WEB application security protection method based on automatic learning

Abstract

The invention discloses a WEB application security protection method based on automatic learning. The method comprises the steps that 1, logs of non-attack requests are screened; 2, a regular expression set with specific rules is generated through machine learning according to fields in the logs, and white list rules are formed; 3, the regular expression set is adopted to perform matching on received requests, and the requests not in the white list rules are intercepted or marked; and 4, the marked requests are recognized, if the requests are normal, the requests are added into the white listrules, and the requests are intercepted in case of attacks. Through the method, the white list rules can be generated through automatic learning, the missing report rate and the mistaken report rate are low in use, and an unknown vulnerability can be prevented.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a defense method for a WEB application fire protection system based on automatic learning. Background technique [0002] The WEB application system is a transaction processing system based on the B / S (browser / server) model developed by using various dynamic WEB technologies; at present, WEB security threats are becoming more and more serious, and for users, WEB security is a disaster; currently the most A commonly used method is a firewall, which can filter out data on non-service ports to prevent loopholes in non-Web services; however, traditional WEB application firewalls use attack signature databases to detect requests to determine whether the requests are normal requests; If it is a normal request, it will return the content of the request. If it is an attack request, it will intercept the request and return a prompt message; however, traditional WEB application firewalls ...

AI Technical Summary

Problems solved by technology

[0002] The WEB application system is a transaction processing system based on the B / S (browser / server) model developed by using various dynamic WEB technologies; at present, WEB security threats are becoming more and more serious, and for users, WEB security is a disaster; currently the most A commonly used method is a firewall, which can filter out data on non-service ports to prevent loopholes in non-Web services; however, traditional WEB application firewalls use attack signature databases to detect requests to determine whether the requests are normal requests; If it is a normal request, it will return the content of the request. If it is an attack request, it will intercept the request and return a prompt message; however, traditional WEB application firewalls face various types of websites in use, and there will be false positives and false negatives; they can only defend against Vulnerabilities that have been disclosed, unknown vulnerabilities cannot be protected before the rules are not upgraded

Images