13 results about "Web attack" patented technology

The invention discloses a dynamic self-adaptive network security protection method based on Nginx, which relates to the technical field of IT and software development, automatically analyzes access logs of an Nginx server periodically through a Lua analysis script, filters normal access through a predefined white list rule, deeply analyzes residual suspicious logs, and provides a dynamic self-adaptive network security protection method based on the Nginx. Intelligently identifying an abnormal IP address with an attack behavior and a novel attack load keyword from the suspicious log; the identified abnormal IP is automatically added to a system firewall to perform network layer shielding access to the IP, and meanwhile, the identified attack keyword is dynamically written into an access control strategy library of the Nginx server; whenever the Nginx server receives a real-time access request, the Nginx server carries out real-time protection through a Lua protection script, dynamically loads the latest keyword access control strategy library, carries out matching check on the content of the access request, and immediately intercepts the access request once the access request is hit to realize real-time protection. According to the method, dynamic, self-adaptive and efficient protection on Web attacks is realized.

The application discloses an attack detection method and device and electronic equipment, and relates to the technical field of network security, to improve the accuracy and real-time performance of web attack detection, the method comprises the following steps: first, obtaining network request data to be identified, and preprocessing the network request data to be identified to obtain preprocessed network request data; then, a pre-trained target detection model is used to extract the deep semantic vector of the preprocessed network request data, and the similarity between the deep semantic vector and each semantic vector in a preset semantic vector library is calculated; finally, based on each similarity, the detection result of the network request data to be identified is determined. Through the above method, the detection model only needs to learn the semantic vectorization expression of the text, which reduces the training difficulty of the model, reduces the model parameters, and reduces the calculation amount of the model, thereby improving the detection efficiency.

An embodiment of the present invention comprises a web firewall service component that is equipped with an attention-based neural network deep learning-based inference model and infers and detects web attacks by analyzing data collected from a web server in real time on the basis of training data generated by extracting features of web attacks for each set field.

The application provides a Web attack detection method and device, and relates to the technical field of computers.The method comprises the following steps: receiving a Web request sent by a user; extracting a plurality of dimensional request features from the Web request; identifying the encoding mode of each request feature based on encoding detection; decoding the request features based on the encoding mode of the request features to obtain original features corresponding to the request features; determining whether there are original features matching a preset current attack rule, and if not, forwarding the Web request to a source station server, otherwise, extracting an attack payload from the original features matching the current attack rule, and updating the current attack rule based on the attack payload.The application can update the attack rule in a timely manner and improve the security of the source station server.

The application provides a Web attack detection method based on a gated Transformer, and relates to the technical field of network maintenance.The method provided by the application proposes a network model based on a gated Transformer, which combines a Transformer and a gated convolution module together, the Transformer extracts global semantic information of different spatial dimensions through a multi-head self-attention mechanism, the gated convolution extracts information of a local space through a one-dimensional convolution kernel, and a gating mechanism is adopted to screen and filter text information.The application can effectively extract multidimensional global features and local features, a mixed word vector table can contain more accurate and rich semantic information, can automatically extract effective data information features in a text sequence, does not need to manually screen information and replace a word table, further improves the accuracy of model multi-classification attack detection and reduces a false positive rate, and can fully protect the security of a Web server system.

The embodiment of the invention discloses a Web application attack detection and defense method and system based on AI. The method comprises the following steps: extracting a minimum effective feature set of attack behaviors from historical Web attack traffic data, clustering, generating attack micro-feature clusters, and constructing an attack micro-feature cluster library; key features of the access traffic of the Web application are extracted, and the current occurrence frequency, the accumulated occurrence frequency and the combination mode of the key features are counted; matching the key features based on the attack micro-feature cluster library to obtain a matching result, constructing a structured numerical matrix in combination with statistical data, inputting the structured numerical matrix into a detection model for detection, and executing a blocking operation when a malicious attack is detected; and when the hostile attack is a novel unknown attack, updating the features of the hostile attack to the attack micro-feature cluster library. According to the method, the computing power consumption can be greatly reduced, the detection efficiency can be improved to adapt to a high-concurrency scene, deformation and fragmentation novel attacks can be accurately identified, feature library self-updating can be realized, and the problem of rule hysteresis can be solved.

The invention discloses a dual-channel Web attack detection method based on a BERT pre-training model, and the method comprises the steps: extracting a URL, a request method, a Payload and corresponding label information from an HTTP request message in a data set, and carrying out the standardization preprocessing; independently coding the URL and the Payload parameters by using the pre-trained URLBERT and SecBERT respectively, and generating context-aware embedded representations of a plurality of request parameters of the URL and the Payload respectively; fusing the embedded representations of the URL and the Payload, splicing to obtain a joint feature vector, and inputting the joint feature vector to a full connection layer for classification; a training set is used for training a model, a cross entropy loss function is used as an optimization target, the model is optimized through a back propagation mechanism, collaborative learning is synchronously carried out on URLBERT and SecBERT, and the detection performance is evaluated on a test set. By adopting the method and the device, the request URL and Payload characteristics in the Web attack detection task are fully mined, the parameter combination relationship is modeled, and the attack can be effectively traced.

The invention provides a web attack detection method and device, computer equipment and a storage medium, and belongs to the technical field of web attack detection. According to the scheme, the method comprises the following steps: acquiring an http request log generated when a user accesses a web service; analyzing and extracting a request resource url in the request log, and carrying out decoding and word segmentation processing on the url to obtain training data; after a Bert model is used for replacing an AE self-encoder in the DEC framework, an improved DEC classification model is obtained, the training data is used for carrying out clustering training on the improved DEC classification model to obtain a plurality of clusters, and the web attack category to which each cluster belongs is determined; and inputting the current to-be-classified data into the trained improved DEC classification model for classification to obtain a classification cluster to which the current to-be-classified data belongs, and judging whether the current to-be-classified data belongs to the web attack or not according to the web attack category to which the current classification cluster belongs. According to the scheme, the problem that in the prior art, due to the fact that some statistical features are extracted based on an http log to conduct classification or clustering analysis research, the extracted features are not comprehensive and remarkable enough, and the abnormal request detection precision of the model is affected to a great extent is solved.

This disclosure presents an AI-based method and system for detecting and defending against web application attacks. The method includes: extracting the minimum effective feature set of attack behavior from historical web attack traffic data, clustering it to generate attack micro-feature clusters, and constructing an attack micro-feature cluster library; extracting key features from the access traffic of web applications, and statistically analyzing the current occurrence frequency, cumulative occurrence frequency, and combination methods of the key features; matching the key features based on the attack micro-feature cluster library to obtain matching results, and combining the statistical data to construct a structured numerical matrix and inputting it into a detection model for detection; when a malicious attack is detected, a blocking operation is performed; when the malicious attack is a new and unknown attack, its features are updated in the attack micro-feature cluster library. This method can significantly reduce computational power consumption, improve detection efficiency to adapt to high-concurrency scenarios, accurately identify deformed and fragmented new attacks, and achieve self-updating of the feature library, solving the problem of rule lag.

This application proposes a Transformer-based method for detecting unknown web attacks. The method includes: real-time collection of HTTP requests, preprocessing them into a token sequence; inserting a special token at the beginning of the token sequence, converting each token in the expanded token sequence into an embedded representation, encoding the embedded representation using a multi-layer Transformer encoder to obtain an intermediate representation for each token; using the intermediate representation as the initial hidden state of a GRU decoder, and generating a reconstructed token sequence by performing sequence decoding on the GRU decoder; and determining whether a given HTTP request conforms to the pattern characteristics of a normal HTTP request by comparing the reconstruction error between the original token sequence and the reconstructed token sequence. This application, through unsupervised learning, can detect unknown web attacks without relying on manual rules or labeled data, and can effectively capture the structural information of HTTP requests, thus modeling the normal behavior patterns of web applications.

The invention particularly relates to a method and device for automatically reconstructing a stateful Web attack front step sequence, and the method comprises the steps: receiving a final attack request; based on the final attack request, constructing a target state portrait, and based on the target state portrait, calculating a state distance between the current application state and the target state; determining a shortest path of the target state portrait based on a preset data-driven guide model and the state distance, and generating a candidate request sequence by using a preset operation sequence generation engine based on the shortest path; and based on a preset comprehensive score function, evaluating the difference between the rear-end state after executing the candidate request sequence and the target state portrait to obtain a comprehensive score of the candidate request sequence, and when the comprehensive score meets a preset condition, taking the candidate request sequence as a request sequence corresponding to the comprehensive score. Therefore, the problems that automatic reconstruction of the stateful Web attack sequence is difficult, multi-step vulnerability verification efficiency is low, attack investigation depends on manpower and the like are solved.

The application relates to the technical field of network security, and discloses an interpretable Web attack detection method based on deep learning, which comprises the following steps: an original HTTP request is received by a preprocessing module and is hierarchically parsed and converted into an ordered minimum semantic unit sequence; an embedding attribution module is used to convert the sequence into an embedding matrix which is input into a deep learning model, and an attribution matrix is generated based on gradient calculation when an anomaly occurs; a structure alignment module is used to perform double-layer feature aggregation of labels and protocol levels, and to calculate semantic unit attribution scores; a malicious payload positioning module is used to construct a positioning feature vector based on the attribution scores and text semantics, and the positioning feature vector is input into the model to determine the position of the malicious payload; and an automatic WAF rule generation module is used to cluster and regularly extract the positioning results to generate defense rules. The application realizes interpretable model decision through attribution analysis and structure alignment, and realizes accurate positioning of attack payloads and automatic generation of defense rules by fusing context and semantic features.