Method and device for detecting website attack behaviors based on machine learning

Abstract

The embodiment of the invention discloses a method and a device for detecting website attack behaviors based on machine learning, applied to a server. The method comprises the steps of acquiring the feature parameters of a current network flow, using the acquired feature parameters as the input information of a preset detection model, and acquiring the detection value of the current network flow, wherein the detection value is the feature value used for representing that the current network flow is the website attack behavior, the detection model is the one aiming at the feature parameters; updating the detection model according to the acquired feature parameters in the case of meeting preset updating conditions; analyzing the detection value based on the sorting algorithm of machine learning for judging whether the current network flow is the website attack behavior; and if yes, generating the attack detection result aiming at the current network flow. With the application of the method, the network environment which develops quickly can be adapted, and the detection rate of the website attack behaviors can be improved.

Description

technical field [0001] The present invention relates to the field of Internet technology, in particular to a method and device for detecting website attack behavior based on machine learning. Background technique [0002] The detection of website attack behavior is actually the detection of network traffic attacks (ie, web traffic attacks). Currently, there are two ways to detect website attacks: [0003] The first is the malicious keyword matching method. This method is the simplest method in the detection method of website attack behavior. The method is: establishing a malicious keyword library or a regular expression library of attack types, and detecting website attack behaviors by matching strings in network traffic. Specifically, if a string in the network traffic to be detected is successfully matched with the string in the malicious keyword database, it is determined that the network traffic is a website attack behavior. The malicious keyword matching method only...

AI Technical Summary

Problems solved by technology

The rule statistics method is only effective for specific attack types of network traffic and is not comprehensive

On the other hand, the network traffic threshold is the only factor to determine whether the network traffic is a website attack behavior, which makes the detection rate of the website attack behavior not high by this method

[0005] The detection method of website attack behavior in the prior art cannot adapt to the rapidly developing network environment, the detection rate of website attack behavior is not high, it is easy to cause information loss of the server, and the security is poor

Images