Research On Parameter Injection Attack Detection Method Based On Machine Learning

Network attack behavior detection plays an important role in the network defense system.When the security protection network is broken,whether the attack behavior can detect the attack behavior is the premise of the response and blocking of the attack behavior.Therefore,how to improve the accuracy and response time of the attack behavior detection is an important indicator to measure the attack detection model.As the main way of information service in the Internet,Web services are rapidly updated with the increase of security issues.How to quickly and accurately detect web attack behavior is an important issue facing current network security research.In this paper,the current Web attack detection technology relies too much on the feature database and high false positives.Based on the characteristics of Web attack,this paper proposes a method based on hidden Markov machine learning to establish a Web attack detection model.Tests show that the proposed method has a greater degree of improvement in the recognition speed and recognition accuracy of the attack behavior than the current mainstream methods.The main work of this paper is:(1)Establish a data set and collect normal access requests and attack behavior requests in the web application.A model based on normal access sequence was selected to select 18000 normal access sequences.20,000 malicious attack samples,2500 cross-site attack samples,and 500 SQL injections were selected as training sample sets.(2)Establish a hidden Markov machine learning framework,and use the data set to train the framework to obtain the Web attack detection model.(3)The model is tested.The test shows that the Hidden Markov Model is used to detect the network attack behavior.The detection rate of the abnormal attack access based on the normal access sample set model is 97%.The detection rate of abnormal attack access establishment model by abnormal access sample set is 98%.In the generalized detection capability test of the model,the recognition rate of the detection model based on the normal access samples and the recognition rate of the detection model based on the attack samples were tested.