WO2021139641A1 - 一种web攻击检测方法、装置及电子设备和存储介质 - Google Patents

一种web攻击检测方法、装置及电子设备和存储介质 Download PDF

Info

Publication number
WO2021139641A1
WO2021139641A1 PCT/CN2021/070243 CN2021070243W WO2021139641A1 WO 2021139641 A1 WO2021139641 A1 WO 2021139641A1 CN 2021070243 W CN2021070243 W CN 2021070243W WO 2021139641 A1 WO2021139641 A1 WO 2021139641A1
Authority
WO
WIPO (PCT)
Prior art keywords
access request
malicious
target
access
target access
Prior art date
Application number
PCT/CN2021/070243
Other languages
English (en)
French (fr)
Inventor
杨荣海
Original Assignee
深信服科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深信服科技股份有限公司 filed Critical 深信服科技股份有限公司
Publication of WO2021139641A1 publication Critical patent/WO2021139641A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements

Definitions

  • This application relates to the field of computer technology, and more specifically, to a web attack detection method and device, an electronic device, and a computer-readable storage medium.
  • WAF Choinese full name: Web Application Protection System, English full name: Web Application Firewall
  • WAF performs web attack detection and interception based on a single access request, and its ability to detect web attacks with unobvious characteristics is weak.
  • the purpose of this application is to provide a web attack detection method and device, an electronic device, and a computer-readable storage medium, so as to improve the ability to detect web attacks.
  • this application provides a web attack detection method, including:
  • the target access connection is matched with the malicious access model, and the detection result of the target access request is obtained based on the matching result.
  • the constructing a malicious access model based on the context characteristics of the access request in the malicious access connection includes:
  • matching the target access connection with the malicious access model and obtaining the detection result of the target access request based on the matching result includes:
  • matching the target operation sequence with the malicious operation sequence to obtain the detection result of the target access request includes:
  • the target access request is a malicious access request.
  • matching the target operation sequence with the malicious operation sequence to obtain the detection result of the target access request includes:
  • the constructing a malicious access model based on the context characteristics of the access request in the malicious access connection includes:
  • a neural network model is trained using the feature vectors of all the access requests, and the malicious access model is determined to be a neural network model that has been trained.
  • matching the target access connection with the malicious access model, and obtaining the detection result of the target access request based on the matching result includes:
  • the feature vector corresponding to each access request in the target access connection is input into the trained neural network model to obtain the detection result of the target access request.
  • constructing the feature vector corresponding to each access request according to all the fields corresponding to each access request includes:
  • Each field corresponding to each access request is mapped to an ASCII code string, and a feature vector corresponding to each access request is constructed according to the mapping result; wherein each of the ASCII code strings has the same length.
  • inputting the feature vector corresponding to each access request in the target access connection into the trained neural network model to obtain the detection result of the target access request includes:
  • the feature vector corresponding to each access request in the target access connection is input into the trained neural network model to obtain the prediction vector corresponding to each access request in the target access connection; wherein, in the prediction vector The i-th element is the probability that the access request is the i-th output state defined by the neural network model;
  • the predicted value is greater than the third predicted value, it is determined that the target access request is a malicious access request.
  • the training of the neural network model using the feature vectors of all the access requests includes:
  • the calculating the prediction value corresponding to the target access request based on the prediction vector corresponding to the target access request includes:
  • the product of the prediction vector corresponding to the target access request and the target vector is used as the prediction value corresponding to the target access request.
  • the method further includes:
  • this application provides a web attack detection device, including:
  • the determining module is used to determine the target access connection to which the target access request belongs when the target access request is received;
  • the matching module is used to match the target access connection with the malicious access model, and obtain the detection result of the target access request based on the matching result.
  • an electronic device including:
  • Memory used to store computer programs
  • the processor is used to implement the steps of the above web attack detection method when the computer program is executed.
  • the present application provides a computer-readable storage medium having a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the foregoing web attack detection method are implemented.
  • a web attack detection method includes: obtaining a malicious access connection, constructing a malicious access model based on the context characteristics of the access request in the malicious access connection; The target access connection to which the target access request belongs; the target access connection is matched with the malicious access model, and the detection result of the target access request is obtained based on the matching result.
  • the web attack detection method provided in this application establishes a malicious access model by analyzing the context characteristics of each access request in a malicious access connection, tracks and learns the behavior of the entire access connection, and can combine multiple weak features of web attacks to better understand the attacker
  • the intention of malicious access model has higher accuracy.
  • the entire target access connection corresponding to the target access request is matched with the malicious access model, so as to synthesize the context characteristics between the multiple access requests in the entire target access connection for judgment.
  • the application also discloses a web attack detection device, an electronic device and a computer-readable storage medium, which can also achieve the above technical effects.
  • Fig. 1 is a flow chart showing a method for detecting web attacks according to an exemplary embodiment
  • Fig. 2 is a flowchart showing another web attack detection method according to an exemplary embodiment
  • Fig. 3 is a flow chart showing yet another method for detecting web attacks according to an exemplary embodiment
  • Fig. 4 is a structural diagram of a web attack detection device according to an exemplary embodiment
  • Fig. 5 is a structural diagram of an electronic device according to an exemplary embodiment.
  • the malicious access model is established by analyzing the context characteristics of each access request in the entire malicious access connection. When the target access request is received, the entire target access connection corresponding to the malicious access model is matched to synthesize The context characteristics between multiple access requests in the entire target access connection are determined. Due to the introduction of the context relationship between access requests, the ability to detect web attacks is improved.
  • the embodiment of the application discloses a web attack detection method, which improves the detection capability of web attacks.
  • a flow chart of a web attack detection method according to an exemplary embodiment, as shown in Fig. 1, includes:
  • S101 Obtain a malicious access connection, and construct a malicious access model based on the context characteristics of the access request in the malicious access connection;
  • the execution subject of this embodiment may be a WAF device, whose purpose is to perform web attack detection on the received access request.
  • WAF device whose purpose is to perform web attack detection on the received access request.
  • a large amount of hacker's real access data needs to be collected, namely the malicious access connection in this step.
  • the collection method of malicious access connections is not limited here.
  • the malicious access connection in this step includes multiple access requests.
  • the malicious access model is constructed by learning the context characteristics between the access requests.
  • Web attacks have obvious access patterns. For example, when hackers conduct WebShell backdoor communication, they often use shell commands to check the current environment, and then use scripting languages such as PHP to execute arbitrary codes. It is also possible to use SQL to initiate database queries and modify operations. Wait. Therefore, a series of suspicious access requests can be reflected in the access connection: command injection, code injection, and SQL injection. If you can learn the above-mentioned series of access patterns, that is, the context characteristics between multiple access requests, WAF can not only intercept malicious behaviors more accurately, but also better understand hacker attacks.
  • a malicious access model is constructed based on the context characteristics of the access request in the malicious access connection, and the malicious access model can reflect the malicious access pattern of the attacker, thereby performing web attack detection on the received access connection.
  • the specific construction method of the malicious access model is not limited here.
  • the operation sequence of the malicious access connection is used as the malicious access model.
  • the neural network model can also be used to learn the context relationship between access requests, and the trained neural network model can be regarded as the malicious The access model, as long as it can reflect the context relationship between the access requests in the malicious access connection, that is, the association of the previous and subsequent operations is within the protection scope of this embodiment.
  • the target access connection described by the client is determined. It is understandable that if the web application requested by the target access request is a connection-based application, the target access connection can be determined based on the channel established between the client and the application, that is, all access connections transmitted in the channel are Belongs to the target access connection. If the web application requested by the target access request is not a connection-based application, the access request received within the preset time window and the target access request may be combined into the target access connection in the order of receiving time.
  • S103 Match the target access connection with the malicious access model, and obtain a detection result of the target access request based on the matching result.
  • the target access connection determined in the previous step is matched with the malicious access model to analyze the context relationship of each access request in the target access connection, so as to perform web attack detection on the currently received target access connection. If the matching is successful, it is determined that the target access request is a malicious access request and intercepted; otherwise, it is determined that the target access request is a normal access request, and the target access request is released. It is understandable that because the malicious access model can be expressed in different forms, the matching method and the criteria for determining the success of the matching are also different, which will be described in detail in the subsequent embodiments.
  • this step further includes: when the target access request is a malicious access request, intercepting the target access request; determining the source IP address corresponding to the target access request, and blocking the Source IP address.
  • this embodiment adopts a connection-based web attack detection method and comprehensively analyzes the context relationship of multiple access requests, it has higher accuracy. In some scenarios with high defense strength requirements, for suspicious connections with high confidence, stronger protection measures can be adopted, such as directly blocking suspicious IP addresses, increasing the cost of attacks.
  • the web attack detection method establishes a malicious access model by analyzing the context characteristics of each access request in the malicious access connection, tracks and learns the behavior of the entire access connection, and can combine multiple weak features of web attacks for a better understanding
  • the intention of the attacker the malicious access model has higher accuracy.
  • the entire target access connection corresponding to the target access request is matched with the malicious access model, so as to synthesize the context characteristics between the multiple access requests in the entire target access connection for judgment.
  • it can greatly increase the detection rate of web attacks while ensuring low false positives. rate.
  • the embodiment of the present application discloses a web attack detection method. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution. specific:
  • FIG. 2 a flowchart of another web attack detection method according to an exemplary embodiment, as shown in Fig. 2, includes:
  • S201 Obtain a malicious access connection, and identify the request type of each access request in the malicious access connection;
  • the malicious operation sequence corresponding to the malicious access connection is used as the malicious access model.
  • the WAF detects each access request in the malicious access connection, and the obtained detection result is, for example, a normal request and a malicious request.
  • WAF will also detect specific attack types and threat levels, such as command injection, code injection, SQL injection, etc., and threat levels such as high, medium, and low.
  • attack types and different threat levels can be understood as different request types, that is, request types can include normal requests, high-risk command injection requests, low-risk code injection requests, and so on.
  • S202 Construct a malicious operation sequence corresponding to the malicious access connection according to the request type of each access request;
  • each access request in the malicious access connection is mapped to a certain character based on the above request type. For example, a normal request can be mapped to the character "B”. The high-risk command injection is mapped to the character "C”, and the medium-risk command injection attack is mapped to the character "D” and so on. Therefore, a malicious access connection of an attacker can be represented by a character string such as "BCD", that is, the malicious access model is the malicious operation sequence corresponding to the malicious access connection.
  • S203 When receiving the target access request, determine the target access connection to which the target access request belongs;
  • S204 Construct a target operation sequence corresponding to the target access connection, and match the target operation sequence with the malicious operation sequence to obtain a detection result of the target access request.
  • the target operation sequence corresponding to the target access connection to which it belongs is first determined.
  • the construction method of the target operation sequence is similar to that of the malicious operation sequence, which has been described in detail in step S202. , I won’t repeat it here.
  • Matching the target operation sequence with the malicious operation sequence can obtain the matching degree of the target access connection and the malicious access connection, and then detect the currently received target access connection.
  • a common substring method may be used, that is, the target operation sequence is matched with the malicious operation sequence to obtain the detection result of the target access request, including: The operation sequence is matched with the malicious operation sequence to obtain a common substring; when the length of the common substring is greater than a first preset value, it is determined that the target access request is a malicious access request.
  • the target operation sequence is matched with each malicious operation sequence to obtain the common substring of the target operation sequence and each malicious operation sequence.
  • the target The access connection is similar to a malicious access mode, and the currently received target access request is determined to be a malicious access request and intercepted.
  • the first preset value is not specifically limited here, and those skilled in the art can set it flexibly according to the actual required detection capabilities.
  • the string similarity between the target operation sequence and each malicious operation sequence is calculated. When a certain string similarity is greater than the second preset value, it indicates that the target access connection is similar to a certain malicious access mode, and it is determined The currently received target access request is a malicious access request and is intercepted.
  • the second preset value is not specifically limited, and those skilled in the art can set it flexibly according to the actual required detection capabilities.
  • the malicious operation sequence corresponding to the malicious access connection is used as the malicious access model.
  • the target operation sequence corresponding to the target access connection to which it belongs is matched with the malicious operation sequence. , Matching the context relationship between each access request in the target access leveling and the context relationship in the malicious access mode through the matching of the string, the efficiency is high, and the detection efficiency is improved while improving the detection ability of web attacks. .
  • the embodiment of the present application discloses a web attack detection method. Compared with the first embodiment, this embodiment further explains and optimizes the technical solution. specific:
  • FIG. 3 a flowchart of yet another web attack detection method according to an exemplary embodiment, as shown in Fig. 3, includes:
  • S301 Obtain a malicious access connection, and perform message analysis on each access request in the malicious access connection to obtain all fields corresponding to each access request;
  • S302 Construct a feature vector corresponding to each access request according to all the fields corresponding to each access request;
  • a neural network model is used to learn the context relationship between access requests, and the trained neural network model is used as a malicious access model.
  • a message is parsed for each access request in the malicious access connection to obtain all the fields corresponding to each access request, which may include, for example, URL, header fields and body.
  • the feature vector corresponding to each access request is constructed based on the result of the message analysis, that is, all fields are combined into a feature vector.
  • the specific method of constructing the feature vector is not limited here.
  • an ASCII table can be used. That is, the construction of the feature vector corresponding to each access request according to all the fields corresponding to each access request includes: Each field corresponding to the access request is mapped to an ASCII code string, and a feature vector corresponding to each access request is constructed according to the mapping result; wherein each of the ASCII code strings has the same length.
  • each character in the field it is mapped to the corresponding ASCII code character to form an ASCII code string. If there are characters that are not in the ASCII table, such as Chinese characters, they are directly discarded.
  • the ASCII code string corresponding to each field in the access request can be combined into a feature vector corresponding to the access request.
  • the length of the feature vector can also be set. If the length exceeds the preset length, it will be directly truncated, and if it is insufficient, the zero-filling operation can be performed.
  • the status value of each access request in the malicious access connection is marked.
  • the status value here can be understood as the request type of each access request introduced in the previous embodiment, and the neural network model can also be evaluated according to other standards.
  • the output state is set, and there is no specific limitation here.
  • the feature vector and state value of each access request in the malicious access connection are output to the neural network model in the time sequence of the request to train the neural network model.
  • the neural network model can learn the context of the access request in the malicious access connection through the feature vector of the access request, that is, the malicious access mode.
  • the specific type of neural network model is not limited here.
  • RNN full Chinese name: Recurrent Neural Network, full English name: Recurrent Neural Network
  • LSTM full Chinese name: Long Short-Term Memory Network, full English name: Long Short-Term Memory
  • GRU Gated Recurrent Unit
  • S304 When receiving the target access request, determine the target access connection to which the target access request belongs;
  • S305 Input the feature vector corresponding to each access request in the target access connection into the trained neural network model to obtain the detection result of the target access request.
  • the feature vector of each access connection in the target access connection to which it belongs is first extracted.
  • the specific extraction method has been described in detail above, and will not be repeated here.
  • the feature vectors are sequentially input into the trained neural network model, and the prediction result corresponding to each access request can be obtained. Due to the characteristics of the neural network model, the prediction result of the previous access request will be used as the input of this prediction, that is, when the current access request is predicted, the prediction result of the previous access request and the feature vector of the current access request will be used Therefore, the neural network model can use the context relationship between access requests to make predictions.
  • this step may include: inputting the feature vector corresponding to each access request in the target access connection into the trained neural network model to obtain the prediction vector corresponding to each access request in the target access connection; Wherein, the i-th element in the prediction vector is the probability that the access request is the i-th output state defined by the neural network model; calculate the corresponding target access request based on the prediction vector corresponding to the target access request When the predicted value is greater than the third predicted value, it is determined that the target access request is a malicious access request.
  • the prediction vector here is the vector of the prediction result corresponding to each access request, and the prediction vector of the t-th access request can be expressed as among them, Indicates the probability that the access request is the i-th output state defined by the neural network model, 1 ⁇ i ⁇ N, and N is the total number of output states.
  • the prediction vector of the last output of the neural network model that is, the prediction vector corresponding to the target access request, is used to obtain the predicted value.
  • the predicted value is greater than the third predicted value, it indicates that the target access connection is similar to a malicious access pattern , Determine that the currently received target access request is a malicious access request, and intercept it.
  • the third preset value is not specifically limited, and those skilled in the art can set it flexibly according to the actual required detection capabilities.
  • the corresponding prediction vector, the softmax() function normalizes the final output prediction value, and the third prediction value is set to a value between 0 and 1, such as 0.5. It is understandable that if the prediction vector is a 1 ⁇ N vector, then V is a N ⁇ 1 vector, and the i-th element can be understood as the weight of the i-th output state defined by the neural network model.
  • the target vector is in the neural network The target vector is optimized during the training process of the model.
  • the trained neural network model is used as a malicious access model.
  • the feature vector of each access request in the target access connection to which it belongs is input into the trained neural network.
  • the check result of the currently received target access request is obtained. Because the neural network model has strong learning ability, high detection accuracy, and strong generalization ability, it can deal with unknown threats to a certain extent.
  • the following describes a web attack detection device provided by an embodiment of the present application.
  • the web attack detection device described below and the web attack detection method described above can be cross-referenced.
  • a structural diagram of a web attack detection device includes:
  • the construction module 401 is configured to obtain a malicious access connection, and construct a malicious access model based on the context characteristics of the access request in the malicious access connection;
  • the determining module 402 is configured to determine the target access connection to which the target access request belongs when the target access request is received;
  • the matching module 403 is configured to match the target access connection with the malicious access model, and obtain the detection result of the target access request based on the matching result.
  • the web attack detection device establishes a malicious access model by analyzing the context characteristics of each access request in the malicious access connection, tracks and learns the behavior of the entire access connection, and can combine multiple weak features of web attacks for a better understanding
  • the intention of the attacker the malicious access model has higher accuracy.
  • the entire target access connection corresponding to the target access request is matched with the malicious access model, so as to synthesize the context characteristics between the multiple access requests in the entire target access connection for judgment.
  • it can greatly increase the detection rate of web attacks while ensuring low false positives. rate.
  • the construction module 401 includes:
  • the obtaining unit is used to obtain malicious access connections
  • An identification unit for identifying the request type of each access request in the malicious access connection
  • the first construction unit is configured to construct a malicious operation sequence corresponding to the malicious access connection according to the request type of each access request, and determine that the malicious access model is the malicious operation sequence;
  • the matching module 403 is specifically a module that constructs a target operation sequence corresponding to the target access connection, and matches the target operation sequence with the malicious operation sequence to obtain the detection result of the target access request.
  • the matching module 403 includes:
  • the first matching unit is configured to match the target operation sequence with the malicious operation sequence to obtain a common substring
  • the first determining unit is configured to determine that the target access request is a malicious access request when the length of the common substring is greater than a first preset value.
  • the matching module 403 includes:
  • the first calculation unit is configured to calculate the string similarity between the target operation sequence and the malicious operation sequence
  • the second determining unit is configured to determine that the target access request is a malicious access request when the string similarity is greater than a second preset value.
  • the construction module 401 includes:
  • the obtaining unit is used to obtain malicious access connections
  • a parsing unit configured to perform message parsing on each access request in the malicious access connection to obtain all the fields corresponding to each access request
  • the second construction unit is configured to construct a feature vector corresponding to each access request according to all the fields corresponding to each access request;
  • the training unit is used to train a neural network model by using feature vectors of all the access requests, and determine that the malicious access model is a neural network model that has been trained.
  • the matching module 403 is specifically a module that inputs the feature vector corresponding to each access request in the target access connection into the trained neural network model to obtain the detection result of the target access request.
  • the second construction unit specifically maps each field corresponding to each access request to an ASCII code string, and constructs each address according to the mapping result.
  • the matching module 403 includes:
  • the input unit is configured to input the feature vector corresponding to each access request in the target access connection into the trained neural network model to obtain the prediction vector corresponding to each access request in the target access connection;
  • the i-th element in the prediction vector is the probability that the access request is the i-th output state defined by the neural network model;
  • the second calculation unit is configured to calculate the predicted value corresponding to the target access request based on the prediction vector corresponding to the target access request;
  • the third determining unit is configured to determine that the target access request is a malicious access request when the predicted value is greater than the third predicted value.
  • the training unit specifically trains a neural network model using feature vectors of all the access requests, optimizes the target vector during the training process, and determines the malicious access model Is the unit of the trained neural network model; wherein the i-th element in the target vector is the weight of the i-th output state;
  • the second calculation unit is specifically a unit that uses the product of the prediction vector corresponding to the target access request and the target vector as the prediction value corresponding to the target access request.
  • the interception module is used to intercept the target access request when the target access request is a malicious access request
  • the blocking module is used to determine the source IP address corresponding to the target access request and block the source IP address.
  • the present application also provides an electronic device.
  • a structural diagram of an electronic device 500 provided in an embodiment of the present application, as shown in FIG. 5, may include a processor 11 and a memory 12.
  • the electronic device 500 may further include one or more of a multimedia component 13, an input/output (I/O) interface 14, and a communication component 15.
  • I/O input/output
  • the processor 11 is used to control the overall operation of the electronic device 500 to complete all or part of the steps in the web attack detection method described above.
  • the memory 12 is used to store various types of data to support operations on the electronic device 500. These data may include, for example, instructions for any application or method to operate on the electronic device 500, as well as application-related data. For example, contact data, messages sent and received, pictures, audio, video, etc.
  • the memory 12 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, SRAM for short), electrically erasable programmable read-only memory ( Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-only Memory (Read-Only Memory, ROM for short), magnetic memory, flash memory, magnetic disk or optical disk.
  • the multimedia component 13 may include a screen and an audio component.
  • the screen may be a touch screen, for example, and the audio component is used to output and/or input audio signals.
  • the audio component may include a microphone, which is used to receive external audio signals.
  • the received audio signal may be further stored in the memory 12 or sent through the communication component 15.
  • the audio component also includes at least one speaker for outputting audio signals.
  • the I/O interface 14 provides an interface between the processor 11 and other interface modules.
  • the above-mentioned other interface modules may be keyboards, mice, buttons, and the like. These buttons can be virtual buttons or physical buttons.
  • the communication component 15 is used for wired or wireless communication between the electronic device 500 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination of one or more of them, so the corresponding communication component 15 may include: Wi-Fi module, Bluetooth module, NFC module.
  • the electronic device 500 may be implemented by one or more application specific integrated circuits (Application Specific Integrated Circuit, ASIC for short), digital signal processor (Digital Signal Processor, DSP for short), and digital signal processing equipment (Digital Signal Processor). Signal Processing Device, DSPD for short), Programmable Logic Device (PLD for short), Field Programmable Gate Array (FPGA for short), controller, microcontroller, microprocessor or other electronic components Implementation, used to implement the above-mentioned web attack detection method.
  • ASIC Application Specific Integrated Circuit
  • DSP Digital Signal Processor
  • DSP Digital Signal Processor
  • Digital Signal Processor Digital Signal Processor
  • DSPD Signal Processing Device
  • PLD Programmable Logic Device
  • FPGA Field Programmable Gate Array
  • a computer-readable storage medium including program instructions that, when executed by a processor, implement the steps of the web attack detection method described above.
  • the computer-readable storage medium may be the foregoing memory 12 including program instructions, and the foregoing program instructions may be executed by the processor 11 of the electronic device 500 to complete the foregoing web attack detection method.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

一种web攻击检测方法、装置及一种电子设备和计算机可读存储介质，该方法包括: 获取恶意访问连接，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型; 当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接; 将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果。本申请提供的web攻击检测方法，考虑到整个访问连接中各访问请求之间的上下文关系，可以在大幅提升web攻击检出率的同时，保证低误报率。

Description

一种web攻击检测方法、装置及电子设备和存储介质
本申请要求于2020年1月7日提交中国专利局、申请号为202010014713.9、发明名称为“一种web攻击检测方法、装置及电子设备和存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，更具体地说，涉及一种web攻击检测方法、装置及一种电子设备和一种计算机可读存储介质。
背景技术
由于web应用的普及十分广泛，使得web应用成为攻击者主要的攻击目标。目前，网站主要采用WAF(中文全称：Web应用防护系统，英文全称：Web Application Firewall)应对web攻击。在相关技术中，WAF基于单个访问请求进行web攻击检测拦截，其对于特征不是很明显的web攻击检测能力弱。
因此，如何提高对web攻击的检测能力是本领域技术人员需要解决的技术问题。
发明内容
本申请的目的在于提供一种web攻击检测方法、装置及一种电子设备和一种计算机可读存储介质，提高了对web攻击的检测能力。
为实现上述目的，本申请提供了一种web攻击检测方法，包括：
获取恶意访问连接，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型；
当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；
将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果。
其中，所述基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型，包括：
识别所述恶意访问连接中每个访问请求的请求类型；
根据每个所述访问请求的请求类型构建所述恶意访问连接对应的恶意操作序列；
确定所述恶意访问模型为所述恶意操作序列；
相应的，将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果，包括：
构建所述目标访问连接对应的目标操作序列，将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果。
其中，将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果，包括：
将所述目标操作序列与所述恶意操作序列进行匹配得到公共子串；
当所述公共子串的长度大于第一预设值时，判定所述目标访问请求为恶意访问请求。
其中，将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果，包括：
计算所述目标操作序列与所述恶意操作序列的字符串相似度；
当所述字符串相似度大于第二预设值时，判定所述目标访问请求为恶意访问请求。
其中，所述基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型，包括：
对所述恶意访问连接中每个访问请求进行报文解析得到每个所述访问请求对应的所有字段；
根据每个所述访问请求对应的所有字段构建每个所述访问请求对应的特征向量；
利用所有所述访问请求的特征向量训练神经网络模型，并确定所述恶意访问模型为训练完成的神经网络模型。
相应的，将所述目标访问连接与所述恶意访问模型进行匹配，并基于 匹配结果得到所述目标访问请求的检测结果，包括：
将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中得到所述目标访问请求的检测结果。
其中，所述根据每个所述访问请求对应的所有字段构建每个所述访问请求对应的特征向量，包括：
将每个所述访问请求对应的每个字段映射为ASCII码字符串，并根据映射结果构建每个所述访问请求对应的特征向量；其中，每个所述ASCII码字符串的长度相同。
其中，将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中得到所述目标访问请求的检测结果，包括：
将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中，得到所述目标访问连接中每个访问请求对应的预测向量；其中，所述预测向量中的第i个元素为所述访问请求为所述神经网络模型定义的第i个输出状态的概率；
基于所述目标访问请求对应的预测向量计算所述目标访问请求对应的预测值；
当所述预测值大于第三预测值时，判定所述目标访问请求为恶意访问请求。
其中，所述利用所有所述访问请求的特征向量训练神经网络模型，包括：
利用所有所述访问请求的特征向量训练神经网络模型，在训练过程中优化目标向量；其中，所述目标向量中的第i个元素为所述第i个输出状态的权重；
相应的，所述基于所述目标访问请求对应的预测向量计算所述目标访问请求对应的预测值，包括：
将所述目标访问请求对应的预测向量与目标向量的乘积作为所述目标访问请求对应的预测值。
其中，所述基于匹配结果得到所述目标访问请求的检测结果之后，还包括：
当所述目标访问请求为恶意访问请求时，拦截所述目标访问请求；
确定所述目标访问请求对应的源IP地址，并封锁所述源IP地址。
为实现上述目的，本申请提供了一种web攻击检测装置，包括：
构建模块，用于获取恶意访问连接，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型；
确定模块，用于当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；
匹配模块，用于将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果。
为实现上述目的，本申请提供了一种电子设备，包括：
存储器，用于存储计算机程序；
处理器，用于执行所述计算机程序时实现如上述web攻击检测方法的步骤。
为实现上述目的，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如上述web攻击检测方法的步骤。
通过以上方案可知，本申请提供的一种web攻击检测方法，包括：获取恶意访问连接，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型；当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果。
本申请提供的web攻击检测方法，通过分析恶意访问连接中各访问请求的上下文特征建立恶意访问模型，跟踪学习整个访问连接的行为，能够联合web攻击的多个弱特征，更好的理解攻击者的意图，恶意访问模型具有更高的准确性。当接收到目标访问请求时，将该目标访问请求对应的整个目标访问连接与恶意访问模型进行匹配，从而综合整个目标访问连接中的多个访问请求之间的上下文特征进行判定。与相关技术中仅对目标访问请求进行单个报文检测的方案相比，考虑到整个访问连接中各访问请求之间的上下文关系，可以在大幅提升web攻击检出率的同时，保证低误报率。 本申请还公开了一种web攻击检测装置及一种电子设备和一种计算机可读存储介质，同样能实现上述技术效果。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性的，并不能限制本申请。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。附图是用来提供对本公开的进一步理解，并且构成说明书的一部分，与下面的具体实施方式一起用于解释本公开，但并不构成对本公开的限制。在附图中：
图1为根据一示例性实施例示出的一种web攻击检测方法的流程图；
图2为根据一示例性实施例示出的另一种web攻击检测方法的流程图；
图3为根据一示例性实施例示出的又一种web攻击检测方法的流程图；
图4为根据一示例性实施例示出的一种web攻击检测装置的结构图；
图5为根据一示例性实施例示出的一种电子设备的结构图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
由于web攻击呈现强对抗的特点，攻击者可以尝试多次web攻击，不断改变web攻击手法。而当前的WAF则都是基于单个访问请求进行web 攻击检测拦截的，因此，存在只要有一个web攻击对应的请求没有拦截住，就会造成黑客入侵，防御比较被动，防御效果不好。因此，在本申请中，通过分析整个恶意访问连接中各访问请求的上下文特征建立恶意访问模型，当接收到目标访问请求时，将其对应的整个目标访问连接与恶意访问模型进行匹配，从而综合整个目标访问连接中的多个访问请求之间的上下文特征进行判定。由于引入了访问请求之间的上下文关系，提高了对web攻击的检测能力。
本申请实施例公开了一种web攻击检测方法，提高了对web攻击的检测能力。
参见图1，根据一示例性实施例示出的一种web攻击检测方法的流程图，如图1所示，包括：
S101：获取恶意访问连接，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型；
本实施例的执行主体可以为WAF设备，目的为对接收到的访问请求进行web攻击检测。在本步骤中，为了学习恶意的访问模式甚至是攻击者的web攻击手段，需要收集大量的黑客真实访问数据，即本步骤中的恶意访问连接。此处不对恶意访问连接的收集方式进行限定，例如可以通过WAF设备，记录恶意访问连接并上报至云端存储，又如可以设计蜜罐，一种对攻击方进行欺骗的技术，通过布置一些作为诱饵的主机、网络服务或者信息，诱使攻击方对它们实施攻击，从而可以对攻击行为进行捕获和分析，收集恶意访问连接。
可以理解的是，web应用很多都是面向连接、端到端和可靠的数据包发送，即事先为所发送的数据开辟出连接好的通道，然后再利用此通道发送数据。在一个通道内发送的所有访问请求组成一个访问连接。因此，本步骤中的恶意访问连接中包括多个访问请求，本实施例通过学习访问请求之间的上下文特征构建恶意访问模型。
web攻击具有明显的访问模式，例如黑客在进行WebShell后门通信时，经常会先利用shell命令检查当前的环境，然后利用脚本语言，如PHP语言执行任意代码，也有可能利用SQL发起数据库查询、修改操作等。因此 在访问连接上可以体现出一系列的可疑访问请求：命令注入、代码注入、SQL注入。如果可以学习到上述一连串的访问模式，即多个访问请求之间的上下文特征，WAF除了可以更准确地拦截恶意行为外，也能够更好地理解黑客的攻击行为。
因此在本实施例中，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型，该恶意访问模型可以体现攻击者的恶意访问模式，从而对接收到的访问连接进行web攻击检测。此处不对恶意访问模型的具体构建方式进行限定，例如将恶意访问连接的操作序列作为恶意访问模型，也可以利用神经网络模型学习访问请求之间的上下文关系，将训练完成的神经网络模型作为恶意访问模型，只要可以体现出恶意访问连接中各访问请求之间的上下文关系，即前后操作的关联均在本实施例的保护范围内。
S102：当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；
在本步骤中，当接收到客户端的目标访问请求时，确定其所述的目标访问连接。可以理解的是，若该目标访问请求所请求的web应用为基于连接的应用，则可以基于客户端与该应用之间建立的通道确定目标访问连接，即在该通道内传输的所有访问连接均属于目标访问连接。若该目标访问请求所请求的web应用不是基于连接的应用，则可以将预设时间窗口内接收到的访问请求与目标访问请求按照接收时间顺序组合为目标访问连接。
S103：将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果。
在本步骤中，将上一步骤确定的目标访问连接与恶意访问模型进行匹配，以分析目标访问连接中各访问请求的上下文关系，从而对当前接收到的目标访问连接进行web攻击检测。若匹配成功，则判定该目标访问请求为恶意访问请求，进行拦截，否则，判定该目标访问请求为正常访问请求，放行目标访问请求。可以理解的是，由于恶意访问模型可以表现为不同的形式，因此匹配方式和判定匹配成功的标准也有所不同，将在后续实施例进行详细介绍。
作为一种优选实施方式，在本步骤之后，还包括：当所述目标访问请 求为恶意访问请求时，拦截所述目标访问请求；确定所述目标访问请求对应的源IP地址，并封锁所述源IP地址。在具体实施中，由于本实施例采用基于连接的web攻击检测方法，综合分析了多个访问请求的上下文关系，因此具备更高的准确性。在一些防御强度要求较高的场景，对于置信度较高的可疑连接，可以采取更强有力的防护手段，比如直接封锁可疑的IP地址，增加攻击成本。
本申请实施例提供的web攻击检测方法，通过分析恶意访问连接中各访问请求的上下文特征建立恶意访问模型，跟踪学习整个访问连接的行为，能够联合web攻击的多个弱特征，更好的理解攻击者的意图，恶意访问模型具有更高的准确性。当接收到目标访问请求时，将该目标访问请求对应的整个目标访问连接与恶意访问模型进行匹配，从而综合整个目标访问连接中的多个访问请求之间的上下文特征进行判定。与相关技术中仅对目标访问请求进行单个报文检测的方案相比，考虑到整个访问连接中各访问请求之间的上下文关系，可以在大幅提升web攻击检出率的同时，保证低误报率。
本申请实施例公开了一种web攻击检测方法，相对于上一实施例，本实施例对技术方案作了进一步的说明和优化。具体的：
参见图2，根据一示例性实施例示出的另一种web攻击检测方法的流程图，如图2所示，包括：
S201：获取恶意访问连接，并识别所述恶意访问连接中每个访问请求的请求类型；
在本实施例中，将恶意访问连接对应的恶意操作序列作为恶意访问模型。具体的，WAF对恶意访问连接中的每个访问请求进行检测，得到的检测结果例如正常请求、恶意请求。对于恶意请求，WAF还会检测具体的攻击类型及威胁程度，攻击类型例如命令注入、代码注入、SQL注入等，威胁程度例如高、中、低等。不同的攻击类型和不同的威胁程度可以理解为不同的请求类型，即请求类型可以包括正常请求、高危的命令注入请求、低危的代码注入请求等。
S202：根据每个所述访问请求的请求类型构建所述恶意访问连接对应的恶意操作序列；
在本步骤中，基于上述请求类型将恶意访问连接中的每个访问请求映射到某个字符。例如，可以将正常请求映射成字符“B”。高危的命令注入映射成字符“C”，将中危的命令注入攻击映射成字符“D”等。因此，攻击者的某个恶意访问连接可以通过一个字符串如“BCD”进行表示，即恶意访问模型为恶意访问连接对应的恶意操作序列。
S203：当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；
S204：构建所述目标访问连接对应的目标操作序列，将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果。
在具体实施中，当接收到目标访问请求时，首先确定其所属的目标访问连接对应的目标操作序列，目标操作序列的构建方式与恶意操作序列的构建方式类似，已在步骤S202中进行详细介绍，在此不再赘述。将目标操作序列与恶意操作序列进行匹配可以得到目标访问连接与恶意访问连接的匹配程度，进而对当前接收到的目标访问连接进行检测。
本实施例不对具体的匹配方式进行限定，例如可以采用公共子串的方式，即将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果，包括：将所述目标操作序列与所述恶意操作序列进行匹配得到公共子串；当所述公共子串的长度大于第一预设值时，判定所述目标访问请求为恶意访问请求。在具体实施中，将目标操作序列与各恶意操作序列进行匹配，得到目标操作序列与每个恶意操作序列的公共子串，当某一个公共子串的长度大于第一预设值时，说明目标访问连接与某个恶意访问模式相近，判定当前接收到的目标访问请求为恶意访问请求，进行拦截。此处不对第一预设值进行具体限定，本领域技术人员可以根据实际需要的检测能力进行了灵活设置。
又如，可以采用计算字符串相似度的方式匹配目标操作序列与恶意操作序列，即将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果，包括：计算所述目标操作序列与所述恶意操作序 列的字符串相似度；当所述字符串相似度大于第二预设值时，判定所述目标访问请求为恶意访问请求。在具体实施中，计算目标操作序列与各恶意操作序列之间的字符串相似度，当某一个字符串相似度大于第二预设值时，说明目标访问连接与某个恶意访问模式相近，判定当前接收到的目标访问请求为恶意访问请求，进行拦截。此处同样不对第二预设值进行具体限定，本领域技术人员可以根据实际需要的检测能力进行了灵活设置。
由此可见，本实施例将恶意访问连接对应的恶意操作序列作为恶意访问模型，在进行目标访问请求的web攻击检测时，将其所属的目标访问连接对应的目标操作序列与恶意操作序列进行匹配，通过字符串的匹配对目标访问练级中各访问请求之间的上下文关系与恶意访问模式中的上下文关系进行匹配，效率较高，在提高对web攻击的检测能力的同时，提高了检测效率。
本申请实施例公开了一种web攻击检测方法，相对于第一个实施例，本实施例对技术方案作了进一步的说明和优化。具体的：
参见图3，根据一示例性实施例示出的又一种web攻击检测方法的流程图，如图3所示，包括：
S301：获取恶意访问连接，并对所述恶意访问连接中每个访问请求进行报文解析得到每个所述访问请求对应的所有字段；
S302：根据每个所述访问请求对应的所有字段构建每个所述访问请求对应的特征向量；
在本实施例中，利用神经网络模型学习访问请求之间的上下文关系，将训练完成的神经网络模型作为恶意访问模型。在具体实施中，首先对恶意访问连接中每个访问请求进行报文解析得到每个访问请求对应的所有字段，例如可以包括URL，头部字段及body等。基于报文解析结果构建每个访问请求对应的特征向量，即将所有字段组合为特征向量。
此处不对构建特征向量的具体方式进行限定，例如可以使用ASCII表，即所述根据每个所述访问请求对应的所有字段构建每个所述访问请求对应的特征向量，包括：将每个所述访问请求对应的每个字段映射为ASCII码 字符串，并根据映射结果构建每个所述访问请求对应的特征向量；其中，每个所述ASCII码字符串的长度相同。在具体实施中，对于字段中的每个字符，将其映射到相应的ASCII码字符，组成ASCII码字符串。如果存在不在ASCII表中的字符，如中文字符，则直接舍弃。访问请求中的各字段对应的ASCII码字符串可以组合为该访问请求对应的特征向量。优选的，还可以对特征向量的长度进行设定，超过预设长度则直接截断，不足可以进行补0操作。
S303：利用所有所述访问请求的特征向量训练神经网络模型；
在本步骤中，对恶意访问连接中每个访问请求标记状态值，此处的状态值可以理解为上一实施例介绍的每个访问请求的请求类型，也可以按照其他标准对神经网络模型的输出状态进行设定，在此不进行具体限定。将恶意访问连接中每个访问请求的特征向量和状态值按请求的时间顺序输出神经网络模型中，以训练神经网络模型。神经网络模型可以通过访问请求的特征向量学习到恶意访问连接中访问请求的上下文关系，即恶意访问模式。此处不对神经网络模型的具体类型进行限定，例如可以为RNN(中文全称：循环神经网络，英文全称：Recurrent Neural Network)、LSTM(中文全称：长短期记忆网络，英文全称：Long Short-Term Memory)、GRU(Gated Recurrent Unit)等。
S304：当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；
S305：将所述目标访问连接中每个访问请求对应的特征向量输入训练完成的神经网络模型中得到所述目标访问请求的检测结果。
在具体实施中，当接收到目标访问请求时，首先提取其所属的目标访问连接中每个访问连接的特征向量，具体的提取方式已在上述详细介绍，在此不再赘述。将特征向量依次输入训练完成的神经网络模型中，可以得到每个访问请求对应的预测结果。由于神经网络模型的特点，上一个访问请求的预测结果会作为本次预测的输入，即在对当前的访问请求进行预测时，会使用到上一个访问请求的预测结果和当前访问请求的特征向量，因此神经网络模型可以利用访问请求之间的上下文关系进行预测。
具体的，本步骤可以包括：将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中，得到所述目标访问连接中每个访问请求对应的预测向量；其中，所述预测向量中的第i个元素为所述访问请求为所述神经网络模型定义的第i个输出状态的概率；基于所述目标访问请求对应的预测向量计算所述目标访问请求对应的预测值；当所述预测值大于第三预测值时，判定所述目标访问请求为恶意访问请求。此处的预测向量即表示每个访问请求对应的预测结果的向量，第t个访问请求的预测向量可以表示为
Figure PCTCN2021070243-appb-000001
其中，
Figure PCTCN2021070243-appb-000002
表示该访问请求为神经网络模型定义的第i个输出状态的概率，1≤i≤N，N为输出状态的总数。在具体实施中，使用神经网络模型的最后一个输出的预测向量，即目标访问请求对应的预测向量得到预测值，当预测值大于第三预测值时，说明目标访问连接与某个恶意访问模式相近，判定当前接收到的目标访问请求为恶意访问请求，进行拦截。此处同样不对第三预设值进行具体限定，本领域技术人员可以根据实际需要的检测能力进行了灵活设置。
作为一种优选实施方式，可以将目标访问请求对应的预测向量与目标向量的乘积作为目标访问请求对应的预测值，即o＝softmax(Vy T)，V为目标向量，y T为目标访问请求对应的预测向量，softmax()函数对最终输出的预测值进行归一化处理，第三预测值设置为0至1之间的某个值，如0.5。可以理解的是，预测向量为1×N的向量，则V为N×1的向量，其中的第i个元素可以理解为神经网络模型定义的第i个输出状态的权重，目标向量在神经网络模型的训练过程中进行优化目标向量。
由此可见，本实施例将训练完成的神经网络模型作为恶意访问模型，在进行目标访问请求的web攻击检测时，将其所属的目标访问连接中每个访问请求的特征向量输入训练完成的神经网络模型中，得到当前接收到的目标访问请求的检查结果。由于神经网络模型的学习能力较强，检测准确率较高，且泛化能力较强，能够一定程度上应对未知威胁。
下面对本申请实施例提供的一种web攻击检测装置进行介绍，下文描述的一种web攻击检测装置与上文描述的一种web攻击检测方法可以相互 参照。
参见图4，根据一示例性实施例示出的一种web攻击检测装置的结构图，如图4所示，包括：
构建模块401，用于获取恶意访问连接，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型；
确定模块402，用于当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；
匹配模块403，用于将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果。
本申请实施例提供的web攻击检测装置，通过分析恶意访问连接中各访问请求的上下文特征建立恶意访问模型，跟踪学习整个访问连接的行为，能够联合web攻击的多个弱特征，更好的理解攻击者的意图，恶意访问模型具有更高的准确性。当接收到目标访问请求时，将该目标访问请求对应的整个目标访问连接与恶意访问模型进行匹配，从而综合整个目标访问连接中的多个访问请求之间的上下文特征进行判定。与相关技术中仅对目标访问请求进行单个报文检测的方案相比，考虑到整个访问连接中各访问请求之间的上下文关系，可以在大幅提升web攻击检出率的同时，保证低误报率。
在上述实施例的基础上，作为一种优选实施方式，所述构建模块401包括：
获取单元，用于获取恶意访问连接；
识别单元，用于识别所述恶意访问连接中每个访问请求的请求类型；
第一构建单元，用于根据每个所述访问请求的请求类型构建所述恶意访问连接对应的恶意操作序列，确定所述恶意访问模型为所述恶意操作序列；
相应的，所述匹配模块403具体为构建所述目标访问连接对应的目标操作序列，将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果的模块。
在上述实施例的基础上，作为一种优选实施方式，所述匹配模块403包括：
第一匹配单元，用于将所述目标操作序列与所述恶意操作序列进行匹配得到公共子串；
第一判定单元，用于当所述公共子串的长度大于第一预设值时，判定所述目标访问请求为恶意访问请求。
在上述实施例的基础上，作为一种优选实施方式，所述匹配模块403包括：
第一计算单元，用于计算所述目标操作序列与所述恶意操作序列的字符串相似度；
第二判定单元，用于当所述字符串相似度大于第二预设值时，判定所述目标访问请求为恶意访问请求。
在上述实施例的基础上，作为一种优选实施方式，所述构建模块401包括：
获取单元，用于获取恶意访问连接；
解析单元，用于对所述恶意访问连接中每个访问请求进行报文解析得到每个所述访问请求对应的所有字段；
第二构建单元，用于根据每个所述访问请求对应的所有字段构建每个所述访问请求对应的特征向量；
训练单元，用于利用所有所述访问请求的特征向量训练神经网络模型，并确定所述恶意访问模型为训练完成的神经网络模型。
相应的，所述匹配模块403具体为将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中得到所述目标访问请求的检测结果的模块。
在上述实施例的基础上，作为一种优选实施方式，所述第二构建单元具体为将每个所述访问请求对应的每个字段映射为ASCII码字符串，并根据映射结果构建每个所述访问请求对应的特征向量的单元；其中，每个所述ASCII码字符串的长度相同。
在上述实施例的基础上，作为一种优选实施方式，所述匹配模块403 包括：
输入单元，用于将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中，得到所述目标访问连接中每个访问请求对应的预测向量；其中，所述预测向量中的第i个元素为所述访问请求为所述神经网络模型定义的第i个输出状态的概率；
第二计算单元，用于基于所述目标访问请求对应的预测向量计算所述目标访问请求对应的预测值；
第三判定单元，用于当所述预测值大于第三预测值时，判定所述目标访问请求为恶意访问请求。
在上述实施例的基础上，作为一种优选实施方式，所述训练单元具体为利用所有所述访问请求的特征向量训练神经网络模型，在训练过程中优化目标向量，并确定所述恶意访问模型为训练完成的神经网络模型的单元；其中，所述目标向量中的第i个元素为所述第i个输出状态的权重；
相应的，所述第二计算单元具体为将所述目标访问请求对应的预测向量与目标向量的乘积作为所述目标访问请求对应的预测值的单元。
在上述实施例的基础上，作为一种优选实施方式，还包括：
拦截模块，用于当所述目标访问请求为恶意访问请求时，拦截所述目标访问请求；
封锁模块，用于确定所述目标访问请求对应的源IP地址，并封锁所述源IP地址。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
本申请还提供了一种电子设备，参见图5，本申请实施例提供的一种电子设备500的结构图，如图5所示，可以包括处理器11和存储器12。该电子设备500还可以包括多媒体组件13，输入/输出(I/O)接口14，以及通信组件15中的一者或多者。
其中，处理器11用于控制该电子设备500的整体操作，以完成上述的web攻击检测方法中的全部或部分步骤。存储器12用于存储各种类型的数 据以支持在该电子设备500的操作，这些数据例如可以包括用于在该电子设备500上操作的任何应用程序或方法的指令，以及应用程序相关的数据，例如联系人数据、收发的消息、图片、音频、视频等等。该存储器12可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，例如静态随机存取存储器(Static Random Access Memory，简称SRAM)，电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，简称EEPROM)，可擦除可编程只读存储器(Erasable Programmable Read-Only Memory，简称EPROM)，可编程只读存储器(Programmable Read-Only Memory，简称PROM)，只读存储器(Read-Only Memory，简称ROM)，磁存储器，快闪存储器，磁盘或光盘。多媒体组件13可以包括屏幕和音频组件。其中屏幕例如可以是触摸屏，音频组件用于输出和/或输入音频信号。例如，音频组件可以包括一个麦克风，麦克风用于接收外部音频信号。所接收的音频信号可以被进一步存储在存储器12或通过通信组件15发送。音频组件还包括至少一个扬声器，用于输出音频信号。I/O接口14为处理器11和其他接口模块之间提供接口，上述其他接口模块可以是键盘，鼠标，按钮等。这些按钮可以是虚拟按钮或者实体按钮。通信组件15用于该电子设备500与其他设备之间进行有线或无线通信。无线通信，例如Wi-Fi，蓝牙，近场通信(Near Field Communication，简称NFC)，2G、3G或4G，或它们中的一种或几种的组合，因此相应的该通信组件15可以包括：Wi-Fi模块，蓝牙模块，NFC模块。
在一示例性实施例中，电子设备500可以被一个或多个应用专用集成电路(Application Specific Integrated Circuit，简称ASIC)、数字信号处理器(Digital Signal Processor，简称DSP)、数字信号处理设备(Digital Signal Processing Device，简称DSPD)、可编程逻辑器件(Programmable Logic Device，简称PLD)、现场可编程门阵列(Field Programmable Gate Array，简称FPGA)、控制器、微控制器、微处理器或其他电子元件实现，用于执行上述的web攻击检测方法。
在另一示例性实施例中，还提供了一种包括程序指令的计算机可读存储介质，该程序指令被处理器执行时实现上述web攻击检测方法的步骤。 例如，该计算机可读存储介质可以为上述包括程序指令的存储器12，上述程序指令可由电子设备500的处理器11执行以完成上述的web攻击检测方法。
说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似部分互相参见即可。对于实施例公开的装置而言，由于其与实施例公开的方法相对应，所以描述的比较简单，相关之处参见方法部分说明即可。应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下，还可以对本申请进行若干改进和修饰，这些改进和修饰也落入本申请权利要求的保护范围内。
还需要说明的是，在本说明书中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。

Claims (12)

  1. 一种web攻击检测方法，其特征在于，包括：
    获取恶意访问连接，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型；
    当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；
    将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果。
  2. 根据权利要求1所述web攻击检测方法，其特征在于，所述基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型，包括：
    识别所述恶意访问连接中每个访问请求的请求类型；
    根据每个所述访问请求的请求类型构建所述恶意访问连接对应的恶意操作序列；
    确定所述恶意访问模型为所述恶意操作序列；
    相应的，将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果，包括：
    构建所述目标访问连接对应的目标操作序列，将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果。
  3. 根据权利要求2所述web攻击检测方法，其特征在于，将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果，包括：
    将所述目标操作序列与所述恶意操作序列进行匹配得到公共子串；
    当所述公共子串的长度大于第一预设值时，判定所述目标访问请求为恶意访问请求。
  4. 根据权利要求2所述web攻击检测方法，其特征在于，将所述目标操作序列与所述恶意操作序列进行匹配得到所述目标访问请求的检测结果，包括：
    计算所述目标操作序列与所述恶意操作序列的字符串相似度；
    当所述字符串相似度大于第二预设值时，判定所述目标访问请求为恶 意访问请求。
  5. 根据权利要求1所述web攻击检测方法，其特征在于，所述基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型，包括：
    对所述恶意访问连接中每个访问请求进行报文解析得到每个所述访问请求对应的所有字段；
    根据每个所述访问请求对应的所有字段构建每个所述访问请求对应的特征向量；
    利用所有所述访问请求的特征向量训练神经网络模型，并确定所述恶意访问模型为训练完成的神经网络模型；
    相应的，将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果，包括：
    将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中得到所述目标访问请求的检测结果。
  6. 根据权利要求5所述web攻击检测方法，其特征在于，所述根据每个所述访问请求对应的所有字段构建每个所述访问请求对应的特征向量，包括：
    将每个所述访问请求对应的每个字段映射为ASCII码字符串，并根据映射结果构建每个所述访问请求对应的特征向量；其中，每个所述ASCII码字符串的长度相同。
  7. 根据权利要求5所述web攻击检测方法，其特征在于，将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中得到所述目标访问请求的检测结果，包括：
    将所述目标访问连接中每个访问请求对应的特征向量输入所述训练完成的神经网络模型中，得到所述目标访问连接中每个访问请求对应的预测向量；其中，所述预测向量中的第i个元素为所述访问请求为所述神经网络模型定义的第i个输出状态的概率；
    基于所述目标访问请求对应的最后一个输出的预测向量计算所述目标访问请求对应的预测值，其中，所述神经网络模型前次输出的预测向量会和本次的访问请求一起作为输入；
    当所述预测值大于第三预测值时，判定所述目标访问请求为恶意访问请求。
  8. 根据权利要求7所述web攻击检测方法，其特征在于，所述利用所有所述访问请求的特征向量训练神经网络模型，包括：
    利用所有所述访问请求的特征向量训练神经网络模型，在训练过程中优化目标向量；其中，所述目标向量中的第i个元素为所述第i个输出状态的权重；
    相应的，所述基于所述目标访问请求对应的预测向量计算所述目标访问请求对应的预测值，包括：
    将所述目标访问请求对应的预测向量与目标向量的乘积作为所述目标访问请求对应的预测值。
  9. 根据权利要求1至8中任一项所述web攻击检测方法，其特征在于，所述基于匹配结果得到所述目标访问请求的检测结果之后，还包括：
    当所述目标访问请求为恶意访问请求时，拦截所述目标访问请求；
    确定所述目标访问请求对应的源IP地址，并封锁所述源IP地址。
  10. 一种web攻击检测装置，其特征在于，包括：
    构建模块，用于获取恶意访问连接，基于所述恶意访问连接中访问请求的上下文特征构建恶意访问模型；
    确定模块，用于当接收到目标访问请求时，确定所述目标访问请求所属的目标访问连接；
    匹配模块，用于将所述目标访问连接与所述恶意访问模型进行匹配，并基于匹配结果得到所述目标访问请求的检测结果。
  11. 一种电子设备，其特征在于，包括：
    存储器，用于存储计算机程序；
    处理器，用于执行所述计算机程序时实现如权利要求1至9任一项所述web攻击检测方法的步骤。
  12. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1至9任一项所述web攻击检测方法的步骤。
PCT/CN2021/070243 2020-01-07 2021-01-05 一种web攻击检测方法、装置及电子设备和存储介质 WO2021139641A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010014713.9A CN113158182A (zh) 2020-01-07 2020-01-07 一种web攻击检测方法、装置及电子设备和存储介质
CN202010014713.9 2020-01-07

Publications (1)

Publication Number Publication Date
WO2021139641A1 true WO2021139641A1 (zh) 2021-07-15

Family

ID=76787448

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/070243 WO2021139641A1 (zh) 2020-01-07 2021-01-05 一种web攻击检测方法、装置及电子设备和存储介质

Country Status (2)

Country Link
CN (1) CN113158182A (zh)
WO (1) WO2021139641A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113949528A (zh) * 2021-09-09 2022-01-18 中云网安科技有限公司 基于流量数据的访问控制方法、装置、存储介质及设备
CN113987496A (zh) * 2021-11-04 2022-01-28 北京天融信网络安全技术有限公司 恶意攻击检测的方法、装置、电子设备及可读存储介质
CN114021124A (zh) * 2021-11-04 2022-02-08 北京香侬慧语科技有限责任公司 一种自然语言生成及攻击检测方法、介质、装置及设备
CN114553550A (zh) * 2022-02-24 2022-05-27 京东科技信息技术有限公司 请求检测方法、装置、存储介质及电子设备
CN115695054A (zh) * 2023-01-04 2023-02-03 北京知其安科技有限公司 基于机器学习的waf拦截页面识别的方法、装置及相关组件
CN115883160A (zh) * 2022-11-25 2023-03-31 国网山东省电力公司信息通信公司 一种基于深度学习的恶意程序攻击识别方法、系统及终端
CN116962089A (zh) * 2023-09-21 2023-10-27 厦门晨晟昱科技有限公司 一种针对信息安全的网络监测方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100199345A1 (en) * 2009-02-04 2010-08-05 Breach Security, Inc. Method and System for Providing Remote Protection of Web Servers
CN107577945A (zh) * 2017-09-28 2018-01-12 阿里巴巴集团控股有限公司 Url攻击检测方法、装置以及电子设备
CN108111489A (zh) * 2017-12-07 2018-06-01 阿里巴巴集团控股有限公司 Url攻击检测方法、装置以及电子设备
CN109951500A (zh) * 2019-04-29 2019-06-28 宜人恒业科技发展（北京）有限公司 网络攻击检测方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108259494B (zh) * 2018-01-17 2020-10-02 北京邮电大学 一种网络攻击检测方法及装置
CN108616498A (zh) * 2018-02-24 2018-10-02 国家计算机网络与信息安全管理中心 一种web访问异常检测方法和装置
CN110351299B (zh) * 2019-07-25 2022-04-22 新华三信息安全技术有限公司 一种网络连接检测方法和装置
CN110650142B (zh) * 2019-09-25 2022-05-24 腾讯科技（深圳）有限公司 访问请求处理方法、装置、系统、存储介质和计算机设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100199345A1 (en) * 2009-02-04 2010-08-05 Breach Security, Inc. Method and System for Providing Remote Protection of Web Servers
CN107577945A (zh) * 2017-09-28 2018-01-12 阿里巴巴集团控股有限公司 Url攻击检测方法、装置以及电子设备
CN108111489A (zh) * 2017-12-07 2018-06-01 阿里巴巴集团控股有限公司 Url攻击检测方法、装置以及电子设备
CN109951500A (zh) * 2019-04-29 2019-06-28 宜人恒业科技发展（北京）有限公司 网络攻击检测方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
WANG SHUWEI: "Research on Name Entity Recognition And Relation Extraction in Financial Text", CHINESE MASTER'S THESES FULL-TEXT DATABASE, 1 December 2014 (2014-12-01), pages 1 - 69, XP055827805, ISSN: 1674-0246 *

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113949528A (zh) * 2021-09-09 2022-01-18 中云网安科技有限公司 基于流量数据的访问控制方法、装置、存储介质及设备
CN113987496A (zh) * 2021-11-04 2022-01-28 北京天融信网络安全技术有限公司 恶意攻击检测的方法、装置、电子设备及可读存储介质
CN114021124A (zh) * 2021-11-04 2022-02-08 北京香侬慧语科技有限责任公司 一种自然语言生成及攻击检测方法、介质、装置及设备
CN114553550A (zh) * 2022-02-24 2022-05-27 京东科技信息技术有限公司 请求检测方法、装置、存储介质及电子设备
CN114553550B (zh) * 2022-02-24 2024-02-02 京东科技信息技术有限公司 请求检测方法、装置、存储介质及电子设备
CN115883160A (zh) * 2022-11-25 2023-03-31 国网山东省电力公司信息通信公司 一种基于深度学习的恶意程序攻击识别方法、系统及终端
CN115695054A (zh) * 2023-01-04 2023-02-03 北京知其安科技有限公司 基于机器学习的waf拦截页面识别的方法、装置及相关组件
CN115695054B (zh) * 2023-01-04 2023-03-21 北京知其安科技有限公司 基于机器学习的waf拦截页面识别的方法、装置及相关组件
CN116962089A (zh) * 2023-09-21 2023-10-27 厦门晨晟昱科技有限公司 一种针对信息安全的网络监测方法及系统
CN116962089B (zh) * 2023-09-21 2023-12-05 厦门晨晟昱科技有限公司 一种针对信息安全的网络监测方法及系统

Also Published As

Publication number Publication date
CN113158182A (zh) 2021-07-23

Similar Documents

Publication Publication Date Title
WO2021139641A1 (zh) 一种web攻击检测方法、装置及电子设备和存储介质
Shurman et al. DoS and DDoS attack detection using deep learning and IDS
Koroniotis et al. Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset
US11399288B2 (en) Method for HTTP-based access point fingerprint and classification using machine learning
US9294501B2 (en) Fuzzy hash of behavioral results
US20160366169A1 (en) Systems, methods, and media for detecting network anomalies
CN109194684B (zh) 一种模拟拒绝服务攻击的方法、装置及计算设备
CN111224941B (zh) 一种威胁类型识别方法及装置
CA2545916A1 (en) Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data
CN113079150B (zh) 一种电力终端设备入侵检测方法
CN111526136A (zh) 基于云waf的恶意攻击检测方法、系统、设备和介质
US11977626B2 (en) Securing machine learning models against adversarial samples through backdoor misclassification
Fallah et al. Android malware detection using network traffic based on sequential deep learning models
CN113438225B (zh) 一种车载终端漏洞检测方法、系统、设备及存储介质
CN113645234A (zh) 基于蜜罐的网络防御方法、系统、介质及装置
CN112507336A (zh) 基于代码特征和流量行为的服务端恶意程序检测方法
Farid et al. Adaptive network intrusion detection learning: attribute selection and classification
CN113596001A (zh) DDoS攻击检测方法、装置、设备及计算机程序产品
Bai et al. N‐Gram, Semantic‐Based Neural Network for Mobile Malware Network Traffic Detection
Bala et al. AI techniques for IoT-based DDoS attack detection: Taxonomies, comprehensive review and research challenges
CN111859374A (zh) 社会工程学攻击事件的检测方法、装置以及系统
El Attar et al. A Gaussian mixture model for dynamic detection of abnormal behavior in smartphone applications
CN111131309A (zh) 分布式拒绝服务检测方法、装置及模型创建方法、装置
Moure-Garrido et al. Real time detection of malicious DoH traffic using statistical analysis
CN112583827A (zh) 一种数据泄露检测方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21738744

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21738744

Country of ref document: EP

Kind code of ref document: A1