Web Page Request Identification via Clustering

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods for identifying malicious web page requests require a large number of sample requests, leading to high computation complexity and slow training of the identification model, making them inefficient for real-time network security.

Innovation Solution

The method clusters sample web page requests using a clustering algorithm like K-means, determining center vectors for each cluster, and then identifies malicious requests by calculating distances between feature vectors and center vectors, reducing the need for extensive training data and improving processing speed.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If a large number of sample web page requests are used for training the identification model, then the accuracy of malicious request identification is improved, but the computation complexity increases and training time is extended

Engineering Contradiction:
Improveidentification accuracyVSAvoidcomputation complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the training process into two distinct phases: an offline clustering phase that pre-processes sample requests into clusters with center vectors, and an online identification phase that uses simple distance calculations. This segmentation reduces online computation complexity while maintaining identification accuracy by replacing complex model training with pre-computed cluster representations.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent performs clustering and center vector calculation as preliminary actions during offline training. By pre-processing the sample requests to establish cluster structures and center vectors before deployment, the system eliminates the need for complex real-time training, thereby reducing online computation complexity while preserving the ability to accurately identify malicious requests.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If traditional identification models are trained extensively, then the reliability of malicious request detection is improved, but the training time and processing speed are reduced

Engineering Contradiction:
Improvedetection reliabilityVSAvoidtraining time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts the essential characteristics of malicious requests by clustering sample requests and computing center vectors that represent each cluster. This extraction process separates the complex training task into pre-computed cluster representations, maintaining detection reliability while dramatically reducing the time required for model training and deployment.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent creates simplified copies of the training process by using cluster center vectors as representative models. Instead of training on individual sample requests, the system uses compact cluster center representations that capture the essential patterns, thereby maintaining detection reliability while reducing training time and computational resources required.

Inventive Principle:
Principle #26Copying

3Productivity

If clustering algorithms are used to process sample requests, then the processing speed is improved, but the algorithm complexity increases

Engineering Contradiction:
Improveprocessing speedVSAvoidalgorithm complexity
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The patent changes the parameters of the identification process by using cluster center vectors and distance thresholds instead of complex trained model parameters. This parameter transformation enables faster processing during online identification while the clustering algorithm complexity is confined to the offline training phase, effectively balancing processing speed and algorithm complexity.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentEP3684025B1Web page request identification
Publication Date: 2024.02.14 NEW H3C SECURITY TECH CO LTD
  • EP3684025B1 patent drawingFigure 1
  • EP3684025B1 patent drawingFigure 2
  • EP3684025B1 patent drawingFigure 3~5

AI summary

A method and apparatus for identifying a web page request are provided. In the method, features of a plurality of sample web page requests are extracted. A feature vector for features of each sample web page request is determined. The plurality of sample web page requests are clustered using a preset clustering algorithm according to the determined feature vectors. A center vector of feature vectors of sample web page requests included in each cluster is determined according to the feature vectors of the sample web page requests included in the cluster. When a web page request to be identified is obtained, a cluster to which the web page request to be identified belongs is determined. If the distance between a feature vector of the web page request to be identified and a center vector of the cluster to which the web page request to be identified belongs is not within a preset distance range corresponding to the cluster, the web page request to be identified is determined as a malicious web page request. With the examples of the present disclosure, the computation complexity is reduced and the speed of training the web page request identification model is improved.