The Web attack detection model debugging method according to claim 1, characterized in that: The step of locally debugging the fully connected layer of the pre-trained Web attack detection model using the debugging data set to iteratively update the neural network parameters of the pre-trained Web attack detection model also includes: The initial layer of the pre-trained Web attack detection model is frozen to prevent the initial layer from being updated when the local debugging is performed.

6. The Web attack detection model debugging method according to claim 5, characterized in that: The step of locally debugging the fully connected layer of the pre-trained Web attack detection model using the debugging data set to iteratively update the neural network parameters of the pre-trained Web attack detection model also includes: Cross entropy is used as the loss function.

7. The Web attack detection model debugging method according to claim 6, characterized in that: The step of locally debugging the fully connected layer of the pre-trained Web attack detection model using the debugging data set to iteratively update the neural network parameters of the pre-trained Web attack detection model also includes: When performing the local debugging, a Dropout layer is used to reduce overfitting of the Web attack detection model on the debugging data set.

8. A Web attack detection model debugging system, characterized in that: include: Log screening module, data set building module and model debugging module; among them, A log screening module is used to collect HTTP logs through a traffic collector, screen the HTTP logs to obtain non-malicious logs, and obtain normal traffic logs in which business behaviors in the non-malicious logs are within the range of the traffic baseline; A data set establishment module, used to extract a payload from the normal traffic log, use the payload as a white sample set, use historical Web attack data as a black sample set, and combine the white sample set and the black sample set into a debugging data set; The model debugging module is used to use the debugging data set to locally debug the fully connected layer of the pre-trained Web attack detection model to iteratively update the neural network parameters of the pre-trained Web attack detection model.

9. A computer device, characterized in that: include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and is configured to be executed by the processor to implement the Web attack detection model debugging method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon; the computer program is executed by a processor to implement a Web attack detection model debugging method as claimed in any one of claims 1 to 7.

Images