A Web attack detection method based on collaborative training

Abstract

The invention provides a Web attack detection method based on collaborative training. The problem that a Web attack detection model is difficult to train due to lack of most URL tags is solved. According to the method, a part of marked URLs and a large number of unmarked URLs can be used for carrying out model training; firstly, samples are vectorized through expert knowledge characteristics and text characteristics to obtain two independent views, then the views are used for collaborative training to obtain two attack detection models, and finally, the two models are combined through integrated learning to be used for detecting Web attacks. According to the method, the workload of manual data marking can be reduced, and the cost of Web attack detection can be reduced.

Description

technical field [0001] The invention relates to a web attack detection method based on collaborative training, and belongs to the technical fields of web intrusion detection and network security. Background technique [0002] With the wide application of Web systems, attack technologies against Web systems emerge in an endless stream, resulting in more and more attacks on Web systems. In recent years, data leakage incidents have occurred continuously. According to Verizon's "2018 Data Leakage Investigation Report", 90% of data leakage incidents in 2018 were caused by web attacks. It can be seen that the security of the Web system is still not guaranteed, so it is still necessary to study Web attack detection methods. [0003] Web attack detection methods are currently mainly divided into rule-based detection methods and machine learning-based detection methods. At present, most security products for detecting web attacks on the market use a rule-based detection method, whi...

AI Technical Summary

Problems solved by technology

The supervised learning detection method needs to collect a large amount of data and manually mark it, and then use the classification algorithm for training. The method is to use a clustering algorithm to train unlabeled data. The advantage of this method is that the training data does not require labels. The disadvantage is that the accuracy rate is lower than that of supervised learning, and it does not perform well in actual detection; semi-supervised learning detection only needs Manually label part of the unlabeled data, and use the labeled data and unlabeled data for training at the same time

The article "APU Learning based System for Potential Malicious URL Detection" published by Ya-Lin Zhang et al. on the 2017 ACM SIGSAC Conference on Computer and Communications Security mentions the use of PU-learning semi-supervised learning to detect Web attacks, and can eventually reach 94.2% accuracy, but the initial stage requires a large number of malicious samples, which still requires manual labeling to obtain

Images