Abnormal access detection method and device, electronic equipment and readable storage medium

Abstract

The invention discloses an abnormal access detection method and apparatus, an electronic equipment and a readable storage medium. The method comprises the steps of obtaining training data traffic of a target application; performing feature extraction on the data traffic for training to obtain flow data features; based on combination of supervised learning and unsupervised learning, performing feature conversion on the flow data features to learn underlying logic, access logic and service logic of the target application, and obtaining a safety protection model of the target application; and recognizing abnormal access of a target application based on the safety protection model. On the basis of an artificial intelligence method, the attack behaviors, especially the attack behaviors of 0-day vulnerabilities, can be intelligently recognized efficiently and accurately; the safety of an internet application system is remarkably improved, the applicability is wide, and the accuracy is high.

Description

technical field [0001] The present application relates to the technical field of the Internet, in particular to a detection method, device, electronic equipment and readable storage medium for abnormal access. Background technique [0002] With the rapid development of Internet technology, more and more users access servers or other terminals in the Internet through web applications, but there are many attacks in the access, such as SQL injection, high-risk persistent threat attack (Advanced Persistent Threat, APT ) etc., which cause a great security risk to servers or other terminals connected to the Internet. In the existing technology, the interception of abnormal access is usually based on the IP of the abnormal access, or by setting some simple interception rules to intercept according to the characteristics of the access, but these methods are very easy to be circumvented, especially for attackers who do not have access Attacked by system unrepaired vulnerabilities (0...

AI Technical Summary

Problems solved by technology

[0002] With the rapid development of Internet technology, more and more users access servers or other terminals in the Internet through Web applications, but there are many attacks in the access, such as SQL injection, high-risk persistent threat attacks (Advanced Persistent Threat, APT ) and so on, which pose a great security risk to servers or other terminals connected to the Internet

In the existing technology, the interception of abnormal access is usually based on the IP of the abnormal access, or by setting some simple interception rules to intercept according to the characteristics of the access, but these methods are very easy to be circumvented, especially for attackers who do not have access Attacked by unfixed vulnerabilities (0-day vulnerabilities) in the system, the existing methods have low identification efficiency and low accuracy

Images