The invention belongs to the technical field of the
Web application protection, and discloses a multi-mode
Web application protection method based on Mshield
machine learning. The method comprises the following steps: extracting features through a semantic analysis unit, transmitting to a
machine learning unit to recognize, and applying a
random forest algorithm and a logic regression
algorithm; effectively distinguishing hostile
attack from a normal access request, and immediately intercepting the
attack, wherein the Mshield cloud platform screens logs reported by the device everyday and them summarizes to place in a
database as the iteration and a
data set for improving the
algorithm effect; performing deduction according to the past security posture, predicting the possible
attack event and an application easy to be attacked in future. By acquiring the features of
mega attack load data, through the training and the generalization of a
machine learning model, the Mshield is more efficient and
safer protection capacity in the face of the current even the unknown
Web attack in future in comparison with the traditional WAF.