Cross-site scripting attack detection method, device, equipment, medium and product

Abstract

The invention provides a cross-site scripting attack detection method, device and equipment, a medium and a product, which are applied to the technical field of computers, and are used for detecting a cross-site scripting attack by acquiring a pre-trained dynamic depth automatic encoder model and performing threshold selection on the pre-trained dynamic depth automatic encoder model. Determining a target error threshold value for cross-site scripting attack detection; obtaining to-be-detected current webpage feature data, and determining a current reconstruction error of the current webpage feature data by adopting a pre-trained dynamic depth automatic encoder model; and comparing the current reconstruction error with a target error threshold, and determining a cross-site scripting attack detection result of the current webpage feature data according to a comparison result. The target error threshold value determined based on the dynamic depth automatic encoder model is combined with the current reconstruction error to determine the cross-site scripting attack detection result, so that the detection precision of the cross-site scripting attack in a complex scene is improved, and the false alarm rate and the missing report rate are effectively balanced and reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a cross-site scripting attack detection method, device, equipment, medium and product. BACKGROUND

[0002] At present, with the popularity of the Internet, Web (World Wide Web) applications are widely used, and the attack forms against Web applications are also increasingly diversified, such as cross-site scripting (XSS). Cross-site scripting attacks inject malicious scripts into web pages to tamper with the appearance of websites, steal information, and fake user operations.

[0003] In the prior art, the detection schemes for cross-site scripting attacks include static analysis, dynamic analysis, and hybrid analysis. Static analysis detects vulnerabilities through code review, but results in a large number of false positives. Dynamic analysis analyzes the behavior of application runtime, which can only detect vulnerabilities in the execution path, but cannot locate vulnerabilities in components that have not been executed. Hybrid analysis combines static analysis and dynamic analysis for detection.

[0004] However, in the above-mentioned manner, there are problems of low detection accuracy, high false positive rate and high false negative rate in the detection process, which is difficult to cope with complex attack scenarios. SUMMARY

[0005] In view of the above problems, a cross-site scripting attack detection method, device, equipment, medium and product are provided to overcome the above problems or at least partially solve the above problems, comprising: A cross-site scripting attack detection method, the method comprising: Obtaining a pre-trained dynamic deep autoencoder model, and performing threshold selection on the pre-trained dynamic deep autoencoder model to determine a target error threshold for cross-site scripting attack detection; Obtaining current web feature data to be detected, and using the pre-trained dynamic deep autoencoder model to determine a current reconstruction error of the current web feature data; Comparing the current reconstruction error with the target error threshold, and determining a cross-site scripting attack detection result of the current web feature data according to the comparison result.

[0006] Optionally, before obtaining the pre-trained dynamic deep autoencoder model, further comprising: Building a dynamic deep autoencoder model; Obtaining a web feature data set; wherein the web feature data set includes a training set; The dynamic deep auto-encoder model is trained by using the training set.

[0007] Optionally, the webpage feature data set further comprises a verification set; threshold selection is performed on the pre-trained dynamic deep auto-encoder model to determine a target error threshold for cross-site scripting attack detection, comprising: The pre-trained dynamic deep auto-encoder model is used to determine a verification reconstruction error of the verification webpage feature data in the verification set. The current error threshold is obtained, and the current error threshold is iteratively updated. For each iteratively updated current error threshold, the verification reconstruction error and the current error threshold are combined to determine a detection result evaluation score corresponding to the current error threshold. According to the detection result evaluation score, a target error threshold for cross-site scripting attack detection is determined from the iteratively updated current error threshold.

[0008] Optionally, for each iteratively updated current error threshold, the verification reconstruction error and the current error threshold are combined to determine a detection result evaluation score corresponding to the current error threshold, comprising: For each iteratively updated current error threshold, the verification reconstruction error and the current error threshold are compared, and according to the comparison result, a cross-site scripting attack detection result of the verification webpage feature data is determined. According to the cross-site scripting attack detection result of the verification webpage feature data, a detection result evaluation score corresponding to the current error threshold is determined.

[0009] Optionally, according to the cross-site scripting attack detection result of the verification webpage feature data, a detection result evaluation score corresponding to the current error threshold is determined, comprising: According to the cross-site scripting attack detection result of the verification webpage feature data, a detection precision and a detection recall rate corresponding to the current error threshold are determined. According to the detection precision and the detection recall rate, a detection result evaluation score corresponding to the current error threshold is determined.

[0010] Optionally, the initial value of the current error threshold is the maximum value in the verification reconstruction error.

[0011] Optionally, before the dynamic deep auto-encoder model is trained by using the training set, further comprising: The webpage feature data in the webpage feature data set is preprocessed.

[0012] Optionally, the webpage feature data in the webpage feature data set is preprocessed, comprising: The webpage feature data in the webpage feature data set is de-duplicated; and / or, the webpage feature data in the webpage feature data set is normalized.

[0013] Optionally, the webpage feature data set includes any one or more types of webpage feature data: URL-based webpage feature data, HTML-based webpage feature data, JavaScript-based webpage feature data.

[0014] Optionally, according to the comparison result, the cross-site scripting attack detection result of the current webpage feature data is determined, including: If the current reconstruction error is less than or equal to the target error threshold, it is determined that the current webpage feature data is normal traffic data. If the current reconstruction error is greater than the target error threshold, it is determined that the current webpage feature data is network attack data.

[0015] Optionally, the dynamic deep autoencoder model includes an encoder and a decoder, the encoder has at least two encoding layers, and at least one layer of the at least two encoding layers adopts a cross-layer residual connection structure.

[0016] A cross-site scripting attack detection device, the device comprises: A threshold selection module for obtaining a pre-trained dynamic deep autoencoder model and performing threshold selection on the pre-trained dynamic deep autoencoder model to determine a target error threshold for cross-site scripting attack detection; A current reconstruction error determination module for obtaining current webpage feature data to be detected and determining a current reconstruction error of the current webpage feature data using a pre-trained dynamic deep autoencoder model; A cross-site scripting attack detection result determination module for comparing the current reconstruction error with the target error threshold and determining the cross-site scripting attack detection result of the current webpage feature data according to the comparison result.

[0017] An electronic device comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the computer program being executed by the processor to implement the method described above.

[0018] A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the method described above.

[0019] A computer program product comprising a computer program, the computer program being executed by a processor to implement the method described above.

[0020] Embodiments of the present application have the following advantages: In the embodiments of the present application, by acquiring a pre-trained dynamic deep autoencoder model, and performing threshold selection on the pre-trained dynamic deep autoencoder model to determine a target error threshold for cross-site scripting attack detection, acquiring current webpage feature data to be detected, and using the pre-trained dynamic deep autoencoder model to determine a current reconstruction error of the current webpage feature data, comparing the current reconstruction error with the target error threshold, and determining a cross-site scripting attack detection result of the current webpage feature data according to the comparison result, the target error threshold determined based on the dynamic deep autoencoder model is combined with the current reconstruction error to determine the cross-site scripting attack detection result, thereby improving the detection accuracy of cross-site scripting attacks in complex scenarios, and effectively balancing and reducing the false positive rate and the false negative rate. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed to be used in the description of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained according to these drawings without creative labor for those skilled in the art.

[0022] Figure 1 is a step flow chart of a cross-site scripting attack detection method one provided by some embodiments of the present application; Figure 2 is an architecture diagram of a dynamic deep autoencoder provided by some embodiments of the present application; Figure 3 is a data flow diagram of a dynamic deep autoencoder provided by some embodiments of the present application; Figure 4 is a step flow chart of training a dynamic deep autoencoder model provided by some embodiments of the present application; Figure 5 is a step flow chart of a cross-site scripting attack detection method two provided by some embodiments of the present application; Figure 6 is a structural block diagram of a cross-site scripting attack detection device provided by some embodiments of the present application. DETAILED DESCRIPTION

[0023] In order to make the above objectives, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0024] In the related art, the detection method for XSS attacks can be applied to the client side and the server side, and various methods for different attack media are used for analysis. The detection method can include static analysis, dynamic analysis and hybrid analysis, which will be described below: 1. Static analysis, code review of web applications, including review of source code, bytecode or binary code, to find out how data flow or control flow will flow before the application is executed. However, due to complexity and technical limitations, some static analysis methods cannot observe input validation routines, resulting in a large number of false positives.

[0025] 2. Dynamic analysis, a dynamic method by focusing on the runtime behavior of the application, the information collected during the execution of the application is used to find vulnerabilities at runtime. Dynamic analysis is mainly applied to the testing stage of the development or runtime of the software package after release. However, dynamic analysis can only detect vulnerabilities in the execution path, but cannot locate vulnerabilities in components that have not been executed in the code.

[0026] 3. Hybrid analysis, which combines static analysis and dynamic analysis to analyze the application.

[0027] In the related art, tools for mitigating XSS attacks can be used to filter or escape input data based on rule or pattern matching mechanisms to prevent the execution of malicious scripts. However, these tools rely on known attack patterns and may not be able to effectively identify new or variant XSS attacks, and cannot fully identify XSS attack vulnerabilities in applications.

[0028] Since there is no single defense solution that can successfully mitigate XSS attacks or completely solve the defects in the program source code. In the related art, machine learning methods such as Support Vector Machine, Decision Tree, etc. can also be used to detect XSS attacks. However, it is difficult for machine learning methods to detect attacks in a large data set.

[0029] Based on this, the embodiment of the present application proposes a deep autoencoder based on a dynamic deep encoder structure to learn the features in the XSS dataset, and reconstructs the features through an encoder based on cross-layer residual connection and mixed activation function and a multi-layer decoder. This structure can capture the dynamic features of XSS attacks and adapt to XSS attacks such as DOM-based XSS (Document Object Model-based Cross-Site Scripting), Mutation XSS (Mutation-based Cross-Site Scripting) and other obfuscation attacks, so as to accurately detect more XSS attacks.

[0030] Secondly, the present application also proposes a threshold iterative updating algorithm based on The threshold iterative updating algorithm distinguishes from the fixed threshold or the simple iterative method for selecting the threshold, which only focuses on the false positive rate. The present application can better adapt to the attack distribution under different network environments, balance the false positive rate and the false negative rate, and reduce the false negative rate.

[0031] Specifically, the dynamic deep autoencoder based on the dynamic deep encoder structure can be trained first to obtain a high-precision detection model that can accurately identify XSS attacks. Then, based on the threshold iterative updating algorithm, the optimal threshold is selected by calculating the accuracy on the validation set. The optimal threshold is iteratively updated by the algorithm, and a model that can accurately detect network attack data and avoid false positives and false negatives as much as possible is obtained. In addition, the threshold-based method can detect known types and obfuscated XSS attacks with dynamic features at the same time, further improving the security in the network access process.

[0032] For example, the dataset can be preprocessed first, and the dataset is randomly screened to obtain a training set and a test set, and a normalization strategy is used to eliminate the mutual influence of different dimensional data. The designed dynamic deep autoencoder based on cross-layer residual connection and mixed activation function (Sigmoid-ReLU) is used for encoding and decoding operation, and the model is trained by minimizing the reconstruction error in the training set. For the sample to be detected, when the calculated reconstruction error exceeds the set threshold, the data can be judged as network attack data.

[0033] In the above embodiments, the XSS attack detection based on the dynamic deep encoder structure and the threshold iterative updating algorithm can effectively improve the security of the network and reduce the influence of XSS attacks on users and enterprises. By analyzing the reconstruction error difference between normal traffic data and network attack data, real-time detection of known and unknown XSS attacks is realized, which can quickly respond to attack variants, reduce data leakage risks and economic losses, and provide a high-precision, low-latency adaptive security protection scheme for Web applications.

[0034] The following will be described in detail with reference to the accompanying drawings Figure 1 Further description of the present application is as follows: Reference Figure 1 , a step flowchart of a cross-site scripting attack detection method provided by some embodiments of the present application is shown, which can specifically include the following steps: Step 101, obtaining a pre-trained dynamic deep autoencoder model, and selecting a threshold value for the pre-trained dynamic deep autoencoder model to determine a target error threshold value for cross-site scripting attack detection.

[0035] As some examples, the dynamic deep autoencoder (DDAE) can be a deep learning model architecture combining cross-layer residual connection and hybrid activation function.

[0036] After obtaining the pre-trained dynamic deep autoencoder model, the current error threshold value that reaches the iterative updating stop condition when training the DDAE model can be obtained and used as the target error threshold value for cross-site scripting attack detection.

[0037] In some embodiments of the present application, before obtaining the pre-trained dynamic deep autoencoder model, it further includes: constructing a dynamic deep autoencoder model; obtaining a web feature dataset; wherein the web feature dataset includes a training set; using the training set to train the dynamic deep autoencoder model.

[0038] In some examples, the dynamic deep autoencoder model architecture can be constructed in advance, as shown in Figure 2 It can include an input layer, a hidden layer and an output layer.

[0039] Among them, the encoder in the dynamic deep autoencoder model can compress the high-dimensional data of the input layer into low-dimensional features of the hidden layer, and the decoder can map the low-dimensional features of the hidden layer back to the reconstruction data consistent with the dimension of the input layer, and output through the output layer.

[0040] In the encoding stage, the encoding function can be used to convert the input high-dimensional data into low-dimensional data, such as calculated by the following formula 1: (Formula 1) For example, using functions Initial input Convert to hidden representation Among them, the nonlinear activation function Here you can choose Sigmoid. Represents weight, This represents the bias. The randomly initialized dynamic depth autoencoder iteratively updates its parameters through backpropagation.

[0041] During the decoding stage, a decoding function can be used to reconstruct low-dimensional data into reconstructed data with the same dimensions as the input, as calculated using the following formula 2: (Formula 2) For example, using functions To hide the representation Reconstructed Through nonlinear activation function To refactor, Represents weight, This represents the bias.

[0042] The training of a dynamic depth autoencoder involves finding the parameters using a backpropagation algorithm. The objective function is to minimize the sum of reconstruction errors in the training set D. The calculation formula 3 is as follows: (Formula 3) Where L is the reconstruction error, the reconstruction error of the dynamic depth autoencoder can be measured by the square of the error to measure the similarity between the input information and the reconstructed information.

[0043] In dynamic depth autoencoders, since the data has been preprocessed, the reconstruction error can be represented by cross-entropy loss, calculated as shown in Formula 4 below: (Formula 4) Where log refers to the logarithmic function and i refers to the eigenvalue.

[0044] In some embodiments of the present invention, the dynamic depth autoencoder model includes an encoder and a decoder, the encoder having at least two coding layers, and at least one of the at least two coding layers employing a cross-layer residual connection structure.

[0045] As some examples, the encoder can be composed of at least two encoding layers in series for layer-by-layer compression, abstraction, and transformation of high-dimensional input data (such as a 67-dimensional feature vector of XSS attacks) into a low-dimensional hidden feature representation. The decoder can receive the low-dimensional hidden features output by the encoder and reconstruct them into output data consistent with the original input dimension through layer-by-layer reverse mapping, and determine whether the data is abnormal by calculating the error (reconstruction error) between the input and the reconstructed output.

[0046] As Figure 3 , the dynamic deep autoencoder can input a feature vector with 67 features The output feature vector is obtained by decoding the encoded data through the corresponding decoder.

[0047] Among them, the cross-layer residual connection structure refers to the output of a certain layer in the encoder, which can not only be obtained by weighted transformation of the output of the previous layer, but also be connected to the output of a shallower layer and fused according to the weight.

[0048] In some examples, the cross-layer residual connection structure can be placed in the deep layer (such as the second layer) of the encoder. It can input the results after linear transformation and activation function (such as ReLU) processing of the current layer, as well as the original or shallow features from a certain layer (such as the first layer) in front. The weighted sum of the two is taken as the final output of the layer, so that the model can capture local details and global abstraction at the same time, and improve the dynamic perception and representation ability of hidden and confusing features in XSS attacks.

[0049] For example, the dynamic deep autoencoder can use a combination of a two-layer encoder and a layer decoder, with the number of neurons in each layer of the encoder being 67→36→20, and the number of neurons in the decoder being 20→36→67, to enhance the abstraction ability of the encoder. In order to enhance the dynamic feature extraction ability of the model, the second encoding layer can not use the form of full connection, but use the cross-layer residual connection mode. The output calculation formula 5 of this layer is as follows: (Formula 5) Among them, As the output, ReLu is the activation function selected by the layer, is the weight, is the input of the second layer, is the bias, is the weight coefficient, is the input of the first layer. During the training process, can be automatically optimized through backpropagation, and dynamically adjust the fusion ratio of shallow and deep features according to the attack feature distribution of the input data.

[0050] In the above examples, except for the second layer of the encoder which uses ReLU (Rectified Linear Unit), the activation function is Sigmoid (Sigmoid Function). By using a hybrid activation function, the encoder can not only improve training speed, but also enhance high-frequency features (such as the abnormal symbol combinations of XSS attacks) through the linear rectified function, dynamically focus on key attack patterns, adaptively adjust feature representation, and improve the generalization ability to unknown attacks.

[0051] As examples, webpage feature data can be obtained from data sources or web crawlers to obtain a webpage feature dataset. By preprocessing the webpage feature dataset, it can be divided into a training set, a validation set, and a test set.

[0052] In some embodiments of the present invention, the method further includes: preprocessing the webpage feature data in the webpage feature dataset.

[0053] After obtaining the webpage feature dataset, the webpage feature data in the dataset can be preprocessed, such as deduplication and normalization, and then the preprocessed webpage feature dataset can be input into the dynamic deep autoencoder model for training.

[0054] In some embodiments of the present invention, preprocessing of the webpage feature data in the webpage feature dataset includes: deduplicating the webpage feature data in the webpage feature dataset; and / or normalizing the webpage feature data in the webpage feature dataset.

[0055] As some examples, deduplication refers to removing duplicate samples in a dataset with identical feature vectors to avoid training bias and overfitting; normalization refers to mapping feature values ​​of each dimension to a uniform interval (such as [0, 1]) through linear transformation to eliminate differences in the scale and range of different features.

[0056] like Figure 4 After obtaining the webpage feature dataset, it can be preprocessed (e.g., deduplication). After removing duplicate data, the webpage feature dataset is divided into training set, validation set, and test set. The data is divided in an 8:1:1 ratio using random sampling. 80% of the total dataset is used as the training set for training, 10% as the validation set to determine the target error threshold, and 10% as the test set to measure the training effect of the trained model, so as to increase the generalization ability of the trained model and enable it to achieve accurate detection under different XSS attacks.

[0057] Then, the original data is processed using a normalization strategy to normalize the data of different dimensions to [0, 1], eliminate the influence of different dimensions of data with different dimensions, and accelerate the convergence speed of the dynamic deep auto-encoder model. The calculation formula 6 is as follows: (Formula 6) Wherein, X is input data, min is the minimum value of normalization, max is the maximum value of normalization, and A is the current data set to be normalized.

[0058] In some embodiments of the application, the web feature data set includes any one or more types of web feature data: URL (Uniform Resource Locator, Uniform Resource Locator) based web feature data, HTML (HyperText Markup Language, HyperText Markup Language) based web feature data, JavaScript (programming language) based web feature data.

[0059] After preprocessing the web feature data in the web feature data set, the training set data divided according to the web feature data set can be input into the model, and the reconstruction error is minimized by the back propagation algorithm, so that the model learns the feature distribution of normal web traffic, and the dynamic deep auto-encoder model is trained.

[0060] In some embodiments of the application, the web feature data set further includes a validation set; the threshold value of the pre-trained dynamic deep auto-encoder model is selected to determine the target error threshold for cross-site scripting attack detection, including: Substep 11, using the pre-trained dynamic deep auto-encoder model, determining the validation reconstruction error of the validation web feature data in the validation set.

[0061] As some examples, the validation reconstruction error can be a set of multiple reconstruction errors, and the reconstruction error refers to the difference threshold between the output data and the original input data. Wherein, each reconstruction error corresponds to a web feature data sample in the validation set.

[0062] For example, the web feature data in the validation set can be input into the trained dynamic deep auto-encoder model, and after the model encodes and decodes the input data, the difference threshold between the output data and the original input data can be determined.

[0063] In some examples, after the dynamic deep auto-encoder model training is completed, the model can be loaded, and the feature vector of each web feature data sample in the validation set can be input in turn to perform forward propagation to obtain a reconstruction output, and then the reconstruction error of each web feature data sample can be calculated according to the above formula 4, and each obtained reconstruction error can form a set (i.e., a validation reconstruction error) to reflect the reconstruction performance distribution of the model on the normal validation data, and to provide key input data for the subsequent threshold selection algorithm.

[0064] For example, a sample containing 67 normalized features (such as a feature vector representing a normal login page) is taken from a 10% validation set and input into the trained dynamic deep auto-encoder model. The model encodes and decodes to output a reconstruction vector, and the system calculates the cross-entropy loss between the original vector and the reconstruction vector to obtain a single reconstruction error of 0.02. After traversing all the validation set samples, the validation reconstruction error (such as 0.01 to 0.09) can be obtained.

[0065] In step 12, the current error threshold is obtained, and the current error threshold is iteratively updated. For each iteratively updated current error threshold, the detection result evaluation score corresponding to the current error threshold is determined in combination with the validation reconstruction error and the current error threshold.

[0066] In some embodiments of the present application, the initial value of the current error threshold is the maximum value in the validation reconstruction error.

[0067] In some examples, the maximum reconstruction error can be determined from the validation reconstruction error, and the maximum value can be set as the initial value of the current error threshold. For example, the maximum value of the reconstruction error in the validation reconstruction error is 0.09, and the initial value (such as 0) of the current error threshold is set to 0.09.

[0068] As some examples, after the current error threshold is obtained, the current error threshold can be iteratively updated by using a preset threshold iterative update algorithm.

[0069] In the iterative update of the current error threshold, a maximum number of iterations or an evaluation score threshold can be set as a stop condition for the iterative update. When the stop condition for the iterative update is reached, the iterative update of the current error threshold is stopped.

[0070] In some examples, the preset threshold iterative update algorithm can be executed in the following way: Input: training set , validation set , trained DDAE model, β = 2, learning rate η = 0.001, max_iters = 1000 (maximum number of iterations); Output: Optimal threshold (Current error threshold); 1. Using the training set Train the DDAE model to obtain the maximum reconstruction error. ; 2. Initialize the optimal threshold and threshold values: ; 3. Initialize best_Fβ=0, previous_Fβ=0, iters=0; 4. while iters <max_iters; 5. Use the validation set to calculate Fβ; 6. Calculate the gradient grad = Fβ previou_Fβ / (threshold previous_threshold); 7. Update threshold=threshold η×grad; 8. if: Fβ > best_Fβ; 9. Update best_threshold=threshold; 10. Update best_Fβ=Fβ; 11.iters=iters+1, previous_threshold=threshold, previous_Fβ=Fβ; 12. end while; 13. Return best_threshold.

[0071] In the example above, the initial optimal threshold is the maximum reconstruction error of the current model training. The gradient descent iterative method is used to calculate the current Fβ value and gradient in each iteration and update the threshold of the current iteration. In addition, the values ​​of best_threshold and best_Fβ are updated based on this value to obtain a threshold that takes into account both the false positive rate and the false negative rate after the iteration is completed.

[0072] In some embodiments of the present application, for each iteration of the updated current error threshold, in combination with the validation reconstruction error and the current error threshold, the detection result evaluation score corresponding to the current error threshold is determined, including: for each iteration of the updated current error threshold, comparing the validation reconstruction error with the current error threshold, and determining the cross-site scripting attack detection result of the validation webpage feature data according to the comparison result; determining the detection result evaluation score corresponding to the current error threshold according to the cross-site scripting attack detection result of the validation webpage feature data.

[0073] As some examples, when the current error threshold is updated each time, each reconstruction error in the validation reconstruction error can be compared with the current error threshold to determine the comparison result (such as greater than, less than, or equal to).

[0074] After obtaining the comparison result, the cross-site scripting attack detection result of the webpage feature data sample corresponding to each reconstruction error can be determined according to the comparison result, such as network attack data or normal traffic data.

[0075] For example, the current error threshold is set to 0.05, each reconstruction error in the validation reconstruction error is compared with 0.05, if the reconstruction error is less than or equal to 0.05, it is determined that the traffic corresponding to the webpage feature data sample is normal traffic data; if the reconstruction error is greater than or equal to 0.05, it is determined that the traffic corresponding to the webpage feature data sample is network attack data.

[0076] In some embodiments of the present application, the detection result evaluation score corresponding to the current error threshold is determined according to the cross-site scripting attack detection result of the validation webpage feature data, including: determining the detection accuracy and detection recall rate corresponding to the current error threshold according to the cross-site scripting attack detection result of the validation webpage feature data; determining the detection result evaluation score corresponding to the current error threshold according to the detection accuracy and detection recall rate.

[0077] After determining the cross-site scripting attack detection result of the validation webpage feature data, the real label (such as network attack data or normal traffic data) corresponding to each webpage feature data sample in the validation set can be obtained and compared with the cross-site scripting attack detection result output by the model to determine four prediction types, namely, true positive (TP), true negative (TN), false positive (FP), and false negative (FN).

[0078] wherein, the true instance refers to the network attack data sample correctly predicted by the model, i.e. the number of samples whose true label is network attack data and which are determined by the model as network attack data. The false negative instance refers to the normal traffic data sample correctly identified by the model, i.e. the number of samples whose true label is normal traffic data and which are determined by the model as normal traffic data. The false positive instance is the misjudged sample of the model, i.e. the number of samples whose true label is network attack data but which are determined by the model as normal traffic data. The false negative instance is the network attack data sample that the model fails to detect, i.e. the number of samples whose true label is network attack data but which are determined by the model as normal traffic data.

[0079] After determining the four prediction types, the detection accuracy and the detection recall corresponding to the current error threshold can be calculated according to the four prediction types.

[0080] In some examples, the detection accuracy can be calculated by the following formula 7: (Formula 7) wherein, Precision refers to the detection accuracy, TP refers to the true instance, and FP refers to the false positive instance.

[0081] In some examples, the detection recall can be calculated by the following formula 8: (Formula 8) wherein, Recall refers to the detection recall, TP refers to the true instance, and FN refers to the false negative instance.

[0082] After determining the detection accuracy and the detection recall corresponding to the current error threshold, the detection result evaluation score corresponding to the current error threshold can be calculated, i.e. the weighted harmonic mean of the detection accuracy and the detection recall.

[0083] In some examples, the detection result evaluation score can be calculated by the following formula 9: (Formula 9) wherein, the detection result evaluation score, and 1 refer to the weight adjustment coefficient, Precision refers to the detection accuracy, and Recall refers to the detection recall.

[0084] In the above examples, the relative importance of the detection recall to the detection accuracy can be measured, and when = 1, the accuracy and the recall are the same at this time, reflecting the balanced performance of the model in accuracy and recall, in order to adapt to the case that the missed judgment rate of the confusion XSS attack with dynamic characteristics is high, can take =2 to reduce the false negative rate of the model and improve the ability to detect confusing XSS attacks with dynamic characteristics.

[0085] In some examples, the current error threshold can be iteratively updated according to the detection result evaluation score and the iteration update stop condition. When the iteration update stop condition is reached, the current error threshold can be used as the target error threshold for cross-site scripting attack detection.

[0086] In some examples, the current error threshold can be iteratively updated according to the detection result evaluation score and the iteration update stop condition. When the iteration update stop condition is reached, the current error threshold can be used as the target error threshold for cross-site scripting attack detection.

[0087] For example, the last obtained current error threshold is used as the target error threshold for cross-site scripting attack detection by the threshold iteration update algorithm preset above.

[0088] Step 102, obtaining the current webpage feature data to be detected, and using a pre-trained dynamic deep autoencoder model to determine the current reconstruction error of the current webpage feature data.

[0089] As some examples, the current webpage feature data to be detected can be webpage feature data in a test set for simulation testing, or webpage feature data extracted from real-time webpage requests for cross-site scripting attack detection in actual scenarios.

[0090] After obtaining the current webpage feature data to be detected, it can be input into the pre-trained dynamic deep autoencoder model for encoding and decoding operations, and then the current reconstruction error between the output data and the original input data is determined.

[0091] Step 103, comparing the current reconstruction error with the target error threshold, and determining the cross-site scripting attack detection result of the current webpage feature data according to the comparison result.

[0092] After obtaining the current reconstruction error, it can be compared with the target error threshold determined based on the validation set, and the cross-site scripting attack detection result of the current webpage feature data, such as network attack data or normal traffic data, is determined according to the comparison result (e.g., greater than, less than, or equal to).

[0093] In some examples, the trained DDAE model can be used to reconstruct the input data. If the calculated reconstruction error is greater than the target error threshold, the data can be marked as XSS attack.

[0094] In the above examples, the target error threshold can be used to determine whether the input feature is XSS attack data without relying on the judgment of XSS attack types.

[0095] In some embodiments of the present application, according to the comparison result, the cross-site scripting attack detection result of the current webpage feature data is determined, including: if the current reconstruction error is less than or equal to the target error threshold, determining that the current webpage feature data is normal traffic data; if the current reconstruction error is greater than the target error threshold, determining that the current webpage feature data is network attack data.

[0096] In actual application, if the current reconstruction error is less than or equal to the target error threshold, it indicates that the webpage request is running in normal condition, the current webpage feature data is normal traffic data, and there is no risk of cross-site scripting attack. If the current reconstruction error is greater than the target error threshold, it indicates that the cross-site scripting attack may be suffered, and the current webpage feature data can be determined as network attack data.

[0097] In the above embodiments, the XSS attack detection based on the dynamic deep autoencoder is performed, the target error threshold is determined according to the cross-layer residual connection and the mixed activation function, and the dynamic abstraction and efficient extraction of attack features are realized to maintain the user information security and the enterprise image.

[0098] In some examples, the XSS attack detection based on the dynamic deep autoencoder can be performed in the following way: Input: trained DDAE model, test set , target error threshold ; Output: labeled data 1. ; 2. Use the trained model and feature data reconstruction ; 3. Calculate the reconstruction error RE 4. if ; 5. Label the data as attack traffic 6. else 7. Label the data as normal traffic 8. end while.

[0099] In the embodiment of the present application, by acquiring a pre-trained dynamic deep autoencoder model, and performing threshold selection on the pre-trained dynamic deep autoencoder model, a target error threshold for cross-site scripting attack detection is determined; current web feature data to be detected is acquired, and the pre-trained dynamic deep autoencoder model is used to determine a current reconstruction error of the current web feature data; the current reconstruction error is compared with the target error threshold, and according to the comparison result, a cross-site scripting attack detection result of the current web feature data is determined, which realizes the determination of the cross-site scripting attack detection result based on the target error threshold determined by the dynamic deep autoencoder model and the current reconstruction error, thereby improving the detection accuracy of cross-site scripting attacks in complex scenarios, and effectively balancing and reducing the false positive rate and the false negative rate.

[0100] Referring to Figure 5 , a step flowchart of another method for detecting cross-site scripting attacks provided by some embodiments of the present application is shown, which can specifically include the following steps: Step 501, a dynamic deep autoencoder model is constructed.

[0101] Step 502, a web feature data set is acquired; wherein the web feature data set includes a training set.

[0102] Step 503, the training set is used to train the dynamic deep autoencoder model.

[0103] Step 504, a pre-trained dynamic deep autoencoder model is acquired, and threshold selection is performed on the pre-trained dynamic deep autoencoder model to determine a target error threshold for cross-site scripting attack detection.

[0104] Step 505, current web feature data to be detected is acquired, and the pre-trained dynamic deep autoencoder model is used to determine a current reconstruction error of the current web feature data.

[0105] Step 506, the current reconstruction error is compared with the target error threshold, and according to the comparison result, a cross-site scripting attack detection result of the current web feature data is determined.

[0106] In the embodiment of the present application, the target error threshold for cross-site scripting attack detection is determined by acquiring a pre-trained dynamic deep autoencoder model and performing threshold selection on the pre-trained dynamic deep autoencoder model; the current webpage feature data to be detected is acquired, and the pre-trained dynamic deep autoencoder model is used to determine the current reconstruction error of the current webpage feature data; the current reconstruction error is compared with the target error threshold, and the cross-site scripting attack detection result of the current webpage feature data is determined according to the comparison result, which realizes the determination of the cross-site scripting attack detection result based on the target error threshold determined by the dynamic deep autoencoder model and the current reconstruction error, thereby improving the detection accuracy of cross-site scripting attacks in complex scenarios and effectively balancing and reducing the false positive rate and the false negative rate.

[0107] It should be noted that for the method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the present application are not limited by the action sequence described, because according to the embodiments of the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions involved are not necessarily necessary for the embodiments of the present application.

[0108] Referring to Figure 6 , a structure schematic diagram of a cross-site scripting attack detection device provided by some embodiments of the present application is shown, which can specifically include the following modules: The threshold selection module 601 is configured to acquire a pre-trained dynamic deep autoencoder model, and perform threshold selection on the pre-trained dynamic deep autoencoder model to determine a target error threshold for cross-site scripting attack detection. The current reconstruction error determination module 602 is configured to acquire current webpage feature data to be detected, and determine a current reconstruction error of the current webpage feature data by using the pre-trained dynamic deep autoencoder model. The cross-site scripting attack detection result determination module 603 is configured to compare the current reconstruction error with the target error threshold, and determine a cross-site scripting attack detection result of the current webpage feature data according to the comparison result.

[0109] In some embodiments of the present application, the device further includes: The model construction module is configured to construct a dynamic deep autoencoder model. The dataset acquisition module is configured to acquire a webpage feature dataset, wherein the webpage feature dataset includes a training set. The model training module is configured to train the dynamic deep autoencoder model by using the training set.

[0110] In some embodiments of the present application, the webpage feature dataset further comprises a verification set; the threshold selection module 601 comprises: a verification reconstruction error determination submodule, configured to determine a verification reconstruction error of the verification webpage feature data in the verification set by using the pre-trained dynamic deep auto-encoder model; an error threshold update submodule, configured to obtain a current error threshold and iteratively update the current error threshold; a detection result determination submodule, configured to, for each iteratively updated current error threshold, determine a detection result evaluation score corresponding to the current error threshold by combining the verification reconstruction error and the current error threshold; a target error threshold determination submodule, configured to determine a target error threshold for cross-site scripting attack detection from the iteratively updated current error threshold according to the detection result evaluation score.

[0111] In some embodiments of the present application, the detection result determination submodule comprises: a cross-site scripting attack detection result determination unit, configured to, for each iteratively updated current error threshold, compare the verification reconstruction error with the current error threshold, and determine a cross-site scripting attack detection result of the verification webpage feature data according to a comparison result; a detection result evaluation score determination unit, configured to determine a detection result evaluation score corresponding to the current error threshold according to the cross-site scripting attack detection result of the verification webpage feature data.

[0112] In some embodiments of the present application, the detection result evaluation score determination unit is configured to: determine a detection precision and a detection recall rate corresponding to the current error threshold according to the cross-site scripting attack detection result of the verification webpage feature data; determine the detection result evaluation score corresponding to the current error threshold according to the detection precision and the detection recall rate.

[0113] In some embodiments of the present application, an initial value of the current error threshold is a maximum value in the verification reconstruction error.

[0114] In some embodiments of the present application, the device further comprises: a preprocessing module, configured to preprocess webpage feature data in the webpage feature dataset.

[0115] In some embodiments of the present application, the preprocessing module comprises: a deduplication processing submodule, configured to perform deduplication processing on the webpage feature data in the webpage feature dataset; The normalization processing submodule is configured to normalize the webpage feature data in the webpage feature data set.

[0116] In some embodiments of the present application, the webpage feature data set includes one or more of the following types of webpage feature data: URL-based webpage feature data, HTML-based webpage feature data, and JavaScript-based webpage feature data.

[0117] In some embodiments of the present application, the cross-site scripting attack detection result determination module 603 includes: The normal traffic data determination submodule is configured to determine that the current webpage feature data is normal traffic data if the current reconstruction error is less than or equal to the target error threshold. The network attack data determination submodule is configured to determine that the current webpage feature data is network attack data if the current reconstruction error is greater than the target error threshold.

[0118] In some embodiments of the present application, the dynamic deep autoencoder model includes an encoder and a decoder, the encoder has at least two encoding layers, and at least one of the at least two encoding layers adopts a cross-layer residual connection structure.

[0119] Some embodiments of the present application also provide an electronic device, including a processor, a memory, and a computer program stored on the memory and capable of running on the processor, and the computer program is executed by the processor to implement the method as above.

[0120] Some embodiments of the present application also provide a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method as above.

[0121] Some embodiments of the present application also provide a computer program product, including a computer program, and the computer program is executed by the processor to implement the method as above.

[0122] For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the related parts refer to the part of the method embodiments.

[0123] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0124] The various embodiments described in this specification are intended to be illustrative only and in no way limit the scope of the application. One skilled in the art will readily recognize from the disclosure herein, possible alternative techniques within the scope of the application. Accordingly, the embodiments described in this specification are set forth without any loss of generality to, and without imposing limitations upon, the claimed invention.

[0125] Those skilled in the art will appreciate that embodiments of the application can be devised for a variety of applications. It is therefore intended that the appended claims be construed to include alternative embodiments to the extent permitted.

[0126] Embodiments of the present application are described herein with reference to the drawings, in which are shown embodiments that are illustrative of the principles of the present application. The drawings are in simplified form and are not to precise scale. For purposes of clarity, not every component is called out in the drawings. In the drawings: Like reference numerals can refer to like components throughout. Figure 1 one or more functions specified in a flow or multiple flows and / or blocks. Figure 1 an apparatus that can perform one or more functions specified in a flow or multiple flows and / or blocks.

[0127] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 one or more functions specified in a flow or multiple flows and / or blocks. Figure 1 an apparatus that can perform one or more functions specified in a flow or multiple flows and / or blocks.

[0128] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 one or more functions specified in a flow or multiple flows and / or blocks. Figure 1 an apparatus that can perform one or more functions specified in a flow or multiple flows and / or blocks.

[0129] While the preferred embodiments of the application have been described above, it should be understood that many modifications and adaptations to those embodiments will be possible on the basis of the foregoing description and drawings. Therefore, the following claims are intended to cover all such modifications and adaptations which come within the scope of the preferred embodiments of the application.

[0130] Finally, it should be noted that the terms "first", "second", and the like, herein do not denote any order, quantity, combination, or importance, but rather are used to distinguish one element from another, and do not imply singular or plural. Moreover, the term "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the a single element. The terms "an embodiment", "one embodiment", or the like, do not denote the same embodiment or implementations, but rather candidate structures and / or concepts that might be considered one of many potentially distinct embodiments or implementations.

[0131] The above provides a method, device, equipment, medium and product for cross-site script attack detection, and the principle and implementation of the application are described by using specific examples. The above description of the embodiments is only used to help understand the method of the application and its core idea. Meanwhile, for those skilled in the art, the specific implementation and application range can be changed according to the idea of the application. In conclusion, the content of the specification should not be understood as a limitation of the application.

Claims

1. A method for detecting cross-site scripting attacks, characterized in that, The method includes: Obtain a pre-trained dynamic deep autoencoder model and perform threshold selection for the pre-trained dynamic deep autoencoder model to determine the target error threshold for cross-site scripting attack detection. The current webpage feature data to be detected is obtained, and a pre-trained dynamic deep autoencoder model is used to determine the current reconstruction error of the current webpage feature data. The current reconstruction error is compared with the target error threshold, and the cross-site scripting attack detection result of the current webpage feature data is determined based on the comparison result.

2. The method according to claim 1, characterized in that, Before obtaining the pre-trained dynamic deep autoencoder model, the following steps are also included: Construct a dynamic depth autoencoder model; Obtain a webpage feature dataset; wherein, the webpage feature dataset includes a training set; The dynamic depth autoencoder model is trained using the training set.

3. The method according to claim 2, characterized in that, The webpage feature dataset also includes a validation set; threshold selection is performed on a pre-trained dynamic deep autoencoder model to determine the target error threshold for cross-site scripting attack detection, including: A pre-trained dynamic deep autoencoder model is used to determine the verification reconstruction error of the feature data of the verification web pages in the verification set. Obtain the current error threshold and iteratively update the current error threshold; For each iteration of the current error threshold, the detection result evaluation score corresponding to the current error threshold is determined by combining the verification reconstruction error and the current error threshold. Based on the detection results, an evaluation score is made, and a target error threshold for cross-site scripting attack detection is determined from the iteratively updated current error threshold.

4. The method according to claim 3, characterized in that, For each iteration's updated current error threshold, the detection result evaluation score corresponding to the current error threshold is determined by combining the verification reconstruction error and the current error threshold, including: For each iteration update of the current error threshold, the verification reconstruction error is compared with the current error threshold, and based on the comparison result, the cross-site script attack detection result of the verification webpage feature data is determined; Based on the cross-site scripting attack detection results of the verified webpage feature data, the detection result evaluation score corresponding to the current error threshold is determined.

5. The method according to claim 4, characterized in that, Based on the cross-site scripting attack detection results of the verified webpage feature data, determine the detection result evaluation score corresponding to the current error threshold, including: Based on the cross-site scripting attack detection results of the verified webpage feature data, determine the detection precision and detection recall corresponding to the current error threshold; Based on the detection precision and detection recall, the detection result evaluation score corresponding to the current error threshold is determined.

6. The method according to claim 3, characterized in that, The initial value of the current error threshold is the maximum value among the verification and reconstruction errors.

7. The method according to any one of claims 2-6, characterized in that, Before training the dynamic deep autoencoder model using the training set, the method further includes: The webpage feature data in the webpage feature dataset is preprocessed.

8. The method according to claim 7, characterized in that, Preprocessing of the webpage feature data in the webpage feature dataset includes: The webpage feature data in the webpage feature dataset is deduplicated; And / or, normalize the webpage feature data in the webpage feature dataset.

9. The method according to any one of claims 2-6, characterized in that, The webpage feature dataset includes one or more of the following types of webpage feature data: URL-based webpage feature data, HTML-based webpage feature data, and JavaScript-based webpage feature data.

10. The method according to any one of claims 1-6, characterized in that, Based on the comparison results, the cross-site scripting attack detection result of the current webpage feature data is determined, including: If the current reconstruction error is less than or equal to the target error threshold, the current webpage feature data is determined to be normal traffic data; If the current reconstruction error is greater than the target error threshold, the current webpage feature data is determined to be network attack data.

11. The method according to any one of claims 1-6, characterized in that, The dynamic depth autoencoder model includes an encoder and a decoder. The encoder has at least two coding layers, and at least one of the at least two coding layers adopts a cross-layer residual connection structure.

12. A device for detecting cross-site scripting attacks, characterized in that, The device includes: The threshold selection module is used to obtain a pre-trained dynamic deep autoencoder model and perform threshold selection on the pre-trained dynamic deep autoencoder model to determine the target error threshold for cross-site scripting attack detection. The current reconstruction error determination module is used to acquire the current webpage feature data to be detected and to determine the current reconstruction error of the current webpage feature data using a pre-trained dynamic deep autoencoder model. The cross-site scripting attack detection result determination module is used to compare the current reconstruction error with the target error threshold, and determine the cross-site scripting attack detection result of the current webpage feature data based on the comparison result.

13. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the method as described in any one of claims 1 to 11.

15. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 11.

Images