Isolation Forest URL Attack Detection Model

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing URL attack detection methods are ineffective in quickly identifying and distinguishing illegal URL access requests from ordinary requests, particularly in large-scale internet applications, where attacks like Trojan horse and SQL injection attacks can go undetected.

Innovation Solution

The method employs the Isolation Forest machine learning algorithm to extract features from URL access request samples, construct training samples, and build a URL attack detection model using random binary trees, allowing for the classification and prediction of potential URL attacks by calculating a risk score based on extracted features.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If traditional URL attack detection methods are used, then the detection process requires labeled training samples, but this increases manpower consumption and reduces detection efficiency

Engineering Contradiction:
Improvedetection efficiencyVSAvoidmanpower consumption
Core Design Contradiction:
ProductivityVSLoss of time

Solution Approach 1:

The system performs self-training by automatically generating labels through anomaly detection on unlabeled data. The Isolation Forest algorithm identifies abnormal samples without human intervention, and these automatically labeled samples are then used to train the URL attack detection model, eliminating the need for manual labeling while maintaining high detection efficiency

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system performs preliminary anomaly detection on unlabeled URL access request samples to generate training data before the actual attack detection task. By pre-processing the data to create labeled training samples through automated anomaly identification, the system prepares the necessary training material in advance, reducing the need for manual labeling efforts during deployment

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If manual labeling of training samples is performed, then the model can be trained accurately, but this increases the complexity and time consumption of the preparation process

Engineering Contradiction:
Improvedetection accuracyVSAvoidsample preparation complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system automatically generates training labels through the Isolation Forest anomaly detection algorithm, which identifies abnormal URL access requests without human intervention. This self-labeling process replaces complex manual labeling operations while maintaining sufficient training data quality for accurate model training

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system replaces the mechanical manual labeling process with an automated computational approach using the Isolation Forest algorithm. Instead of human experts manually examining and labeling URL samples, the algorithm automatically identifies abnormal patterns and generates labels, significantly reducing preparation complexity while maintaining detection accuracy

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If more labeled training samples are collected, then the model training becomes more accurate, but this increases the time and resources required for data collection and labeling

Engineering Contradiction:
Improvemodel training accuracyVSAvoiddata collection and labeling time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system uses unlabeled URL access request samples as input and automatically generates labeled training data through anomaly detection. The Isolation Forest algorithm processes the unlabeled data, identifies abnormal samples, and creates training labels automatically, transforming an unlimited pool of unlabeled data into sufficient labeled training samples without manual intervention

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system performs preliminary anomaly detection and label generation on unlabeled data before model training. By pre-processing the unlabeled URL samples through the Isolation Forest algorithm to create automatically labeled training datasets, the system prepares adequate training material in advance without requiring time-consuming manual data collection and labeling efforts

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3651043B1URL attack detection method and apparatus, and electronic device
Publication Date: 2021.04.14 ADVANCED NEW TECHNOLOGIES CO LTD
  • EP3651043B1 patent drawingFigure 1
  • EP3651043B1 patent drawingFigure 2
  • EP3651043B1 patent drawingFigure 3~4

AI summary

The present specification provides a URL attack detection method, including: extracting features of multiple dimensions from information included in a URL access request; entering the extracted features to a predetermined URL attack detection model for prediction calculation to obtain a risk score of the URL access request, where the URL attack detection model is a machine learning model obtained through training based on the Isolation Forest machine learning algorithm; and determining whether the URL access request is a URL attack request based on the risk score.