Web attack detection method and Web stack detection device

Abstract

The invention provides a Web attack detection method and a Web attack detection device. The method comprises the following steps: acquiring a to-be-detected Web request, and pretreating the to-be-detected Web request to acquire a corresponding target character string; carrying out vectorization treatment on the target character string to acquire a corresponding target vector; and detecting the target vector according to a detection model, and judging whether a to-be-detected Web request is an attack request or not. Therefore, the attack request and even a novel unknown attack can be timely and effectively detected. Meanwhile, after building of the detection model is completed, manual intervention is not needed, and detection rules do not need to be established, so that labor cost is reduced.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a web attack detection method and device. Background technique [0002] Traditional web attack detection methods (for example, detection methods based on traditional regular expressions, black / white list methods) need to manually formulate detection rules and manually construct training samples for supervised detection. These operations need to be performed by experienced white hats (positive Hackers can identify security loopholes in computer systems or network systems, but they will not exploit them maliciously, but publish the loopholes so that the system can be patched before being exploited by others (such as black hats), so as to ensure detection The effectiveness of the method requires high labor costs, and the professional skills of many enterprise employees do not meet the requirements. [0003] In the existing technology, detection methods based on...

AI Technical Summary

Problems solved by technology

[0002] Traditional web attack detection methods (for example, detection methods based on traditional regular expressions, black / white list methods) need to manually formulate detection rules and manually construct training samples for supervised detection. These operations need to be performed by experienced white hats (positive Hackers can identify security loopholes in computer systems or network systems, but they will not exploit them maliciously, but publish the loopholes so that the system can be patched before being exploited by others (such as black hats), so as to ensure detection The effectiveness of the method requires high labor costs, and the professional skills of many enterprise employees do not meet the requirements

[0003] In the existing technology, detection methods based on rules, whitelists, blacklists, regular expressions and string matching can intercept most attacks, but the detection rules are too strict and the false alarm rate is too high, which will affect Normal use by users

The detection rules are broad and easy for attackers to bypass

[0004] In addition, the existing detection methods cannot detect and block new unknown attacks in a timely manner. After a new type of attack appears, it usually needs to be disseminated, discovered, and disclosed before relevant personnel can analyze and formulate detection rules, which have a certain impact on attack detection. Delay

Images