Research On Classification Method Of Server Behavior Based On Multidimensional Data

In recent years,the World Wide Web has flourished in China,bringing about changes in people's lives.However,the openness of the World Wide Web itself has brought about a series of security problems.The outbreak of facebook user information in 2018 has made people more aware of the importance of network security.According to a report by security company Fireye,Web intrusion is the most common form of attack on the network,and site scanning and backdoors are the most common of all security threats.Performing access behavior detection on different types of servers,and timely detecting web intrusion behaviors such as website scanning and website backdoors can maintain server security and reduce losses.The main research content of this thesis is to establish a detailed user behavior model for different types of websites through website classification.The behavioral model is used to classify the user behavior,and the refined behavior category is obtained,thereby detecting abnormal behavior.For the classification of websites,this thesis summarizes three types of websites,consulting information,resource downloading and information interaction for the characteristics of mainstream Internet applications.According to the characteristics of each type of website: users of information websites have high degree of dispersion and high frequency;users of resource websites have low frequency of visits and fewer visits;users of interactive websites submit more actions.This thesis extracts features from three dimensions: HTTP message content,user attribution and website access information.According to the characteristics of large amount of actual data and no mark,the Tritraing algorithm in semi-supervised learning is used to train the model,and a better classification effect is obtained.According to the user behavior classification of the website,because the user's access behavior to the World Wide Web website is the HTTP access behavior of the user to the website,this thesis analyzes the HTTP message to analyze the user behavior.This article divides user behavior into two broad categories,normal user behavior and abnormal user behavior.For abnormal user behavior,this article summarizes the characteristics of a typical Webshell and scanner,and summarizes the characteristics different from normal users.Considering the classification performance problem of the algorithm,using the xgboost algorithm for model training,a higher correct rate and a lower false positive rate are obtained.Finally,based on the classification of the website,a refined user behavior model is established and compared with the unified user behavior model to prove its effectiveness.For the Web intrusion detection scheme,the user classification method is first used to classify users,and then the corresponding user behavior model is established for each website user,and the behavior of the network traffic is refined using a detailed user behavior model.And finally a specific behavior category is got,achieving the purpose of Web intrusion detection.