Artificial intelligence-based hosted web firewall service system and method for managing web server security in multi-cloud environment.

Abstract

An embodiment of the present invention comprises a web firewall service component that is equipped with an attention-based neural network deep learning-based inference model and infers and detects web attacks by analyzing data collected from a web server in real time on the basis of training data generated by extracting features of web attacks for each set field.

Description

AI-based hosted web firewall service system and method for managing web server security in a multi-cloud environment.

[0001] The present invention relates to an artificial intelligence-based hosted web firewall for managing the security of a web server in a multi-cloud environment, and to a technology for strengthening the security of a web server by collecting, processing, and analyzing web attack data.

[0002] Web Application Firewall (WAF) is a solution developed specifically for web application security, unlike general network firewalls.

[0003] The basic role of a web firewall is to detect and block web attacks such as SQL Injection and Cross-Site Scripting (XSS). In addition to responding to direct web attacks, it can also be used as an information leak prevention solution, an unauthorized login prevention solution, and a website forgery prevention solution.

[0004] In other words, a web firewall provides web security features while protecting against unexpected external attacks and internal threats that were not discovered in advance.

[0005] Recently, security operation centers (SOCs) are applying machine learning to their security systems to address issues such as a persistent shortage of technical personnel and an increase in intrusion detection events due to the increasing number of security devices.

[0006] However, conventional web firewalls employing machine learning models require analysis of security events to accurately distinguish between true and false positives due to the inherent machine learning capabilities. In other words, identifying security events within a domain is paramount to distinguishing between false positives and true positives. This requires the collection and analysis of training data.

[0007] However, conventional learning data collection requires a lot of time and expert intervention, and has the problem of making it difficult to effectively respond to attacks originating from various sources, such as in a multi-cloud environment.

[0008] The present invention provides an artificial intelligence hosted web firewall for multi-cloud environment web server security management that can strengthen the security of a web server by installing an artificial intelligence model capable of collecting and analyzing data in real time to effectively respond to attacks occurring from various sources in a multi-cloud environment.

[0009] An embodiment of the present invention includes a web firewall service component that is equipped with a web server and an attention-based neural network deep learning-based inference model, and analyzes data collected from a web server in real time based on learning data that extracts features of web attacks for each set field to infer and detect web attacks.

[0010] The web firewall service unit may include a data collection unit that collects data and converts the collected data into a learning data set set by user-defined rules by applying supervised learning and unsupervised learning algorithms to learn new patterns, a data processing unit that processes the data collected by the data collection unit by at least one of data cleaning, data normalization, data splitting, feature engineering, dimensionality reduction, data augmentation, and data de-identification, a feature extraction unit that extracts features of web attacks from the data by applying a natural language processing (NLP) technique, clusters the extracted features according to set fields, and stores them, and a detection unit that learns the features extracted and clustered by the feature extraction unit and analyzes the data to detect web attacks.

[0011] And, the data collection unit includes a data collection module that collects data by installing an automated data collection agent on each web server to monitor HTTP requests and responses in real time, identifies and stores the set web attack types from the collected data, a data conversion module that automatically labels the collected data of the collection module by attack type through a labeling algorithm, and converts the labeled data into a learning dataset by applying supervised learning and unsupervised learning algorithms to learn new patterns, a data management module that manages the learning dataset so that the inference model can continuously evolve by adding new attack patterns to the learning dataset when they are detected through a data feedback loop for continuous evolution of the inference model, and a data management interface that visualizes and provides the status of the dataset and provides database backup and recovery functions.

[0012] In addition, the data transformation module divides the labeled data into multiple groups according to the set user-defined rules, and the multiple groups divided according to the user-defined rules include at least two of the following groups: method execution (METHOD-ENFORCEMENT), scanner detection (SCANNER-DETECTION), protocol execution (PROTOCOL-ENFORCEMENT), protocol attack (PROTOCOL-ATTACK), application attack (APPLICATION-ATTACK), and a general group that does not fall into any other group. The application attack (APPLICATION-ATTACK) is characterized by being subdivided into groups of local file (LFI), remote file (RFI), remote code execution (RCE), PHP, cross-site scripting (XSS), SQL, session fixation (SESSION-FIXATION), and session Java (SESSION-JAVA).

[0013] In addition, the feature extraction unit performs stopword removal, stem extraction, and title extraction from the text of the collected data, and includes a preprocessing module that executes a preprocessing process to separate meaningful units of data through text tokenization, a vectorization module that vectorizes the preprocessed data using text representation techniques such as TF-IDF, Word2Vec, and BERT to extract features and store them in a DB, and a clustering module that clusters and stores the vectorized features in the vectorization module by field set through a machine learning algorithm or a deep learning algorithm and provides them as learning data for an inference model.

[0014] And, the features extracted from the vectorization module are at least one of remote ip, main request, sub request, sub resource type, sub resource type group, request header, session id, session create time, session update, header cookie, header user agent, and cluster id.

[0015] In addition, the preprocessing module is characterized by constructing an AST (Abstract Syntax Tree) using an Abstract Syntax constructed using code snippet semantic properties, and extracting a Path-context through the AST (Abstract Syntax Tree).

[0016] Additionally, the configuration fields of the clustering module include at least one of URL Pasthm HTTP Parameter, HTTP Method, Content type, Content Length, User Agent, Connection, Host, and Refere.

[0017] And, the inference model applies a natural language processing (NLP)-based machine learning algorithm to tokenize the HTTP request traffic by section, and analyzes at least one of URL Paste, HTTP Parameter, HTTP Method, Content type, Content Length, User Agent, Connection, Host, and Refere from the string classified by feature to detect web attack patterns.

[0018] Another embodiment of the present invention comprises the steps of: a) identifying a set web attack type from data received in real time through an automated data collection agent installed on a web server, and automatically labeling by attack type; b) performing at least one of data cleaning, data normalization, data splitting, feature engineering, dimensionality reduction, data augmentation, and data de-identification on the labeled data to transform the collected data; c) extracting and vectorizing features from the collected data, and clustering and storing the vectorized features into set fields; and d) analyzing the collected data through a natural language processing (NLP) vectorization algorithm in an attention-based neural network deep learning-based inference model learned based on learning data including the stored features to infer and detect web attacks; and e) analyzing the detection results to compare the numerical values ​​of the improvement in accuracy and speed according to set conditions to determine a performance index. Includes the steps of producing.

[0019] In step a) of the above embodiment, the labeled data is characterized in that it is converted into a learning dataset of a user-defined group by applying supervised learning and unsupervised learning algorithms for learning new patterns.

[0020] Here, step c) further includes a step of extracting a script language having a grammar for extracting Path-Context for each script language from a text, a step of decomposing script code from the extracted script language to create Abstract Syntax, a step of constructing the Abstract Syntax into an AST (Abstract Syntax Tree) to extract Path-context, a step of vectorizing the extracted Path-context to extract features, and a step of clustering and storing the vectorized features by fields set through a machine learning algorithm or a deep learning algorithm.

[0021] The present invention is an artificial intelligence-based web firewall that analyzes data collected in real time based on learning data that extracts features of web attacks, thereby effectively responding to attacks occurring from various sources in a multi-cloud environment, thereby enhancing the security of web servers.

[0022] FIG. 1 is a block diagram illustrating an overview of an artificial intelligence hosted web firewall service system for multi-cloud environment web server security management according to the present invention.

[0023] Figure 2 is a block diagram illustrating the absence of a web firewall service.

[0024] Figure 3 is a block diagram illustrating a data collection unit.

[0025] Figures 4 and 5 are diagrams showing examples of learning datasets.

[0026] Figure 6 is a block diagram illustrating a data processing unit.

[0027] Figure 7 is a diagram illustrating an example of an anonymization processing technique.

[0028] Figure 8 is a block diagram illustrating a feature extraction unit.

[0029] Figure 10 is a diagram illustrating an example of method processing unit extraction.

[0030] Figure 11 is a diagram illustrating an example of Path-Context creation.

[0031] Figure 12 is a diagram illustrating an example of classification and analysis of web attack data.

[0032] Figure 13 is a flowchart illustrating an artificial intelligence hosted web firewall service method for multi-cloud environment web server security management according to the present invention.

[0033] While the present invention is susceptible to numerous modifications and embodiments, specific embodiments are illustrated in the drawings and described in detail. This is not intended to limit the present invention to specific embodiments, but rather to encompass any modification, equivalent, or alternative within the spirit and technical scope of the present invention for connecting and / or securing structures extending in different directions.

[0034] The terminology used herein is for the purpose of describing specific embodiments only and is not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly dictates otherwise.

[0035] In this specification, it should be understood that terms such as “include” or “have” are intended to specify the presence of a feature, number, step, operation, component, part or combination thereof described in the specification, but do not preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts or combinations thereof.

[0036] Hereinafter, a preferred embodiment of an artificial intelligence hosted web firewall service system and method for multi-cloud environment web server security management according to the present invention will be described with reference to the attached drawings.

[0037] FIG. 1 is a block diagram illustrating an overview of an artificial intelligence hosted web firewall service system for multi-cloud environment web server security management according to the present invention.

[0038] Referring to FIG. 1, the present invention includes a web firewall service member (100), a web server (200), and multiple user terminals (300).

[0039] The web firewall service (100) may be a separate management server or terminal from the web server (200).

[0040] The web firewall service (100) is characterized by being configured as a separate device to perform web firewall analysis and detection, unlike the existing WAF (Web Application Firewall) in that it is not embedded in the web server (200) or operates on the same web server (200).

[0041] This feature of the present invention does not affect the original service performance of the web server (200), and when operating multiple web services, it performs the function of a web application firewall in a single window.

[0042] In addition, the present invention has the advantage of enabling the performance of a web application firewall function in a single window by integrating a cloud service and an enterprise on-premise environment, and making it unnecessary to create a module for a web application firewall that operates in various web servers (200) such as the existing Apache, NgineX, and MS IIS.

[0043] In addition, the web firewall service (100) implements an artificial intelligence learning model based on a large amount of attack web protocol big data for machine learning-based web protocol analysis, detection, and blocking, and can additionally learn the characteristics of the applied site to analyze and determine whether it is normal or an attack.

[0044] In addition, the web firewall service (100) can collect a large amount of attack web protocol big data and secure learning data for inferring and detecting web attacks through the learning data set of OWASP top 10 (The Open Web Application Security Project) or various attack web protocol artificial intelligence models.

[0045] The training data here includes monitoring and logging data that monitors HTTP requests and responses and provides comprehensive logging to record attack attempts; signal detection and blocking data that identifies and blocks potential attacks on web applications based on defined rules; and data related to customization and flexibility that applies tailored security policies to specific environments or applications by adding or modifying user-defined rules.

[0046] In addition, the absence of a web firewall service (100) can complete an artificial intelligence learning model capable of predicting abnormality detection by conducting additional learning on normal web protocols for a certain period of time to reflect the characteristics of a web service site.

[0047] A more detailed explanation of the absence of a web firewall service (100) is provided below.

[0048] Figure 2 is a block diagram illustrating the absence of a web firewall service, and Figure 3 is a block diagram illustrating a data collection unit.

[0049] Referring to FIGS. 2 and 3, the web firewall service component (100) includes a data collection unit (110), a data processing unit (120), a feature extraction unit (130), a detection unit (140), and an evaluation unit (150).

[0050] The data collection unit (110) includes a data collection module (111) that collects data, a data conversion module (112) that creates a learning data set, a data management module (113) that adds learning data, and a data management interface (114) that provides a visualization of the status of learning data and collected data.

[0051] The data collection module (111) installs an automated data collection agent on each web server (200) to monitor HTTP requests and responses in real time and generate logs. Furthermore, the data collection module (111) identifies major web attack types listed in the OWASP Top 10, such as SQL injection, XSS, CSRF, authentication and session management vulnerabilities, and security misconfigurations, and stores them in a database.

[0052] The data transformation module (112) automatically labels the collected data from the data collection module (111) by attack type using a labeling algorithm. The labeled data is converted into a learning dataset by applying supervised and unsupervised learning algorithms to learn new patterns.

[0053] Labeled data is divided into multiple groups based on user-defined rules. Examples of such user-defined rule groups for labeled data are illustrated in Figures 4 and 5.

[0054] Figure 4 illustrates the types of groups classified according to user-defined rules, and Figure 5 illustrates an example of further segmenting the groups.

[0055] First, referring to FIG. 4, the labeling data of the conversion module (112) can be classified into general data (General), method execution (METHOD-ENFORCEMENT), scanner detection (SCANNER-DETECTION), protocol execution (PROTOCOL-ENFORCEMENT), protocol attack (PROTOCOL-ATTACK), and application attack (APPLICATION-ATTACK).

[0056] The METHOD-ENFORCEMENT group contains data about lockdown methods such as PUT and PATCH.

[0057] The SCANNER-DETECTION group contains data on the scanner's ports and environmental protection.

[0058] The PROTOCOL-ENFORCEMENT group contains data that protects protocol and encoding issues.

[0059] The PROTOCOL-ATTACK group includes data to protect against header injection, response splitting, and request smuggling.

[0060] Application attacks (APPLICATION-ATTACK) are further subdivided into groups such as local file (LFI), remote file (RFI), remote code execution (RCE), PHP, cross-site scripting (XSS), SQL, session fixation (SESSION-FIXATION), and session Java (SESSION-JAVA).

[0061] More specifically, the APPLICATION-ATTACK group is further subdivided into groups that include data on Protect against file and path attacks, Protect against remote file inclusion (RFI), Protect again remote code execution attacks, Protect against PHP-injection attacks, Protect against cross-site scripting attacks, Protect against SQL-injection attacks, Protect against session-fixation attacks, and Protect against JAVA attacks.

[0062] Each group classified according to such user-defined rules is divided into sub-data groups as shown in Fig. 5 by ID (Rule ID), and each group is provided as a data sheet containing a learning dataset with different features.

[0063] Here's a data sheet containing multiple groups broken down by custom rules, including the CRS Rule ID data sheet from ModSecurity, an open source OWASP Foundation tool used by web servers like Apache and Nginx to protect web applications, and to monitor and filter HTTP and HTTPS traffic to detect security vulnerabilities.

[0064] However, the data sheet including multiple learning datasets grouped by the user-defined rules of the present invention is not limited to the CRS Rule ID data sheet of ModSecurity, and other open source data capable of detecting security vulnerabilities of HTTP and HTTPS can be applied.

[0065] The data management module (113) adds a learning dataset to the data sheet when a new attack pattern is detected through a continuous data feedback loop to enable the continuous evolution of the artificial intelligence model described below, thereby enabling the model to continuously evolve.

[0066] The data management interface (114) provides the operator with a visual representation of the status of the dataset and provides database backup and recovery functions.

[0067] The data processing unit (120) converts the collected data set into purified data through the processes of data cleaning, data normalization, data splitting, feature engineering, dimensionality reduction, data augmentation, and data de-identification.

[0068] Such a data processing unit (120) is described with reference to FIG. 6.

[0069] Figure 6 is a block diagram illustrating a data processing unit.

[0070] Referring to FIG. 6, the data processing unit (120) includes a configuration for processing data collected from the data collection unit (110) or converted learning data (hereinafter collectively referred to as a dataset).

[0071] Specifically, the data processing unit (120) includes a purification module (121), a normalization module (122), a segmentation module (123), a feature engineering module (124), a dimensionality reduction module (125), a data augmentation module (126), and a data de-identification module (127).

[0072] The purification module (121) performs data cleaning on the dataset. Data cleaning removes missing values ​​and duplicate data from the collected data and applies a data cleansing algorithm to improve data accuracy.

[0073] The normalization module (122) performs data normalization using a normalization technique. Data normalization improves data quality by converting data collected from various sources into a consistent format using a normalization technique.

[0074] The splitting module (123) splits the collected dataset into training, validation, and test sets to verify the performance and generalization ability of the model.

[0075] The feature engineering module (124) performs feature engineering to extract useful features from web request logs and improve the accuracy of the model. These include URL patterns, request methods, and response codes.

[0076] The dimensionality reduction module (125) performs dimensionality reduction using techniques such as principal component analysis (PCA) and t-SNE to convert high-dimensional data into low-dimensional data and improve processing speed.

[0077] The data augmentation module (126) performs data augmentation of the learning data to expand the dataset by generating a virtual attack scenario, thereby improving the generalization performance of the model.

[0078] The data de-identification module (127) performs data de-identification using a data de-identification tool. The data de-identification tool enhances data security by processing the training dataset to remove personal information. This data de-identification process is illustrated in Figure 7.

[0079] Referring to Figure 7, the data collection unit (110) collects data by designating sites that are expected to contain relatively little personal information as the source resources for the collected data. However, personal information inevitably must be included. Therefore, the data processing unit (120) can apply various techniques to de-identify personal information.

[0080] In particular, the present invention applies a data masking method to de-identify personal information and use it as a learning dataset. The data de-identification processing technique applied in the present invention is at least one of pseudonymization, aggregation, data reduction, data suppression, and data masking.

[0081] Pseudonymization replaces personally identifiable data with a non-identifiable value by applying one of the following methods: heuristic pseudonymization, encryption, or exchange.

[0082] Aggregation applies statistical values ​​(whole or partial) to personal information by applying one of the following methods: totaling, partial aggregation, rounding, or data rearrangement, so that a specific individual cannot be identified.

[0083] Data Reduction is the process of deleting specific data values ​​that can identify personal information by applying one or more of the following methods: identifier deletion, partial identifier deletion, record deletion, or complete deletion of identifier elements.

[0084] Data suppression prevents tracking and identification of unique information by applying at least one of the following methods: categorization, random rounding, range rounding, and controlled rounding, converting single identifying information into a representative value for the group (categorization) or converting it into an interval value (range).

[0085] Data Masking is a method of replacing personally identifiable information with a substitute value (e.g., a space, special characters such as '*, %, $', noise, etc.) in whole or in part by adding random noise and / or replacing it with a space.

[0086] The feature extraction unit (130) is described with reference to FIG. 8.

[0087] Figure 8 is a block diagram illustrating a feature extraction unit, and Figure 9 is a diagram schematically illustrating the feature information extraction process.

[0088] Referring to FIGS. 8 and 9, the feature extraction unit (130) includes a preprocessing module (131), a vectorization module (132), and a clustering module (133) to execute Feartuer selection.

[0089] The preprocessing module (131) performs stop word removal, stem extraction, and title extraction during the text preprocessing process, and executes a preprocessing process that separates meaningful units of data through text tokenization.

[0090] For example, the preprocessing module (131) extracts a method processing unit from a text such as an example of FIG. 10, creates an abstract syntax using the code snippet semantic properties, and extracts a path context (see FIG. 11) from an AST (Abstract Syntax Tree) constructed using the abstract syntax.

[0091] And the preprocessing module (131) executes code embeddings that represent code snippets as code vectors with a single fixed length.

[0092] In this case, the extraction of the method processing unit extracts a script language suitable for the grammar system for removing HTML from PHP / JSP, ASP=c#, and ASP-VB and extracting Path-Context for each script language.

[0093] Code snippet semantic propertied decomposes script code and extracts Abstract Syntax from each code.

[0094] AST (Abstract Syntax Tree) is a tree-like structure of the relationships that constitute a method. That is, the preprocessing module (131) generates an AST (Abstract Syntax Tree) that expresses the relationships of Abstract Syntax as a tree. AST (Abstract Syntax Tree) corresponds to a known technology, and thus its description is omitted.

[0095] Path-context corresponds to all Path-Contexts that can be used to assign meaning to the method from the constructed AST (Abstract Syntax Tree). That is, the preprocessing module (131) extracts all Path-Contexts related to the method from the AST.

[0096] The vectorization module (132) vectorizes data using text representation techniques such as TF-IDF, Word2Vec, and BERT, and extracts features through this and stores them in a DB.

[0097] The features extracted here are at least one of remote IP, main request, sub request, sub resource type, sub resource type group, request header, session id, session create time, session update, header cookie, header user agent, and cluster id, and are feature information only for web attack analysis.

[0098] The clustering module (133) clusters the features vectorized by the vectorization module (132) by fields set through a machine learning algorithm or a deep learning algorithm. At this time, the set fields include at least one of URL Paste HTTP Parameter, HTTP Method, Content Type, Content Length, User Agent, Connection, Host, and Refere.

[0099] The detection unit (140) is equipped with an inference model that infers and detects web attacks through feature-based learning data extracted from the feature extraction unit (130).

[0100] The inference model is equipped with a natural language processing (NLP) vectorization algorithm such as Code2Vec, Word2Vec, and BERT algorithms to understand the meaning and structure of web requests and analyze the collected data based on learning data containing vectorized features in the feature extraction unit (130) to detect web attacks.

[0101] To this end, the inference model is implemented as a deep learning model based on Attention-Based Neural Network Deep Learning, which applies an attention mechanism to focus on specific patterns, and detects web attack patterns by utilizing the Transformer architecture.

[0102] Therefore, the inference model detects web attack patterns by learning features collected from the data collection unit (110) and vectorized and clustered by set fields in the feature extraction unit (130). The inference model can use an alarming means to issue an alarm when a web attack is detected.

[0103] For example, the inference model applies a natural language processing (NLP)-based machine learning algorithm to tokenize HTTP request traffic by section and analyze the strings of fields classified by feature (e.g., at least one of URL Paste, HTTP Parameter, HTTP Method, Content type, Content Length, User Agent, Connection, Host, and Refere) to detect web attack patterns.

[0104] This is explained with reference to Fig. 12. Fig. 12 is a diagram illustrating an example of data analysis.

[0105] Referring to Figure 12, Content-Type analysis is performed only on methods other than GET, HEAD, PROPFIND, and OPTIONS, and since there are only two methods, POST and PUT, when checking the Content-Type for a malicious packet (rule_id 920420) and a normal packet, if it is not a specific Content-Type, it is judged to be malicious.

[0106] Content Length analysis is limited to the POST and PUT methods for the methods of fields belonging to the learning data (e.g., rule_id 920170, 920180 in the ModSecurity CRS Rule ID data sheet) that affect Content-Length. Therefore, among normal data, when the Content-Length is greater than 0 (1) and Content-Length is 0 (0), when the field does not exist (-1), and when it is not extracted (-1), it is judged as malicious.

[0107] Here, the methods detected by Content-Length are limited to POST and PUT methods.

[0108] User Agent analysis compares the string length distribution of training data of normal packets that contain the User-Agent field of the ModSecurity CRS Rule ID data sheet based on WASP top 10 that affects User-Agent, and determines that the string length of User-Agent is low when it is malicious.

[0109] That is, the detection unit (140) is equipped with an inference model modeled based on attention deep learning, and the inference model detects web attacks by extracting features from the collected data by applying a natural language processing (NLP)-based machine learning algorithm.

[0110] The evaluation unit (150) measures the performance indicators for the accuracy and speed performance of the detection unit (140) or calculates and outputs the performance indicators through a combination of positive (P) and negative (N) values ​​through a confusion matrix.

[0111] The present invention includes the above-described configuration, and the following describes an artificial intelligence hosted web firewall service method for security management of a multi-cloud environment web server (200) according to the present invention.

[0112] Figure 13 is a flowchart illustrating an artificial intelligence hosted web firewall service method for multi-cloud environment web server security management according to the present invention.

[0113] Referring to FIG. 13, the present invention includes a step S100 for collecting data, a step S200 for refining and processing the collected data, a step S300 for extracting and clustering features having set fields, a step S400 for analyzing the collected data based on clustered learning data to detect web attacks, and a step S500 for evaluating the detection results and performance.

[0114] Step S100 is the step where the data collection unit (110) converts the collected data into training data. The data collection unit (110) identifies major web attack types specified in the OWASP Top 10 from data received in real time through an automated data collection agent installed on the web server (200) and automatically labels them by attack type. Then, the labeled data is converted into a training dataset of a user-defined group by applying supervised learning and unsupervised learning algorithms to learn new patterns. The data sheet of the user-defined group is based on the CRS Rule ID data sheet of ModSecurity.

[0115] Step S200 is a step in which the data processing unit (120) converts the collected data set into purified data through the data cleaning, data normalization, data splitting, feature engineering, dimensionality reduction, data augmentation, and data de-identification processes on the data collected from the data collection unit (110).

[0116] Step S300 is a step in which the feature extraction unit (130) preprocesses the data-processed learning dataset to extract and vectorize features of the set fields and cluster them into the set fields.

[0117] Here, the feature extraction unit (130) performs stop word removal, stem extraction, and title extraction in the text preprocessing process, and executes a preprocessing process to separate meaningful units of data through text tokenization.

[0118] For example, the preprocessing step includes a step of extracting a script language having a grammar for extracting a path-context for each script language from the text, decomposing the script code in the extracted script language to create an abstract syntax, and extracting a path-context by configuring the abstract syntax into an AST (Abstract Syntax Tree).

[0119] Additionally, it further includes a step of vectorizing the extracted Path-context (see Fig. 11).

[0120] Vectorization of the data extracted here can be performed using text representation techniques such as TF-IDF, Word2Vec, and BERT.

[0121] And the extracted and vectorized data corresponds to features for web attack analysis only, such as at least one of remote IP, main request, sub request, sub resource type, sub resource type group, request header, session id, session create time, session update, header cookie, header user agent, and cluster id.

[0122] Extracted features are clustered by fields set using machine learning or deep learning algorithms. These fields include at least one of the following: URL Paste, HTTP Parameter, HTTP Method, Content Type, Content Length, User Agent, Connection, Host, and Referer.

[0123] Step S400 analyzes the collected data using a feature-trained inference model to infer and detect web attacks. The inference model, an attention-based neural network deep learning model, is trained on training data containing features. It incorporates natural language processing (NLP) vectorization algorithms such as Code2Vec, Word2Vec, and BERT to analyze the collected data and infer and detect web attacks.

[0124] Step S500 is the step for calculating performance indicators for detection results. The evaluation unit (150) analyzes the detection results of the detection unit (140), compares the improvements in accuracy and speed, and calculates performance indicators using a set algorithm.

[0125] In this way, the present invention can detect and respond to web attacks in real time to strengthen the security of web applications in a multi-cloud environment, and can effectively respond to continuously changing security threats.

[0126]

[0127] Although the present invention has been described above with limited embodiments and drawings, the present invention is not limited thereto, and various modifications and variations are possible by those skilled in the art to which the present invention pertains.

[0128]

[0129] Furthermore, those skilled in the art will appreciate that the present invention can be implemented in modified forms without departing from the essential characteristics of the above-described description. Therefore, the disclosed methods should be considered illustrative rather than restrictive. The scope of the present invention is set forth in the claims, not the foregoing description, and all differences within the scope equivalent thereto should be construed as being encompassed by the present invention.

Claims

1. Web server; and An artificial intelligence hosted web firewall service system for multi-cloud environment web server security management, including a web firewall service that analyzes data collected from a web server in real time based on learning data that extracts web attack features by set fields and infers and detects web attacks, equipped with an inference model based on Attention-Based Neural Network Deep Learning; 2. In claim 1, the absence of a web firewall service A data collection unit that collects data and applies supervised learning and unsupervised learning algorithms to learn new patterns, converting the collected data into a learning dataset set by user-defined rules; A data processing unit that processes data collected from a data collection unit through at least one of data cleaning, data normalization, data splitting, feature engineering, dimensionality reduction, data augmentation, and data de-identification; A feature extraction unit that extracts features of web attacks from data by applying natural language processing (NLP) techniques, clusters the extracted features according to set fields, and stores them; and An artificial intelligence hosted web firewall service system for managing web server security in a multi-cloud environment, including a detection unit that learns features extracted and clustered in a feature extraction unit and analyzes data to detect web attacks.

3. In claim 2, the data collection unit A data collection module that installs an automated data collection agent on each web server to monitor HTTP requests and responses in real time to collect data, and identifies and stores established web attack types from the collected data; A data transformation module that automatically labels the collected data of the collection module by attack type using a labeling algorithm and converts the labeled data into a learning dataset by applying supervised learning and unsupervised learning algorithms to learn new patterns; A data management module that manages the training dataset so that the inference model can continuously evolve by adding new attack patterns to the training dataset through a continuous data feedback loop when detected to ensure the continuous evolution of the inference model; and An artificial intelligence hosted web firewall service system for multi-cloud environment web server security management, including a data management interface that provides visualization of the status of the dataset and database backup and recovery functions.

4. In claim 3, the data conversion module Split the labeled data into multiple groups based on user-defined rules, Multiple groups divided according to user-defined rules Contains at least two of the following groups: METHOD-ENFORCEMENT, SCANNER-DETECTION, PROTOCOL-ENFORCEMENT, PROTOCOL-ATTACK, APPLICATION-ATTACK, and GENERAL, which are not included in any other group. Application attacks (APPLICATION-ATTACK) are subdivided into groups of local file (LFI), remote file (RFI), remote code execution (RCE), PHP, cross-site scripting (XSS), SQL, session fixation (SESSION-FIXATION), and session Java (SESSION-JAVA); an artificial intelligence hosted web firewall service system for managing web server security in a multi-cloud environment.

5. In claim 2, the feature extraction unit A preprocessing module that removes stop words, extracts stems, and extracts titles from the text of the collected data, and executes a preprocessing process to separate meaningful units of data through text tokenization; A vectorization module that extracts features by vectorizing the preprocessed data using text representation techniques such as TF-IDF, Word2Vec, and BERT, and stores them in a DB; and An artificial intelligence hosted web firewall service system for managing web server security in a multi-cloud environment, including a clustering module that clusters and stores vectorized features in a vectorization module by field set through a machine learning algorithm or deep learning algorithm and provides them as learning data for an inference model.

6. In claim 5, the feature extracted from the vectorization module is An artificial intelligence hosted web firewall service system for managing web server security in a multi-cloud environment, characterized by at least one of remote IP, main request, sub request, sub resource type, sub resource type group, request header, session id, session create time, session update, header cookie, header user agent, and cluster id.

7. In claim 5, the preprocessing module An artificial intelligence hosted web firewall service system for multi-cloud environment web server security management, characterized by constructing an AST (Abstract Syntax Tree) using an Abstract Syntax constructed using code snippet semantic properties and extracting a Path-context through the AST (Abstract Syntax Tree).

8. In claim 5, the setting field of the clustering module is An artificial intelligence hosted web firewall service system for multi-cloud environment web server security management, characterized by including at least one of URL Pasthm HTTP Parameter, HTTP Method, Content type, Content Length, User Agent, Connection, Host, and Refere.

9. In claim 1, the inference model is An artificial intelligence hosted web firewall service system for multi-cloud environment web server security management, characterized by: applying a natural language processing (NLP)-based machine learning algorithm to tokenize HTTP request traffic by section, and analyzing at least one of URL Paste, HTTP Parameter, HTTP Method, Content type, Content Length, User Agent, Connection, Host, and Refere from strings classified by feature to detect web attack patterns; 10.a) A step of identifying the set web attack type from data received in real time through an automated data collection agent installed on a web server and automatically labeling by attack type; b) A step of transforming the collected data by performing at least one of data cleaning, data normalization, data splitting, feature engineering, dimensionality reduction, data augmentation, and data de-identification on the labeled data; c) A step of extracting and vectorizing features from the collected data, and storing the vectorized features by clustering them into set fields; and d) A step of inferring and detecting web attacks by analyzing the collected data through a natural language processing (NLP) vectorization algorithm in an attention-based neural network deep learning-based inference model learned based on learning data containing stored features; and e) A method for an artificial intelligence hosted web firewall service for managing web server security in a multi-cloud environment, comprising: a step of analyzing the detection results and comparing the numerical values ​​of improvement in accuracy and speed according to set conditions to derive a performance index; 11. In claim 10, in step a), the labeled data is A method for managing web server security in a multi-cloud environment, comprising: converting a learning dataset of a user-defined group into a learning dataset by applying supervised learning and unsupervised learning algorithms to learn new patterns; 12. In claim 10, step c) A step of extracting a script language having a grammar for extracting Path-Context for each script language from a text, decomposing script code from the extracted script language to create Abstract Syntax, and extracting Path-context by configuring the Abstract Syntax into an AST (Abstract Syntax Tree); A step of extracting features by vectorizing the extracted path context; and A method for an artificial intelligence hosted web firewall service for managing web server security in a multi-cloud environment, further comprising: a step of storing vectorized features by clustering them by fields set through a machine learning algorithm or a deep learning algorithm;

Images