Web Page Request Identification Using Structural and Text Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious web page requests using hidden Markov models are limited by considering only text information, resulting in lower accuracy.
Innovation Solution
A method that involves obtaining tagged sample web page requests, determining structural features, segmenting text information, calculating word weights, and training a web page request identification model using a support vector machine algorithm to improve accuracy by incorporating both structural and text features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a hidden Markov model is used to identify web page requests based only on text information, then the identification process is simple, but the identification accuracy is low
Solution Approach 1:
The patent combines multiple feature types (text information, structural features, URL features, HTTP request features) into a unified identification model. This merging of diverse features enables the system to overcome the limitations of using only text information while maintaining manageable complexity through systematic feature integration and weighted fusion.
Solution Approach 2:
The identification model uses composite feature representation by integrating different types of features (text, structure, URL, HTTP) similar to how composite materials combine different substances to achieve superior properties. Each feature type contributes unique characteristics that together enhance overall identification accuracy beyond what any single feature type could achieve alone.
2Measurement precision
If only text information is considered for identification, then the processing is fast, but the identification accuracy is limited
Solution Approach 1:
The patent segments the web page request analysis into multiple independent feature extraction components (text segmentation, structural feature extraction, URL feature extraction, HTTP request feature extraction). This segmentation allows parallel processing of different feature types, maintaining processing speed while comprehensively analyzing multiple aspects of the request to improve accuracy.
Solution Approach 2:
The patent transitions from one-dimensional text analysis to multi-dimensional analysis by incorporating structural features, URL features, and HTTP request features as additional dimensions. This dimensional expansion enables more comprehensive characterization of web page requests without proportionally increasing processing time, as each dimension can be extracted independently.
3Measurement precision
If multiple feature types are integrated into the identification model, then the identification accuracy improves, but the model complexity increases
Solution Approach 1:
The patent employs parameter changes by introducing weight parameters for different feature types and using support vector machine parameters to optimize the identification model. These parameter adjustments enable the system to handle multiple feature types effectively by tuning their relative importance and optimizing the decision boundary, thereby managing model complexity while improving accuracy.
Solution Approach 2:
The support vector machine acts as an intermediary that integrates multiple feature types. It receives diverse features from different sources, processes them through a unified mathematical framework, and produces the final identification result. This intermediary role simplifies the complexity of directly combining multiple feature types by providing a standardized integration mechanism.
Data Source
Figure 1
Figure 2~3
AI summary
A method and an apparatus for identifying a web page request are provided. The method comprises obtaining a plurality of sample web page requests marked with tags, wherein each tag of the tags is a tag indicating that a web page request is a malicious web page request or a tag indicating that a web page request is a non-malicious web page request; determining a structural feature of each sample web page request; obtaining text words of each sample web page request; calculating a weight of each text word of each sample web page request; determining a feature vector of each sample web page request according to the structural feature of each sample web page request and the weight of each text word of each sample web page request; training a web page request identification model according to the feature vector and the tag of each sample web page request, based on a machine learning algorithm; and when a web page request to be identified is obtained, identifying the web page request to be identified by using the web page request identification model, to determine whether the web page request to be identified is a malicious web page request or not. Applying the example of the present disclosure, the accuracy of the identification of the web page request is improved.