Web unknown threat detection method and system

Abstract

The invention provides a web unknown threat detection method and system, and belongs to the technical field of network security. The method comprises the following steps: obtaining an initial feature vector set according to an http response message; performing data dimension reduction on the feature vector initial set to obtain a feature vector matrix; performing model training by taking the feature vector matrix as training input data to obtain output data corresponding to each feature vector, terminating model training when it is judged that convergence is completed, and taking a current convergence model as a prediction model; and performing http response message anomaly detection of the current network environment by using the prediction model to obtain an anomaly score set, sorting the size of each anomaly score in the anomaly score set, screening abnormal data from the sorted anomaly scores according to a preset threshold percentage, and performing risk early warning of a corresponding level according to the numerical value of the abnormal data. According to the scheme, unsupervised learning of web unknown threat detection is realized, and the method is suitable for big data monitoring.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for detecting an unknown web threat and a system for detecting an unknown web threat. Background technique [0002] At present, web (World Wide Web, global wide area network) applications develop rapidly and provide great convenience for people's life. However, malicious attacks against web vulnerabilities are becoming more and more serious, causing serious information security problems. Among them, malicious attacks against web servers have the worst impact, including the most common existing attack methods such as SQL injection and command injection. These malicious attacks pose a great threat to the security of web servers. It is becoming more and more difficult to deal with various intrusion attacks. In recent years, with the rapid development of deep learning, many deep learning algorithms have been applied to web intrusion detection technology and have a...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the embodiment of the present invention is to provide a web unknown threat detection method and system to at least solve the problem that the current artificial intelligence algorithm can not adapt to the big data environment in web threat detection

Images