TWI419531B - Web site attack detection system and method - Google Patents

Description

Website attack detection system and method

The present invention relates to a website attack detection system and method, and more particularly to a system and method for detecting an attack behavior by using a mechanism on a computer network.

Generally speaking, in the detection of website attack behavior, the signature is used to detect the signature, and the administrator extracts the signature from the known attack behavior enough to represent the attack behavior, and then The signature is added to the Intrusion Detection System (IDS) or the Web Application Firewall (WAF) in the form of a rule.

However, the above-mentioned website attack detection architecture has a big disadvantage - it cannot effectively detect the deformation attack. The detection method of the feature code comparison is to analyze the currently known attack behavior and find a segment to represent the attack. The signature code, and the intrusion detection system/web application firewall determines whether an attack behavior is generated by comparing the attack signatures in the filtered packet data. However, when the attacker initiates some and current When the attack behavior is similar, but the attack code is not exactly the same, the signature-based detection mechanism may be invalidated because the signature is not matched in the variant attack packet; plus an attack behavior Deformation attacks can be as many as tens or even hundreds, so it is impossible to convert all morphing attacks into signatures for detection, so it is not complete for signature-based attack detection mechanisms. A deformation attack was detected.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good designer, but needs to be improved. In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally succeeded in researching and developing the attack detection method of this website.

The object of the present invention is to provide a website attack detection system and method, which can determine whether an HTTP request is an attack behavior through a tag and a request parameter, so as to effectively and accurately detect a website attack.

A website attack detection system for achieving the above object includes: a mark sequence generation module, for an HTTP Request, responsible for converting a request parameter to which it belongs into a mark sequence, the mark sequence consisting of a plurality of marks; a mark association mode The group is responsible for generating a score of the marker sequence according to the strength of the association between the markers; and an attack detection module, which determines whether the HTTP Request is an aggressive behavior according to the score of each marker sequence and the threshold value.

The operation process of the attack detection method of the website is that the mark sequence generation module accepts the HTTP Request input and generates the mark sequence; the mark association module accepts the mark sequence generated by the mark sequence generation module, and generates a score of each mark sequence; The detecting module determines whether the HTTP Request is an attack according to the score of each marking sequence generated by the tag association module and the threshold value.

The tag sequence generation module defines a plurality of tags and a relationship between the tags and the request parameter strings. The main purpose of the tag sequence generation module is to simplify the request parameters so that the tag association module can perform association analysis on them, for example, "eval" in the request parameters. The "script" string will be replaced by the "SCRIPT_WORD" tag. The tag sequence generation module uses HTTP Request as input data, which analyzes and extracts all request parameters and converts them into a plurality of tag sequences.

The tag association module uses statistical or machine learning (including hidden Markov models, Markov chains, neural networks, decision trees, support vector machines, Bayesian networks) to generate scores for each tag sequence, in order to make the tags The association module has the criteria for calculating the score of the marker sequence, so it must be trained first. The training method is to give the marker association module some sample sequence data belonging to the attack. Through the training of the sample data, the marker association module can The entered sequence of tokens is then calculated for its score. The tag sequence sample data is generated by first obtaining some HTTP Requests that are attacked by the expert, and then using the tag sequence generation module to convert those request parameters into tag sequence samples.

The attack detection module performs comprehensive judgment according to the score of each mark sequence and the threshold value of the input to determine whether an HTTP Request is an attack. The main judgment principle is that when any HTTP request belongs to a request parameter, the score is higher than When the threshold is exceeded, it is determined that the HTTP Request is an attack behavior.

FIG. 1 is an architectural diagram of a website attack detection system, showing the relationship and operation process between the modules of the present invention; the website attack detection system includes a mark sequence generation module 100, a mark association module 200, and attack detection. Module 300.

The tag sequence generation module 100 receives an HTTP Request and extracts all the request parameters from the file, and converts the request parameters into a tag sequence according to a defined tag list. The tag list is shown in FIG. 5 and FIG. 6, and FIG. 5 is used to define The boundary of each mark in the request parameter, the "KEY" mark in Figure 6 represents the string with the higher frequency of occurrence, and all the strings that do not belong to other marks are converted with the "VAR" mark. The tag sequence generation module 100 finally produces one or more tag sequences, the number of tag sequences being equal to the number of request parameters possessed by the HTTP Request. For example, if an HTTP Request contains two sets of request parameters as "id=jacky" and "value=<script>alert(document.cookie)</script>", the two sets of request parameters will be converted by the mark sequence generation module. The two sets of markup sequences are "KEY=VAR" and "KEY=<SCRIPT_WORD>ALERT VAR</SCRIPT_WORD>".

The tag association module 200 accepts the tag sequence output by the tag sequence generation module 100, and respectively outputs the score of each tag sequence and outputs it; the scoring method used by the tag association module 200 can be any statistical or machine learning method. (including hidden Markov model, Markov chain, neural network, decision tree, support vector machine, Bayesian network). In this embodiment, the Hidden Markov Model (HMM) is used to execute the mark sequence. Score. The tag association module 200 must first obtain the criteria for calculating the score through the training phase before the flag sequence can be officially scored, as shown in FIG. 2 as the process of the tag association module 200 in the training phase, when it is known as an attack. After the HTTP Request is converted into a mark sequence by the mark sequence generation module, the mark sequence is input into the mark association training module 201, thereby obtaining the degree of association between the marks. FIG. 3 shows a flow of the marker association module 200 starting to score the marker sequence after the training is completed. The marker association online module 202 calculates each of the marker association strength information obtained by the marker association training module 201 during the training phase. The score of the marker sequence, the higher the score, the more likely the marker sequence is to imply an aggressive behavior.

After the attack detection module 300 receives the score of each mark sequence output by the mark association module 200, it determines whether the HTTP request is an attack behavior according to a predefined threshold value, and FIG. 4 indicates the judgment of the attack detection module 300. The flowchart includes the steps of: 301 first converting the request parameter in the HTTP Request into one or more tag sequences by using the tag list, and storing the score of each tag sequence output by the tag association module 200; 302 using machine learning or statistics The method scores each marker sequence separately, and must be trained before scoring. Therefore, it is necessary to provide the marker sequence data of the method known as attack or normal behavior as the training set of the above method acquisition scoring rules. Training, and then comparing the scores of each mark sequence with the threshold value; 303 in the stored mark sequence, when any one of the mark sequence scores is greater than the threshold value, the HTTP Request is determined to be an aggressive behavior; 304, If none of the mark sequence scores is greater than the threshold value, it is determined that the HTTP Request is normal without an attack. It is.

The website attack detection method provided by the invention has the following advantages when compared with other conventional technologies:

1. Compared with the current common attack detection method, the present invention can detect deformation attacks completely and effectively.

2. The present invention separately processes calculations for each request parameter. When any of the request parameters is determined to be an attack, the HTTP Request is determined to be an attack. Compared with some methods, only the content of the HTTP Request is determined. It can avoid the problem that the attack code is easy to be ignored when the proportion of HTTP Request content is too low.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

100. . . Tag sequence generation module

200. . . Tag association module

201. . . Tag association training module

202. . . Tag association online module

300. . . Attack detection module

Please refer to the following detailed description of the invention and the accompanying drawings, which will further understand the technical content of the invention and its effect;

1 is a flow chart of a website attack detection device;

2 is a flow chart of the tag association module in the training phase;

Figure 3 is a scoring flowchart of the tag association module;

4 is a flow chart of determining an attack detection module;

Figure 5 is a list of markers -1;

Figure 6 is a list of tags -2.

100‧‧‧Marking sequence generation module

200‧‧‧ tag association module

300‧‧‧ Attack Detection Module

Claims (12)

A website attack detection system includes: a. a mark sequence generation module, which converts a request parameter in an HTTP Request into a singular or plural mark sequence according to a mark list, wherein the content of the mark list is not fixed, due to a system environment And b. the tag association module, which is responsible for scoring the tag sequence; and c. the attack detection module, which is responsible for comprehensively determining whether the HTTP request is based on external information such as the score and threshold of each tag sequence For the attack. The website attack detection system of claim 1, wherein the mark sequence generation module converts the request parameter into a tag sequence through a self-definable tag list. For example, in the website attack detection system described in claim 1, wherein the tag association module needs to undergo a training phase, and the training mode is to provide a plurality of tag sequences belonging to the attack and input to the tag association module to learn the attack. The structure of the data; the attack signature sequence is generated by the tag sequence generation module by inputting the HTTP Request belonging to the attack into the tag sequence generation module. The website attack detection system of claim 1, wherein the mark association module can use a statistical method. The website attack detection system of claim 1, wherein the mark association module can use a Hidden Markov Model. The website attack detection system of claim 1, wherein the mark association module can use a Markov Chain. The website attack detection system of claim 1, wherein the mark association module can use a neural network. The website attack detection system of claim 1, wherein the mark association module can use a decision tree. The website attack detection system of claim 1, wherein the mark association module can use a support vector machine (Support Vector Machine). The website attack detection system of claim 1, wherein the mark association module can use a Bayesian network. For example, in the website attack detection system described in claim 1, wherein the attack detection module compares the scores of each mark sequence with external information such as threshold values, as long as any mark sequence is identified as an attack ( HOW), the HTTP Request is considered an attack. A method for detecting a website attack, the method comprising the steps of: a. converting a request parameter in an HTTP Request into one or more tag sequences using a tag list; b. scoring each tag sequence separately using machine learning or statistical methods ;c. Training must be performed before scoring, so it is necessary to provide the marker sequence data of the method known as attack or normal behavior as the training set of the above method acquisition scoring rules, so as to train; d. compare each one The difference between the score of the mark sequence and the threshold value. When the score of any mark sequence is higher than the threshold value, it is determined that the HTTP Request contains the attack behavior; otherwise, when the scores of all the mark sequences are lower than the threshold value, the judgment is determined. This HTTP Request does not contain attack behavior.