Malicious HTTP Traffic Detection via Multi-Field Relation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious HTTP traffic face challenges due to the complexity of feature engineering, flexibility issues with protocol upgrades, and the inability to effectively analyze multi-field relationships, leading to evasion by attackers and noise in network traffic data.
Innovation Solution
A detection system utilizing an active label corrector and multi-field feature extractor, which includes a hybrid network for discovering underlying field relationships and reducing trivial information, to automatically extract features and correct noisy labels, thereby enhancing interpretability and robustness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manually-designed features are used for detection, then detection accuracy can be achieved, but feature engineering is expensive and inflexible to protocol upgrades
Solution Approach 1:
The system uses auto-learned features that automatically adapt to protocol changes without manual feature engineering. The deep learning model self-adjusts to HTTP protocol versions (1.0, 1.1, 2.0) by learning from traffic patterns, eliminating the need for manual feature redesign when protocols upgrade.
Solution Approach 2:
The system transitions from static manually-defined features to dynamic auto-learned features that change parameters based on observed traffic. The model automatically adjusts feature extraction parameters to match different HTTP protocol versions, making the detection system flexible and adaptive.
2Measurement precision
If single field or multi-field content analysis is performed, then detection can be achieved, but the underlying triggering relation among fields is not concerned allowing evasion
Solution Approach 1:
The system merges analysis of individual fields with analysis of field relationships. The deep learning model simultaneously processes single-field features and multi-field triggering relations (e.g., URL-referer, version-method relationships), creating a comprehensive detection approach that is difficult for attackers to evade.
Solution Approach 2:
The system adds the dimension of field relationship analysis to traditional single-field or multi-field content analysis. By incorporating the triggering relations between fields as an additional analysis dimension, the system creates a more robust detection framework that accounts for contextual interactions between fields.
3Measurement precision
If multi-field analysis is performed, then comprehensive detection is achieved, but trivial information flooding occurs
Solution Approach 1:
The system extracts and focuses on the most informative fields and their relationships while filtering out trivial information. The deep learning model automatically identifies and emphasizes fields that contribute most to detection accuracy, such as URL and its relationships, while downweighting less informative fields like method, version, or language.
Solution Approach 2:
The system applies different analysis depths to different fields based on their informative value. Important fields like URL receive detailed analysis including relationship extraction, while less informative fields receive simpler processing. This local quality differentiation ensures comprehensive detection without processing all fields at maximum depth, reducing computational overhead.
Data Source
AI summary
The present disclosure provides a detection system, comprising a client for unloading malicious HTTP traffic and a server for receiving and detecting the malicious HTTP traffic, wherein the server comprises an active label corrector for correcting noisy labels of the malicious HTTP traffic and a multi-field feature extractor for automatically discovering underlying features of the malicious HTTP traffic.