Web business abnormality detection method and apparatus

Abstract

The invention discloses a web business abnormality detection method. The web business abnormality detection method comprises the following steps: extracting a plurality of feature values of an access behavior in an HTTP log, and generating a feature vector; calculating an abnormal index of the feature vector according to a pre-established abnormality detection algorithm model; determining whether the abnormal index goes beyond a preset threshold value range; and if the abnormal index goes beyond the preset threshold value range, determining the access behavior corresponding to the feature vector to be abnormal. According to the method, by extracting and analyzing the feature value of an access record in the HTTP log, the abnormal behavior can be detected without a rule base, so that the detection capacity for an unknown type of abnormal behavior can be effectively improved. The invention also discloses a web business abnormality detection apparatus which has the same beneficial effects.

Description

technical field [0001] The present application relates to the field of information security, in particular to a method and device for detecting web service anomalies. Background technique [0002] With the continuous development of information technology, web access plays an important role in the application of various industries in modern work and life. [0003] However, insecure factors in the network will lead to various abnormal behaviors in normal business systems, such as being maliciously scanned by network worms for important local file information, blasted by malicious programs, or by some systems that bypass security controls. The program access, namely the back door, and the emergence of security holes, etc., are likely to bring greater failures and problems to the business system, causing serious impact and loss. Therefore, anomaly detection is very important for web business. [0004] The detection of abnormal behaviors in web access in the prior art is mainly...

AI Technical Summary

Problems solved by technology

[0005] However, since the anomaly detection scheme in the prior art can only extract rules based on known anomalous behaviors, this detection scheme can only detect known anomalous behaviors, but cannot detect some security issues that are not in the rule base

It can be seen that the detection ability of the web service anomaly detection method in the prior art needs to be improved

Images