Web attack detection method and device

Abstract

The embodiment of the invention provides a Web attack detection method and device, and the method comprises the steps: receiving a network Web request which carries a hypertext transfer protocol request format; taking the Web request as the input of a trained Web intrusion detection model; a Web intrusion detection model is trained; outputting a marked detection category corresponding to the Web request; wherein the trained Web intrusion detection model is obtained by training a sample set based on a Web log text; according to the to-be-trained Web intrusion detection model, a sample set of aWeb log text is used as input of the to-be-trained Web intrusion detection model; local features and high-order implicit features of data are extracted through the CNN network layer on the basis of Web log texts, sequence information between contexts in the Web log texts is extracted through the GRU network layer on the basis of the local features and the high-order implicit features, and the sequence information is classified through the full connection layer.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a web attack detection method and device. Background technique [0002] With the development of Internet technology, network Web services have been integrated into all aspects of people's lives, but due to the openness of Web services, they are easily attacked by network hackers, and network security problems arise. Therefore, Web attack detection has become one of the most important means to solve network security problems. [0003] Traditional web attack detection methods mainly detect web attacks by matching keywords or rule bases. Among them, the rule base contains the characteristics and description rules of known attack methods. The main steps of the web attack detection method include: receiving a request, and detecting the attack mode of the request through regular matching of keywords or characteristics and description rules of known attack patterns in a rule ...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the embodiment of the present invention is to provide a web attack detection method and device, which is used to solve the problem that the rule base in the web attack detection method in the prior art requires professionals to build and maintain the cost is too high, and with the change of the attack mode And the types of attacks increase, making it difficult to guarantee the security of Web services

Images