Attack data set malicious fragment labeling method and system based on LSTM

Abstract

The invention provides an attack data set malicious fragment labeling method and system based on LSTM. The method comprises the following steps: extracting key values of all groups of parameters in amalicious URL; converting the key values into feature representations; inputting the feature representations into a trained LSTM model, and predicting to obtain a prediction result value with the maximum numerical value; and obtaining a corresponding malicious fragment according to the prediction result value with the maximum numerical value, obtaining the position of the malicious fragment in themalicious URL, and labeling the malicious fragment. The system comprises: a data processing unit used for extracting key values of all groups of parameters in the malicious URL and converting the keyvalues into the feature representations; a data prediction unit used for inputting the feature representations into the trained LSTM model for prediction to obtain the prediction result value with the maximum numerical value; and a data labeling unit used for acquiring the corresponding malicious fragment according to the prediction result value with the maximum numerical value, thereby acquiringthe position of the malicious fragment in the malicious URL and labeling the malicious fragment.

Description

technical field [0001] The invention relates to the technical field of network and information security, in particular to an LSTM-based method for marking malicious fragments of an attack data set and an LSTM-based system for marking malicious fragments of an attack data set. Background technique [0002] Web firewall is the first line of defense for information security. With the rapid update of network technology, new hacking techniques emerge in an endless stream, which brings challenges to traditional rule firewalls. Traditional web intrusion detection technology intercepts intrusion access by maintaining rule sets. However, hard rules are easily bypassed by flexible hackers, and rule sets based on previous knowledge are difficult to deal with 0day attacks. Attacks such as SQL injection and command injection pose a great threat to data security. In order to detect web attacks on a website, it is necessary to extract website traffic and analyze and detect the traffic. ...

AI Technical Summary

Problems solved by technology

There is currently a lack of better automated data labeling methods

Images