Web Page Request Identification via Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious web page requests require a large number of sample requests, leading to high computation complexity and slow training of the identification model, making them inefficient for real-time network security.
Innovation Solution
The method clusters sample web page requests using a clustering algorithm like K-means, determining center vectors for each cluster, and then identifies malicious requests by calculating distances between feature vectors and center vectors, reducing the need for extensive training data and improving processing speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a large number of sample web page requests are used for training the identification model, then the accuracy of malicious request identification is improved, but the computation complexity increases and training time is extended
Solution Approach 1:
The patent segments the training process into two distinct phases: an offline clustering phase that pre-processes sample requests into clusters with center vectors, and an online identification phase that uses simple distance calculations. This segmentation reduces online computation complexity while maintaining identification accuracy by replacing complex model training with pre-computed cluster representations.
Solution Approach 2:
The patent performs clustering and center vector calculation as preliminary actions during offline training. By pre-processing the sample requests to establish cluster structures and center vectors before deployment, the system eliminates the need for complex real-time training, thereby reducing online computation complexity while preserving the ability to accurately identify malicious requests.
2Reliability
If traditional identification models are trained extensively, then the reliability of malicious request detection is improved, but the training time and processing speed are reduced
Solution Approach 1:
The patent extracts the essential characteristics of malicious requests by clustering sample requests and computing center vectors that represent each cluster. This extraction process separates the complex training task into pre-computed cluster representations, maintaining detection reliability while dramatically reducing the time required for model training and deployment.
Solution Approach 2:
The patent creates simplified copies of the training process by using cluster center vectors as representative models. Instead of training on individual sample requests, the system uses compact cluster center representations that capture the essential patterns, thereby maintaining detection reliability while reducing training time and computational resources required.
3Productivity
If clustering algorithms are used to process sample requests, then the processing speed is improved, but the algorithm complexity increases
Solution Approach 1:
The patent changes the parameters of the identification process by using cluster center vectors and distance thresholds instead of complex trained model parameters. This parameter transformation enables faster processing during online identification while the clustering algorithm complexity is confined to the offline training phase, effectively balancing processing speed and algorithm complexity.
Data Source
Figure 1
Figure 2
Figure 3~5
AI summary
A method and apparatus for identifying a web page request are provided. In the method, features of a plurality of sample web page requests are extracted. A feature vector for features of each sample web page request is determined. The plurality of sample web page requests are clustered using a preset clustering algorithm according to the determined feature vectors. A center vector of feature vectors of sample web page requests included in each cluster is determined according to the feature vectors of the sample web page requests included in the cluster. When a web page request to be identified is obtained, a cluster to which the web page request to be identified belongs is determined. If the distance between a feature vector of the web page request to be identified and a center vector of the cluster to which the web page request to be identified belongs is not within a preset distance range corresponding to the cluster, the web page request to be identified is determined as a malicious web page request. With the examples of the present disclosure, the computation complexity is reduced and the speed of training the web page request identification model is improved.