Network Anomaly Detection via Header Word Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security methods based on network log analysis are inefficient in processing and easily allow attackers to evade detection, leading to failed or missed reports of network attacks.
Innovation Solution
A network anomaly data detection method that involves receiving access request data, performing word segmentation processing, calculating a word segmentation weight matrix, and inputting it into an anomaly data detection model to determine the presence of anomaly data, thereby enhancing detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If character match is performed based on a specific rule, then detection simplicity is maintained, but detection accuracy deteriorates allowing attackers to evade detection
Solution Approach 1:
The patent segments the access request data into multiple dimensions including URL, parameters, cookies, and headers. Each dimension is further divided into specific features that are analyzed separately. This segmentation transforms the simple character matching approach into a multi-faceted analysis system, improving detection accuracy while maintaining operational simplicity through structured processing.
Solution Approach 2:
The patent introduces multiple analysis dimensions beyond simple character matching, including URL dimension, parameter dimension, cookie dimension, and header dimension. Each dimension provides additional perspective for detecting anomalies. This dimensional expansion allows the system to maintain ease of operation while significantly improving detection accuracy by examining data from multiple angles simultaneously.
2Ease of operation
If network log analysis is performed using traditional methods, then processing simplicity is maintained, but processing efficiency deteriorates
Solution Approach 1:
The patent performs preliminary actions by pre-defining multiple analysis dimensions and their corresponding features before actual data processing. The system pre-establishes the structure for analyzing URLs, parameters, cookies, and headers, which enables efficient processing of incoming access requests without complex runtime decisions. This preliminary structuring maintains simplicity while improving processing efficiency.
Solution Approach 2:
The patent segments the access request data into distinct components (URL, parameters, cookies, headers) that can be processed independently and in parallel. This segmentation allows the system to maintain simple processing logic for each component while achieving high overall processing efficiency through distributed analysis of multiple segments simultaneously.
3Ease of manufacture
If character match based on specific rules is used, then implementation simplicity is maintained, but detection reliability deteriorates causing failed or missed reports
Solution Approach 1:
The patent segments the detection process into multiple independent analysis dimensions (URL, parameters, cookies, headers), each with its own set of features and analysis rules. This segmentation allows the system to maintain implementation simplicity for each individual dimension while achieving high detection reliability through the combined results of all dimensions. The modular structure makes the system both simple to implement and reliable in operation.
Solution Approach 2:
The patent adds multiple analysis dimensions beyond simple character matching, including URL structure analysis, parameter validation, cookie verification, and header inspection. Each dimension contributes independently to the overall detection reliability, allowing the system to maintain implementation simplicity while achieving robust detection through multi-dimensional verification.
Data Source
AI summary
A network anomaly data detection method includes the following steps: receiving access request data transmitted by a client; searching historical access request data corresponding to a user session identifier in the access request data; acquiring a header character string of the access request data; performing word segmentation processing on the header character string according to a preset step length so as to obtain a word segmentation set; obtaining a word segmentation weight matrix according to the historical access request data and the word segmentation set; inputting the word segmentation weight matrix into an anomaly data detection model so as to obtain a data anomaly probability; and judging whether anomaly data exists in the header character string according to the data anomaly probability.