An attack detection method, apparatus and electronic device

Abstract

The application discloses an attack detection method and device and electronic equipment, and relates to the technical field of network security, to improve the accuracy and real-time performance of web attack detection, the method comprises the following steps: first, obtaining network request data to be identified, and preprocessing the network request data to be identified to obtain preprocessed network request data; then, a pre-trained target detection model is used to extract the deep semantic vector of the preprocessed network request data, and the similarity between the deep semantic vector and each semantic vector in a preset semantic vector library is calculated; finally, based on each similarity, the detection result of the network request data to be identified is determined. Through the above method, the detection model only needs to learn the semantic vectorization expression of the text, which reduces the training difficulty of the model, reduces the model parameters, and reduces the calculation amount of the model, thereby improving the detection efficiency.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to an attack detection method, apparatus, and electronic device. Background Technology

[0002] Currently, web attack detection functionality is mainly integrated into Web Application Firewalls (WAFs), which use WAFs to perform real-time detection of web traffic.

[0003] However, with the development of artificial intelligence technology, attempts have begun to be made to use deep learning models for web attack detection. However, deep learning models require a large amount of training data, and with such a large amount of training data, there is often dirty data, which can cause the trained deep learning model to learn incorrect knowledge, resulting in false negatives or false positives for web attacks. In addition, deep learning models often have a huge number of parameters, resulting in long detection times, making it difficult to meet the requirements for real-time web attack detection.

[0004] Therefore, improving the accuracy and real-time performance of web attack detection is a pressing technical problem that needs to be solved. Summary of the Invention

[0005] This application provides an attack detection method, apparatus, and electronic device to improve the accuracy and real-time performance of web attack detection.

[0006] Firstly, this application provides an attack detection method, the method comprising:

[0007] Obtain the network request data to be identified, and preprocess the network request data to be identified to obtain the preprocessed network request data;

[0008] A pre-trained object detection model is used to extract deep semantic vectors from the pre-processed network request data, and the similarity between the deep semantic vectors and each semantic vector in the preset semantic vector library is calculated; wherein, the preset semantic vector library is a semantic vector library set based on attack samples;

[0009] Based on the various similarities, the detection results of the network request data to be identified are determined; the detection results are used to indicate whether the network request data to be identified is normal data or attack data and the corresponding attack type.

[0010] Using the above method, the detection model only needs to learn the semantic vectorized representation of the text. During detection, the deep semantic vector of the data to be identified is compared with the semantic vector in the preset semantic vector library to calculate the similarity and thus obtain the detection result. The model has low training difficulty, few parameters, reduces the model's computation time, and improves the efficiency and accuracy of detection.

[0011] In one alternative implementation, the network request data to be identified is preprocessed, including:

[0012] The network request data is decoded according to a preset encoding character rule library to obtain the target decoding result;

[0013] The target decoding results are generalized and deduplicated.

[0014] By using the methods described above to preprocess the network data to be identified, the original text information in the network request to be identified can be restored to the greatest extent, thereby improving the detection accuracy of the model.

[0015] In one alternative implementation, the pre-trained object detection model is obtained as follows:

[0016] The training sample pair set is input into the detection model to be trained, and the cosine similarity of each training sample pair is calculated. The training sample pairs are obtained by randomly combining normal samples and / or attack samples in pairs. If the two attack samples have the same attack type, the label similarity of the training sample pair is 1; if the two attack samples have different attack types, the label similarity of the training sample pair is 0.5; or if a normal sample and an attack sample are combined, the label similarity of the training sample pair is 0.

[0017] The detection model to be trained is iteratively trained based on the cosine similarity of each pair of training samples and the label similarity of each pair of training samples to obtain a pre-trained target detection model.

[0018] The training method described above is relatively easy to implement, yet it achieves high detection accuracy.

[0019] In one optional implementation, the detection model to be trained is iteratively trained based on the cosine similarity of each pair of training samples and the label similarity of each pair of training samples to obtain a pre-trained target detection model, including:

[0020] Based on the cosine similarity and label similarity of each pair of training samples, the loss function corresponding to the detection model to be trained is calculated.

[0021] Based on the loss function, the model parameters of the detection model to be trained are adjusted until the loss function is less than a preset threshold, thus obtaining a pre-trained target detection model.

[0022] In one optional implementation, a preset semantic vector library is obtained in the following manner:

[0023] Obtain the original attack sample set;

[0024] The preprocessed attack sample is input into the target detection model to generate the corresponding semantic vector;

[0025] Calculate the similarity between pairwise semantic vectors, and remove duplicate semantic vectors with a similarity greater than a preset threshold.

[0026] Based on the deduplicated semantic vectors, a pre-defined semantic vector library is obtained.

[0027] The above method can be used to obtain a semantic vector library containing various attack types, which facilitates similarity calculation and thus determines the detection results.

[0028] In one optional implementation, the detection result of the network data to be identified is determined based on similarity, including:

[0029] Rank the similarities and determine the highest similarity.

[0030] If the maximum similarity is greater than a preset threshold, the network data to be identified is determined to be attack data and its attack type.

[0031] In one optional implementation, after determining the detection result of the network data to be identified based on similarity, the method further includes:

[0032] The preset semantic vector library is updated according to the preset time limit. If a new attack sample exists, the first deep semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second deep semantic vector in the preset semantic vector library changes to a normal sample, the second deep semantic vector is deleted from the preset semantic vector library.

[0033] The above method can update the preset semantic vector library, ensuring that the preset semantic vector library always contains relatively accurate attack samples, thereby improving the accuracy of detection.

[0034] Secondly, this application provides an attack detection device, the device comprising:

[0035] The processing module is used to acquire network request data to be identified and to preprocess the network request data to be identified to obtain preprocessed network request data.

[0036] The calculation module is used to extract deep semantic vectors from the preprocessed network request data using a pre-trained object detection model, and to calculate the similarity between the deep semantic vectors and each semantic vector in a preset semantic vector library; wherein, the preset semantic vector library is a semantic vector library set based on attack samples.

[0037] The identification module is used to determine the detection result of the network request data to be identified based on the various similarities; the detection result is used to indicate whether the network request data to be identified is normal data or attack data and the corresponding attack type.

[0038] In one optional implementation, when preprocessing the network request data to be identified, the processing module is specifically used for:

[0039] The network request data is decoded according to a preset encoding character rule library to obtain the target decoding result;

[0040] The target decoding results are generalized and deduplicated.

[0041] In an optional implementation, a training module is further included, the training module being specifically used for:

[0042] The training sample pair set is input into the detection model to be trained, and the cosine similarity of each training sample pair is calculated. The training sample pairs are obtained by randomly combining normal samples and / or attack samples in pairs. If the two attack samples have the same attack type, the label similarity of the training sample pair is 1; if the two attack samples have different attack types, the label similarity of the training sample pair is 0.5; or if a normal sample and an attack sample are combined, the label similarity of the training sample pair is 0.

[0043] The detection model to be trained is iteratively trained based on the cosine similarity of each pair of training samples and the label similarity of each pair of training samples to obtain a pre-trained target detection model.

[0044] In one optional implementation, when iteratively training the detection model to be trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples, the training module is specifically used for:

[0045] Based on the cosine similarity and label similarity of each pair of training samples, the loss function corresponding to the detection model to be trained is calculated.

[0046] Based on the loss function, the model parameters of the detection model to be trained are adjusted until the loss function is less than a preset threshold, thus obtaining a pre-trained target detection model.

[0047] In an optional implementation, the computing module is further configured to:

[0048] Obtain the original attack sample set;

[0049] The preprocessed attack sample is input into the target detection model to generate the corresponding semantic vector;

[0050] Calculate the similarity between pairwise semantic vectors, and remove duplicate semantic vectors with a similarity greater than a preset threshold.

[0051] Based on the deduplicated semantic vectors, a pre-defined semantic vector library is obtained.

[0052] In one optional implementation, when determining the detection result of the network data to be identified based on similarity, the identification module is specifically used for:

[0053] Rank the similarities and determine the highest similarity.

[0054] If the maximum similarity is greater than a preset threshold, the network data to be identified is determined to be attack data and its attack type.

[0055] In one optional implementation, after determining the detection result of the network data to be identified based on similarity, the calculation module is further configured to:

[0056] The preset semantic vector library is updated according to the preset time limit. If a new attack sample exists, the first deep semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second deep semantic vector in the preset semantic vector library changes to a normal sample, the second deep semantic vector is deleted from the preset semantic vector library.

[0057] Thirdly, this application provides an electronic device including a processor and a memory, wherein the memory stores program code that, when executed by the processor, causes the processor to perform the steps of the attack detection method described in the first aspect.

[0058] Fourthly, this application provides a computer-readable storage medium including program code that, when executed on an electronic device, causes the electronic device to perform the steps of the attack detection method described in the first aspect.

[0059] Fifthly, this application provides a computer program product that, when invoked by a computer, causes the computer to execute the attack detection method steps as described in the first aspect.

[0060] Furthermore, other features and advantages of this application will be set forth in the following description and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0062] Figure 1 A schematic diagram illustrating the implementation process of an attack detection method provided in this application embodiment;

[0063] Figure 2 This is a schematic diagram of the structure of an attack detection device provided in an embodiment of this application;

[0064] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0066] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. A connected to B can represent: A and B directly connected, or A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0067] Furthermore, the data collection, dissemination, and use in the technical solution of this application all comply with the requirements of relevant national laws and regulations.

[0068] The design concept of the embodiments of this application is briefly introduced below:

[0069] Currently, web attack detection functionality is mainly integrated into WAF, which uses WAF to perform real-time detection of web traffic.

[0070] However, with the development of artificial intelligence technology, attempts have begun to be made to use deep learning models for web attack detection. However, deep learning models require a large amount of training data, and with such a large amount of training data, there is often dirty data, which can cause the trained deep learning model to learn incorrect knowledge, resulting in false negatives or false positives for web attacks. In addition, deep learning models often have a huge number of parameters, resulting in long detection times, making it difficult to meet the requirements for real-time web attack detection.

[0071] Therefore, improving the accuracy and real-time performance of web attack detection is a pressing technical problem that needs to be solved.

[0072] In view of this, this application uses deep semantic vectors to detect web attacks, which can promptly correct the preset semantic vector library, improve the detection accuracy, and the model only needs to map the network data to be detected to the vector space, which will greatly reduce the model parameters and the amount of computation, thereby improving the real-time performance of detection.

[0073] Specifically, this application provides an attack detection method, which includes: first, acquiring network request data to be identified and preprocessing the network request data to obtain preprocessed network request data; then, using a pre-trained target detection model to extract deep semantic vectors from the preprocessed network request data, and calculating the similarity between the deep semantic vectors and each semantic vector in a preset semantic vector library; wherein, the preset semantic vector library is a semantic vector library set based on attack samples; finally, based on each similarity, determining the detection result of the network request data to be identified; the detection result is used to indicate whether the network request data to be identified is normal data, or whether the network request data to be identified is attack data and the corresponding attack type. Through the above method, only the speech vectorization representation of text data needs to be learned, reducing the training difficulty of the model and significantly improving the accuracy and real-time performance of web attack detection.

[0074] The attack detection method provided by exemplary embodiments of this application will now be described with reference to the accompanying drawings.

[0075] See Figure 1 The diagram shown illustrates the implementation flow of an attack detection method provided in this application. The specific implementation flow of this method is as follows:

[0076] S1: Obtain the network request data to be identified, and preprocess the network request data to be identified to obtain the processed network request data.

[0077] In this embodiment, the first step is to obtain the network request data to be identified. For example, the network request data to be identified may be Hypertext Transfer Protocol (HTTP). Specifically, to ensure normal data transmission and improve security, HTTP requests are typically encoded. For example, URL encoding or Unicode encoding may be used.

[0078] However, when extracting the deep semantic vector of the network request data to be identified, it is not possible to process it directly based on the encoded HTTP request. Therefore, it is necessary to preprocess the HTTP request to be identified to ensure that the deep semantic vector of the HTTP request can be successfully extracted in the future.

[0079] In one optional implementation, when preprocessing the network request data to be identified, the network request data to be identified is first decoded according to a preset encoding character rule library to obtain the target decoding result.

[0080] For example, the preset encoded character rule library can be a standard decoding library for Uniform Resource Locator (URL) decoding, a standard decoding library for Hyper Text Markup Language (HTML) decoding, a standard decoding library for Unicode decoding, etc., and this application embodiment does not impose specific limitations. The corresponding encoded character rule library can be selected for decoding according to the actual situation to obtain the target decoding result.

[0081] For example, at least one of URL decoding, HTML decoding, or Unicode decoding can be used to decode the network request data to be identified.

[0082] In this embodiment of the application, the network request data to be identified is decoded by a preset encoding character rule library, which can restore the original text information in the network request data to be identified to the greatest extent, so that the subsequent target detection model can extract the deep semantic vector of the network request data to be identified.

[0083] Furthermore, after obtaining the target decoding result corresponding to the network request data to be identified, it is also necessary to perform generalization processing and deduplication processing on the target decoding result.

[0084] Based on generalization processing, non-ASCII characters in the target decoding result can be removed, and long strings, large numbers, etc. can be replaced with specific tokens.

[0085] For example, a long string in the target decoding result: I need a pen, which can be used... <chinese>For example, a large number in the target decoding result: 8654187, can be replaced by... <num>replace.

[0086] Then, the target decoding result after generalization is deduplicated to remove duplicate text.

[0087] The above method is used to generalize the target decoding result corresponding to the network request data to be identified, converting the specific string into a generalized identifier, so that the subsequent target detection model can more accurately identify the deep semantic vector corresponding to the network request data to be identified.

[0088] S2: Use a pre-trained object detection model to extract deep semantic vectors from the pre-processed network request data, and calculate the similarity between the deep semantic vectors and each semantic vector in the preset semantic vector library.

[0089] In this embodiment of the application, the target detection model is used to identify whether the network request data of the network to be identified is normal data or attack data, and when the network request data to be identified is attack data, it can also accurately determine the attack type corresponding to the network request data to be identified.

[0090] In one alternative implementation, the pre-trained object detection model is obtained as follows:

[0091] Specifically, in this embodiment of the application, firstly, it is necessary to collect sample data, that is, to collect normal HTTP requests and attack data containing various attack types from historical datasets, such as SQL injection, distributed denial-of-service (DDoS) attacks, etc.

[0092] Similarly, after collecting normal HTTP requests and attack data containing various attack types, preprocessing is required. This involves decoding according to a pre-defined encoding character rule library, as described above, followed by generalization and deduplication of the decoding results. This application will not elaborate further on these details.

[0093] Furthermore, the preprocessed sample data needs to be combined to obtain the training sample pairs used to train the model.

[0094] Specifically, the collected sample data includes normal samples and attack samples. In this step, normal samples and attack samples need to be combined. That is, random samples are drawn from the collected sample data and combined in pairs to obtain training sample pairs.

[0095] It is understandable that the resulting training sample pairs can be combinations of normal samples and attack samples, combinations of attack samples, and combinations of normal samples. Therefore, label similarity can also be set for the training sample pairs.

[0096] In this embodiment, the label similarity between two attack samples with the same attack type is set to 1. For example, if attack sample 1's attack type is SQL injection and attack sample 2's attack type is also SQL injection, then the label similarity between attack sample 1 and attack sample 2 forming a training sample pair is 1. If attack sample 3's attack type is SQL injection and attack sample 4's attack type is DDoS attack, then the label similarity between attack sample 3 and attack sample 4 forming a training sample pair is 0.5. If a normal sample and an attack sample form a training sample pair, then the label similarity between the training sample pair is set to 0.

[0097] By combining normal samples and attack samples using the above method, a training sample pair set can be obtained based on the collected sample data.

[0098] Combining training sample pairs using the methods described above increases data diversity, helping the model learn a wider range of data distributions during subsequent training, improving generalization ability, and reducing overfitting risk. Furthermore, pairwise combinations of normal samples help the model learn the similarities and differences between them, which is crucial for identifying anomalous data. Pairwise combinations of attack samples help the model understand the diversity and complexity of anomalous data, enabling more accurate identification and reducing the risk of misclassifying normal data as anomalous. Finally, pairwise combinations of normal and anomalous samples allow the model to learn the boundaries and differences between them, improving its ability to distinguish between normal and anomalous data.

[0099] Furthermore, the obtained training samples are input into the detection model to be trained to obtain a target detection model that can accurately identify attack data.

[0100] Specifically, in this embodiment, the detection model to be trained can be a Siamese network model based on Sentence-BERT. The input to the detection model to be trained is the aforementioned set of training sample pairs. Based on the Siamese network structure, two BERT models with shared weights are used to encode the input training sample pairs. Each training sample pair obtains a token-level hidden state through the BERT model, and then the vector representation of the training sample pair is obtained through pooling operations (e.g., average pooling, max pooling, etc.). Furthermore, the cosine similarity of the training sample pair can be calculated.

[0101] Furthermore, based on the cosine similarity of each pair of training samples and the label similarity of each pair of training samples, the detection model to be trained is iteratively trained to obtain a pre-trained target detection model.

[0102] In one alternative implementation, after obtaining the cosine similarity of each pair of training samples, the loss function corresponding to the detection model to be trained can be calculated based on the cosine similarity and the label similarity of each pair of training samples.

[0103] For example, in this embodiment, the loss function can be the mean-squared error (MSE). For instance, if the cosine similarity of training sample pair 1 is 0.4 and the label similarity is 0.5, then the error between the cosine similarity and label similarity of training sample pair 1 can be calculated. Similarly, if the cosine similarity of training sample pair 2 is 0.8 and the label similarity is 1, then the error between the cosine similarity and label similarity of training sample pair 2 can be calculated. Likewise, the error between the cosine similarity and label similarity of all training sample pairs can be calculated. After obtaining the error between the cosine similarity and label similarity of all training sample pairs, the mean-squared error of the detection model to be trained can be calculated. The specific implementation process for calculating the mean-squared error will not be elaborated here.

[0104] Furthermore, after obtaining the mean squared error of the detection model to be trained, the convergence of the model can be determined based on the mean squared error. The weight parameters and bias parameters of the detection model to be trained are updated by the optimizer based on the mean squared error. The detection model to be trained is iteratively updated continuously until the detection model to be trained converges, or it is determined whether the number of iterations of the detection model to be trained has reached the predetermined number, thereby obtaining the trained target detection model.

[0105] In the embodiments of this application, the pre-trained target detection model can be used to implement web attack detection.

[0106] It should be noted that a semantic vector library needs to be pre-set before attack detection. This pre-set semantic vector library is based on attack samples and contains semantic vectors extracted from various attack data.

[0107] Specifically, in the embodiments of this application, a preset semantic vector library can be obtained in the following manner:

[0108] First, obtain the original attack sample set; this original attack sample set contains various types of attack data.

[0109] Then, the original attack sample is preprocessed, namely the aforementioned decoding, generalization, and deduplication. Since the preprocessing process described in this step is the same as the aforementioned preprocessing process, it will not be repeated here in the embodiments of this application.

[0110] Furthermore, each preprocessed original attack sample is input into a pre-trained target detection model, and the deep semantic vector corresponding to each original attack sample is extracted through the pre-trained target detection model.

[0111] Due to the existence of a large amount of data, extremely similar original attack samples will appear in the original attack sample set. After obtaining the deep semantic vector corresponding to each original sample, it is also necessary to perform deduplication on the obtained deep semantic vectors.

[0112] Specifically, the similarity between the deep semantic vectors corresponding to each pair of original samples can be calculated. For example, their cosine similarity can be calculated. If the similarity is greater than a preset threshold, such as 0.6, then one of the deep semantic vectors corresponding to each of the two original samples can be randomly selected and the other can be deleted, or the two deep semantic vectors can be averaged to obtain a new deep semantic vector.

[0113] Each original attack sample corresponds to a deep semantic vector, but it may contain dirty data, which can affect the detection results.

[0114] Therefore, a pre-defined clustering algorithm can be used to find outliers in these deep semantic vectors and determine whether these outliers are dirty data.

[0115] For example, in this embodiment, the K-means clustering algorithm can be used to find outliers. Specifically, the number of clusters K can be determined as the number of attack types. For instance, if there are 5 attack types, then the number of clusters K is 5. The K-means clustering algorithm allows attack samples of the same type to be mapped to the same space as much as possible. Then, it is determined whether outliers that do not enter any cluster are dirty data, and attack samples that are dirty data are deleted, thereby reducing the negative effect of dirty data on the detection model.

[0116] After deduplication and removal of dirty data from outliers using the methods described above, the deep semantic vectors corresponding to each of the remaining original attack samples can form a pre-defined semantic vector library.

[0117] It is understood that in the embodiments of this application, the deep semantic vector of the network request data to be identified can be extracted by the target detection model trained above, and then the similarity between the obtained deep semantic vector and each semantic vector in the aforementioned preset semantic vector library can be calculated. Cosine similarity can also be used here.

[0118] For example, if the deep semantic vector corresponding to the network request data to be identified is A, and the preset semantic vector library includes deep semantic vectors B, C, and D, then the similarity A between deep semantic vector A and deep semantic vector B, the similarity B between deep semantic vector A and deep semantic vector C, and the similarity C between deep semantic vector A and deep semantic vector D can be calculated.

[0119] S3: Based on each similarity, determine the detection result of the network request data to be identified.

[0120] In this embodiment of the application, after obtaining the similarity between the deep semantic vector of the network request data to be identified and each semantic vector in the preset semantic vector library, the detection result of the network request data to be identified can be obtained.

[0121] Specifically, in one optional implementation, firstly, the similarity between the deep semantic vector of the network request to be identified and each semantic vector in a preset semantic vector library is sorted.

[0122] For example, if similarity A is 0.9, similarity B is 0.95, and similarity C is 0.5, then after sorting, similarity B > similarity A > similarity C, indicating that the deep semantic vector corresponding to the network request data to be identified has the highest similarity to deep semantic vector C.

[0123] Then, if the maximum similarity is greater than the preset similarity threshold, the network data to be identified is determined to be attack data, and the attack type corresponding to the network request data to be identified can be determined, that is, the network request data to be identified has the same attack type as the deep semantic vector C in the above example, for example, the attack type is SQL injection.

[0124] If the maximum similarity is less than the preset similarity threshold, the network data to be identified is determined to be normal data.

[0125] In one optional implementation, the preset semantic vector library also needs to be updated periodically to ensure detection accuracy. If a new attack sample exists, the first deep semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second deep semantic vector in the preset semantic vector library changes to a normal sample, the second deep semantic vector is deleted from the preset semantic vector library. This ensures the accuracy of the samples in the preset semantic vector library, thereby improving detection precision.

[0126] Furthermore, based on the same technical concept, embodiments of this application provide an attack detection device for implementing the above-described method flow of embodiments of this application. See also... Figure 2 As shown, the device includes: a processing module 201, a calculation module 202, and a recognition module 203, wherein,

[0127] The processing module 201 is used to acquire network request data to be identified and to preprocess the network request data to be identified to obtain preprocessed network request data.

[0128] The calculation module 202 is used to extract deep semantic vectors from the preprocessed network request data using a pre-trained object detection model, and to calculate the similarity between the deep semantic vectors and each semantic vector in a preset semantic vector library; wherein, the preset semantic vector library is a semantic vector library set based on attack samples.

[0129] The identification module 203 is used to determine the detection result of the network request data to be identified based on each of the similarities; the detection result is used to indicate whether the network request data to be identified is normal data or whether the network request data to be identified is attack data and the corresponding attack type.

[0130] In one optional implementation, when preprocessing the network request data to be identified, the processing module 201 is specifically used for:

[0131] The network request data is decoded according to a preset encoding character rule library to obtain the target decoding result;

[0132] The target decoding results are generalized and deduplicated.

[0133] In an optional implementation, a training module 204 is further included, which is specifically used for:

[0134] The training sample pair set is input into the detection model to be trained, and the cosine similarity of each training sample pair is calculated. The training sample pairs are obtained by randomly combining normal samples and / or attack samples in pairs. If the two attack samples have the same attack type, the label similarity of the training sample pair is 1; if the two attack samples have different attack types, the label similarity of the training sample pair is 0.5; or if a normal sample and an attack sample are combined, the label similarity of the training sample pair is 0.

[0135] The detection model to be trained is iteratively trained based on the cosine similarity of each pair of training samples and the label similarity of each pair of training samples to obtain a pre-trained target detection model.

[0136] In an optional implementation, when iteratively training the detection model to be trained based on the cosine similarity corresponding to each pair of training samples and the label similarity corresponding to each pair of training samples, the training module 204 is specifically used for:

[0137] Based on the cosine similarity and label similarity of each pair of training samples, the loss function corresponding to the detection model to be trained is calculated.

[0138] Based on the loss function, the model parameters of the detection model to be trained are adjusted until the loss function is less than a preset threshold, thus obtaining a pre-trained target detection model.

[0139] In an optional implementation, the computing module 202 is further configured to:

[0140] Obtain the original attack sample set;

[0141] The preprocessed attack sample is input into the target detection model to generate the corresponding semantic vector;

[0142] Calculate the similarity between pairwise semantic vectors, and remove duplicate semantic vectors with a similarity greater than a preset threshold.

[0143] Based on the deduplicated semantic vectors, a pre-defined semantic vector library is obtained.

[0144] In one optional implementation, when determining the detection result of the network data to be identified based on similarity, the identification module 203 is specifically used for:

[0145] Rank the similarities and determine the highest similarity.

[0146] If the maximum similarity is greater than a preset threshold, the network data to be identified is determined to be attack data and its attack type.

[0147] In an optional implementation, after determining the detection result of the network data to be identified based on similarity, the calculation module 202 is further configured to:

[0148] The preset semantic vector library is updated according to the preset time limit. If a new attack sample exists, the first deep semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second deep semantic vector in the preset semantic vector library changes to a normal sample, the second deep semantic vector is deleted from the preset semantic vector library.

[0149] Based on the same technical concept, embodiments of this application also provide an electronic device that can implement the attack detection method flow provided in the above embodiments of this application. In one embodiment, the electronic device may be a server, a terminal device, or other electronic equipment. See also... Figure 3 As shown, the electronic device may include:

[0150] At least one processor 301 and a memory 302 connected to at least one processor 301. In this embodiment, the specific connection medium between the processor 301 and the memory 302 is not limited. Figure 3 The example shown is the connection between processor 301 and memory 302 via bus 300. Bus 300 is... Figure 3 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Bus 300 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 3 The term 301 is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 301 can also be called a controller; there is no restriction on the name.

[0151] In this embodiment, memory 302 stores instructions executable by at least one processor 301. By executing the instructions stored in memory 302, at least one processor 301 can execute an attack detection method as described above. Processor 301 can implement... Figure 2 The functions of each module in the device shown.

[0152] The processor 301 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 302 and calling data stored in memory 302, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0153] In one possible design, processor 301 may include one or more processing units. Processor 301 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 301. In some embodiments, processor 301 and memory 302 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0154] Processor 301 can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of an attack detection method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0155] Memory 302, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 302 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 302 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 302 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0156] By designing and programming the processor 301, the code corresponding to the frequency offset estimation method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute it during operation. Figure 1 The steps of an attack detection method according to the illustrated embodiment are described below. How to design and program the processor 301 is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0157] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform an attack detection method described above.

[0158] In some possible implementations, this application also provides that various aspects of an attack detection method can be implemented as a program product including program code, which, when the program product is run on a device, causes the control device to perform the steps in an attack detection method according to various exemplary embodiments of this application as described above.

[0159] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0160] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0161] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0162] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0163] Program code for performing the operations of this application can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0164] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0165] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.< / num> < / chinese>

Claims

1. An attack detection method, characterized in that, The method includes: Obtain the network request data to be identified, and preprocess the network request data to be identified to obtain preprocessed network request data; A pre-trained object detection model is used to extract deep semantic vectors from the preprocessed network request data, and the similarity between the deep semantic vectors and each semantic vector in a preset semantic vector library is calculated; wherein, the preset semantic vector library is a semantic vector library set based on attack samples; the object detection model is trained in the following manner: The training sample pair set is input into the detection model to be trained, and the cosine similarity of each training sample pair is calculated. The training sample pair is obtained by randomly combining normal samples and / or attack samples in pairs. If the two attack samples have the same attack type, the label similarity of the training sample pair is 1; if the two attack samples have different attack types, the label similarity of the training sample pair is 0.5; or if a normal sample and an attack sample are combined, the label similarity of the training sample pair is 0. The detection model to be trained is iteratively trained based on the cosine similarity and the label similarity of each pair of training samples to obtain the pre-trained target detection model. Based on the various similarities, the detection result of the network request data to be identified is determined; the detection result is used to indicate whether the network request data to be identified is normal data or whether the network request data to be identified is attack data and the corresponding attack type.

2. The method as described in claim 1, characterized in that, Preprocessing the network request data to be identified includes: The network request data is decoded according to a preset encoding character rule library to obtain the target decoding result; The target decoding result is then subjected to generalization and deduplication processing.

3. The method as described in claim 1, characterized in that, The step of iteratively training the detection model to be trained based on the cosine similarity and label similarity of each pair of training samples to obtain the pre-trained target detection model includes: Based on the cosine similarity and the label similarity of each pair of training samples, the loss function corresponding to the detection model to be trained is calculated. Based on the loss function, the model parameters of the detection model to be trained are adjusted until the loss function is less than a preset threshold, thereby obtaining the pre-trained target detection model.

4. The method as described in claim 1, characterized in that, The preset semantic vector library is obtained in the following manner: Obtain the original attack sample set; The preprocessed attack sample is input into the target detection model to generate the corresponding semantic vector; Calculate the similarity between pairwise semantic vectors, and remove duplicate semantic vectors with a similarity greater than a preset threshold. Based on the deduplicated semantic vectors, the preset semantic vector library is obtained.

5. The method as described in claim 1, characterized in that, The step of determining the detection result of the network data to be identified based on the similarity includes: The various similarities are sorted to determine the highest similarity. If the maximum similarity is greater than a preset threshold, then the network data to be identified is determined to be attack data and its attack type.

6. The method according to any one of claims 1-5, characterized in that, After determining the detection result of the network data to be identified based on the similarity, the method further includes: The preset semantic vector library is updated according to a preset time limit. If a new attack sample exists, the first deep semantic vector corresponding to the new attack sample is added to the preset semantic vector library. If the detection result corresponding to the second deep semantic vector in the preset semantic vector library changes to a normal sample, the second deep semantic vector is deleted from the preset semantic vector library.

7. An attack detection device, characterized in that, The device includes: The processing module is used to acquire network request data to be identified and to preprocess the network request data to be identified to obtain preprocessed network request data. The calculation module is used to extract deep semantic vectors from the preprocessed network request data using a pre-trained object detection model, and to calculate the similarity between the deep semantic vectors and each semantic vector in a preset semantic vector library; wherein, the preset semantic vector library is a semantic vector library set based on attack samples; the object detection model is trained in the following manner: The training sample pair set is input into the detection model to be trained, and the cosine similarity of each training sample pair is calculated. The training sample pair is obtained by randomly combining normal samples and / or attack samples in pairs. If the two attack samples have the same attack type, the label similarity of the training sample pair is 1; if the two attack samples have different attack types, the label similarity of the training sample pair is 0.5; or if a normal sample and an attack sample are combined, the label similarity of the training sample pair is 0. The detection model to be trained is iteratively trained based on the cosine similarity and the label similarity of each pair of training samples to obtain the pre-trained target detection model. The identification module is used to determine the detection result of the network request data to be identified based on the various similarities; the detection result is used to indicate whether the network request data to be identified is normal data or attack data and the corresponding attack type.

8. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

Images