CN109561084A - URL parameter rejecting outliers method based on LSTM autoencoder network - Google Patents
URL parameter rejecting outliers method based on LSTM autoencoder network Download PDFInfo
- Publication number
- CN109561084A CN109561084A CN201811384973.4A CN201811384973A CN109561084A CN 109561084 A CN109561084 A CN 109561084A CN 201811384973 A CN201811384973 A CN 201811384973A CN 109561084 A CN109561084 A CN 109561084A
- Authority
- CN
- China
- Prior art keywords
- lstm
- data
- network
- input
- moment
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/044—Recurrent networks, e.g. Hopfield networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Biophysics (AREA)
- Biomedical Technology (AREA)
- Artificial Intelligence (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
The URL parameter rejecting outliers method based on LSTM autoencoder network that the invention discloses a kind of, the present invention serializes URL parameter, utilize advantage of the LSTM in terms of time series expression, LSTM is established from encoding model, it is decoded output again after encoding to input data, input is set with output loss reduction as optimization aim, network weight is constantly updated by optimization algorithm, finally obtain network model and loss range, loss threshold value T is set according to loss range, data by loss greater than threshold value T are identified as attack data, this method can consider the context relation of data when analyzing data, there is stronger model tormulation ability, preferable effect is reached to the detection of malice URL, improve the accuracy rate of URL parameter attack recognition, reduction is failed to report, wrong report.
Description
Technical field
The present invention relates to Web security technology area more particularly to a kind of URL parameter based on LSTM autoencoder network are abnormal
Value detection method.
Background technique
In recent years, the problem of network security gradually attracts people's attention, and even more becomes National Security Strategy level.People
Increasingly severeer network security problem is faced, wherein the quantity of Web attack rises year by year, and according to statistics, current 75%
Attack is transferred to application layer, and attacker can be caused by being embedded in executable code or injection malicious code in URL
The various Web attacks such as SQL, XSS, information leakage, order execution.Malice URL in order to reduce be detected may be using each
Kind means hide oneself.The sorting algorithm of machine learning has certain effect in URL context of detection, but for many and website
Correct URL has the malice URL of higher similarity, can not accurate detection come out.
Summary of the invention
The URL parameter rejecting outliers method based on LSTM autoencoder network that the purpose of the present invention is to provide a kind of is used
To solve problem above.
Above-mentioned purpose of the invention has the technical scheme that
A kind of URL parameter rejecting outliers method based on LSTM autoencoder network comprising the steps of:
S1, the address URL is handled by urllib module the address URL is handled, including escape, decoded, mention
Take URL parameter；
S2, the URL parameter data of extraction are constructed with vocabulary, includes all characters occurred in vocabulary, it is marked one by one
Number, obtain vocabulary；
S3, according to vocabulary to URL parameter data encoding, be converted into sequence data and intercept uniform length；
S4, data are mapped as by embeded matrix by the insertion of Embedding word；
S5, LSTM autoencoder network is built, obtains network model；
S6, the loss for calculating all training datas, take max value of error as threshold value T；
S7, test network modelling effect, using be mixed with attack data URL tested, repeat step S2, S3, S4,
S5 is identified as attack data when obtaining contaminated product attack data degradation value greater than threshold value T, when penalty values are less than or equal to threshold value T,
It is identified as normal data.
Further, in the step S5, the key of LSTM is that location mode, location mode are run from the beginning to the end, passes through
The structure of door to increase location mode or delete information, including forgets door, input gate, out gate, location mode, leads to respectively
It crosses following formula and calculates acquisition:
Forget door: ft=σ (Wf·[ht-1, x] and+bf) (1)
Input gate: it=σ (Wi·[ht-1, xt]+bi) (2)
State door: candidate state amount
More new state:
Out gate: ot=σ (Wo[ht-1, xt]+bo) (5)
ht=ot·tanh(Ct) (6)
W is corresponding weight in formula, and b is amount of bias, xtFor present input data, ht-1For the output valve of eve, σ is
Sigmoid function, calculation formula areTanh is hyperbolic tangent function, and calculation formula is
When t moment input time sequence XtWith the hidden variable h at t-1 momentt-1, firstly, forgeing
Pupil is at ft, see formula (1) which kind of information abandoned in determining means, then, generate i in input gatet, see formula (2), determine to deposit
Which kind of information is stored up, candidate vector is then createdFormula (3) are seen, according in t-1 moment state door Ct-1Update t moment quantity of state
Ct, formula (4) are seen, finally, generating o in out gatet, see formula (5), and in quantity of state CtWith quantity of state otUnder the action of, it generates
The hidden variable h of t momentt, see formula (6), and then influence the variation of t+1 moment LSTM unit, autoencoder network is a kind of nothing
The output of supervised learning algorithm, including encoder, decoder, encoder is the input of decoder, using back-propagation algorithm, is allowed
Target value is equal to input value, and LSTM autoencoder network includes encoder, decoder, loss function and optimizer, encoder and solution
Code device is that LSTM is built, and the output of encoder is the input of decoder, can be by go-between at as hidden layer, loss function
The error for calculating output with input carries out backpropagation using loss reduction as optimization aim, and optimizing application function constantly updates net
Network weight, it is assumed that time series X={ x1, x2... xn, wherein n is data length, and corresponding theoretical output isAs the data x of moment ttInput autoencoder network, xtFor sequence X t moment value, wherein 1 < < t
< < n, obtained output can be expressed as yt=LSTMforward(xt, ct-1, ht-1), wherein LSTMforwardIndicate above-mentioned LSTM
The calculation method of propagated forward location mode, the output of the autoencoder network of sequence X are Yt=LSTMforward(xt, ct-1, ht-1)
={ y1, y2... yn, the error of input with output is next calculated, selects mean square error as error calculation formula, trained
The loss function of journey is defined asThe minimum optimization aim of loss function is set, network is given
Random seed number, learning rate and the frequency of training of initialization constantly update network weight using Adam optimization algorithm, wait lose
After convergence, final network model is obtained.
In conclusion the invention has the following advantages:
(1) long memory unit (Long Short-term Memory, abbreviation LSTM) in short-term, is a kind of time recurrent neural
Network has preferable effect to processing time series data, the context relation between data can be fully taken into account, in natural language
Processing etc. has many successful applications, and autoencoder network is the network that a kind of desired output is equal to input, is exceptional value inspection
Common method is surveyed, therefore, the present invention is improved using LSTM building autoencoder network for detecting URL parameter exceptional value
The recognition accuracy of URL attack, reduction are failed to report, are reported by mistake.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
Some embodiments of invention for those of ordinary skill in the art without creative efforts, can be with
It obtains other drawings based on these drawings.
Fig. 1 is the LSTM cellular construction figure of the embodiment of the present invention；
Fig. 2 is the flow diagram of the embodiment of the present invention；
Fig. 3 is that the LSTM of the embodiment of the present invention encodes structural schematic diagram certainly.
Specific embodiment
In the following detailed description, many details are proposed, in order to complete understanding of the present invention.But
It will be apparent to those skilled in the art that the present invention can not need some details in these details
In the case of implement.Below to the description of embodiment just for the sake of provided by showing example of the invention to it is of the invention more
Understand well.
Below in conjunction with attached drawing, the technical solution of the embodiment of the present invention is described.
Embodiment:
As shown in Figure 1, a kind of URL parameter rejecting outliers method based on LSTM autoencoder network comprising the steps of:
S1, the address URL is handled by urllib module the address URL is handled, including escape, decoded, mention
Take URL parameter；
S2, the URL parameter data of extraction are constructed with vocabulary, includes all characters occurred in vocabulary, it is marked one by one
Number, obtain vocabulary；
S3, according to vocabulary to URL parameter data encoding, be converted into sequence data and intercept uniform length；
S4, data are mapped as by embeded matrix by the insertion of Embedding word；
S5, LSTM autoencoder network is built, obtains network model；
S6, the loss for calculating all training datas, take max value of error as threshold value T；
S7, test network modelling effect, using be mixed with attack data URL tested, repeat step S2, S3, S4,
S5 is identified as attack data when obtaining contaminated product attack data degradation value greater than threshold value T, when penalty values are less than or equal to threshold value T,
It is identified as normal data.
As shown in Fig. 2, in step s 5, the key of LSTM is that location mode, location mode are run from the beginning to the end, pass through
The structure of door to increase location mode or delete information, including forgets door, input gate, out gate, location mode, leads to respectively
It crosses following formula and calculates acquisition:
Forget door: ft=σ (Wf·[ht-1, x] and+bf) (1)
Input gate: it=σ (Wi·[ht-1, xt]+bi) (2)
State door: candidate state amount
More new state:
Out gate: ot=σ (Wo[ht-1, xt]+bo) (5)
ht=ot·tanh(Ct) (6)
W is corresponding weight in formula, and b is amount of bias, xtFor present input data, ht-1For the output valve of eve, σ is
Sigmoid function, calculation formula areTanh is hyperbolic tangent function, and calculation formula isWhen
T moment input time sequence XtWith the hidden variable h at t-1 momentt-1, firstly, forgeing pupil into ft, see formula (1), determine single
Which kind of information is abandoned in member, then, generates i in input gatet, see formula (2), determine which kind of information stored, then creation is candidate
VectorFormula (3) are seen, according in t-1 moment state door Ct-1Update t moment quantity of state Ct, formula (4) are seen, finally, exporting
Pupil is at ot, see formula (5), and in quantity of state CtWith quantity of state otUnder the action of, generate the hidden variable h of t momentt, see formula
(6), and then the variation of t+1 moment LSTM unit being influenced, autoencoder network is a kind of unsupervised learning algorithm, including encoder,
The output of decoder, encoder is the input of decoder, using back-propagation algorithm, target value is allowed to be equal to input value.
As shown in figure 3, LSTM autoencoder network includes encoder, decoder, loss function and optimizer, encoder and solution
Code device is that LSTM is built, and the output of encoder is the input of decoder, can be by go-between at as hidden layer, loss function
The error for calculating output with input carries out backpropagation using loss reduction as optimization aim, and optimizing application function constantly updates net
Network weight, it is assumed that time series X={ x1, x2... xn, wherein n is data length, and corresponding theoretical output isAs the data x of moment ttInput autoencoder network, xtFor sequence X t moment value, wherein 1 < < t
< < n, obtained output can be expressed as yt=LSTMforward(xt, ct-1, ht-1), wherein LSTMforwardIndicate above-mentioned LSTM
The calculation method of propagated forward location mode, the output of the autoencoder network of sequence X are Yt=LSTMforward(Xt, ct-1, ht-1)
={ y1, y2... yn, the error of input with output is next calculated, selects mean square error as error calculation formula, trained
The loss function of journey is defined asThe minimum optimization aim of loss function is set, network is given
Random seed number, learning rate and the frequency of training of initialization constantly update network weight using Adam optimization algorithm, wait lose
After convergence, final network model is obtained.
The present invention serializes URL parameter, using advantage of the LSTM in terms of time series expression, establishes LSTM from coding
Model sets input with output loss reduction as optimization aim, passes through optimization to output is decoded again after input data coding
Algorithm constantly updates network weight, finally obtains network model and loss range.Loss threshold value T is set according to loss range, it will
Data of the loss greater than threshold value T are identified as attack data.This method can consider the context relation of data when analyzing data, have
Stronger model tormulation ability reaches preferable effect to the detection of malice URL, improves the accurate of URL parameter attack recognition
Rate, reduction are failed to report, are reported by mistake.
The above embodiments are merely illustrative of the technical solutions of the present invention, rather than limits the protection scope of invention.It is aobvious
So, described embodiment is only section Example of the present invention, rather than whole embodiments.Based on these embodiments, ability
Domain those of ordinary skill every other embodiment obtained without creative efforts, belongs to institute of the present invention
Scope of protection.
Although referring to above-described embodiment, invention is explained in detail, and those of ordinary skill in the art still can be with
In the absence of conflict, creative work is not made to be according to circumstances combined with each other the feature in various embodiments of the present invention, increase
It deletes or makees other adjustment, to obtain other technologies scheme different, that essence is without departing from design of the invention, these technical sides
Case similarly belongs to invention which is intended to be protected.
Claims (2)
1. a kind of URL parameter rejecting outliers method based on LSTM autoencoder network, which is characterized in that comprise the steps of:
S1, the address URL is handled by urllib module the address URL is handled, including escape, decoding, extract URL
Parameter；
S2, the URL parameter data of extraction are constructed with vocabulary, includes all characters occurred in vocabulary, its label one by one obtains
To vocabulary；
S3, according to vocabulary to URL parameter data encoding, be converted into sequence data and intercept uniform length；
S4, data are mapped as by embeded matrix by the insertion of Embedding word；
S5, LSTM autoencoder network is built, obtains network model；
S6, the loss for calculating all training datas, take max value of error as threshold value T；
S7, test network modelling effect are tested using the URL for being mixed with attack data, repeat step S2, S3, S4, S5, when
When obtaining contaminated product attack data degradation value greater than threshold value T, it is identified as attack data and is identified as when penalty values are less than or equal to threshold value T
Normal data.
2. a kind of URL parameter rejecting outliers method based on LSTM autoencoder network according to claim 1, feature
Be, in the step S5, the key of LSTM is that location mode, location mode are run from the beginning to the end, by the structure of door come
Increase location mode or delete information, including forget door, input gate, out gate, location mode, passes through following formula respectively
It calculates and obtains:
Forget door: ft=σ (Wf·[ht-1, x] and+bf) (1)
Input gate: it=σ (Wi·[ht-1, xt]+bi) (2)
State door: candidate state amount
More new state:
Out gate: ot=σ (Wo[ht-1, xt]+bo) (5)
ht=ot·tanh(Ct) (6)
W is corresponding weight in formula, and b is amount of bias, xtFor present input data, ht-1For the output valve of eve, σ Sigmoid
Function, calculation formula areTanh is hyperbolic tangent function, and calculation formula isWhen t moment is defeated
Angle of incidence sequence XtWith the hidden variable h at t-1 momentt-1, firstly, forgeing pupil into ft, see formula (1), lost in determining means
Which kind of information is abandoned, then, generates i in input gatet, see formula (2), determine which kind of information stored, then create candidate vector
Formula (3) are seen, according in t-1 moment state door Ct-1Update t moment quantity of state Ct, formula (4) are seen, finally, generating in out gate
ot, see formula (5), and in quantity of state CtWith quantity of state otUnder the action of, generate the hidden variable h of t momentt, see formula (6), into
And the variation of t+1 moment LSTM unit is influenced, autoencoder network is a kind of unsupervised learning algorithm, including encoder, decoder,
The output of encoder is the input of decoder, using back-propagation algorithm, target value is allowed to be equal to input value, LSTM autoencoder network
Including encoder, decoder, loss function and optimizer, encoder is that LSTM is built with decoder, and the output of encoder is
The input of decoder, can be by go-between at as hidden layer, and loss function calculates the error of output with input, with loss reduction
For optimization aim, backpropagation is carried out, optimizing application function constantly updates network weight, it is assumed that time series X={ x1, x2...
xn, wherein n is data length, and corresponding theoretical output isAs the data x of moment ttInput encodes certainly
Network, xtFor sequence X t moment value, wherein 1 < < t < < n, obtained output can be expressed as yt=LSTMforward
(xt, ct-1, ht-1), wherein LSTMforwardIndicate that the calculation method of above-mentioned LSTM propagated forward location mode, sequence X encode certainly
The output of network is Yt=LSTMforward(Xt, ct-1, ht-1)={ y1, y2... yn, the error of input with output is next calculated,
Select mean square error as error calculation formula, the loss function of training process is defined as
The minimum optimization aim of loss function is set, random seed number, learning rate and the frequency of training of netinit, application are given
Adam optimization algorithm constantly updates network weight and obtains final network model after losing convergence.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811384973.4A CN109561084B (en) | 2018-11-20 | 2018-11-20 | URL parameter abnormal value detection method based on LSTM self-coding network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811384973.4A CN109561084B (en) | 2018-11-20 | 2018-11-20 | URL parameter abnormal value detection method based on LSTM self-coding network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109561084A true CN109561084A (en) | 2019-04-02 |
| CN109561084B CN109561084B (en) | 2020-03-17 |
Family
ID=65866851
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811384973.4A Active CN109561084B (en) | 2018-11-20 | 2018-11-20 | URL parameter abnormal value detection method based on LSTM self-coding network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109561084B (en) |
Cited By (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110378392A (en) * | 2019-06-26 | 2019-10-25 | 华东师范大学 | A kind of indoor geriatric state's monitoring method based on LSTM-AE |
| CN110619427A (en) * | 2019-08-26 | 2019-12-27 | 北京建筑大学 | Traffic index prediction method and device based on sequence-to-sequence learning model |
| CN110874744A (en) * | 2019-11-18 | 2020-03-10 | ***股份有限公司 | Data anomaly detection method and device |
| CN110991471A (en) * | 2019-08-01 | 2020-04-10 | 南京航空航天大学 | Fault diagnosis method for high-speed train traction system |
| CN111257754A (en) * | 2020-03-23 | 2020-06-09 | 北京航空航天大学 | Battery SOC robust evaluation method based on PLSTM sequence mapping |
| CN111444507A (en) * | 2020-06-15 | 2020-07-24 | 鹏城实验室 | Method, device, equipment and storage medium for judging whether shell-added software is misinformed |
| CN111709754A (en) * | 2020-06-12 | 2020-09-25 | 中国建设银行股份有限公司 | User behavior feature extraction method, device, equipment and system |
| CN111865552A (en) * | 2019-04-30 | 2020-10-30 | 北京大学 | Method for detecting coding attack resistance of distributed conversion encoder |
| CN112148955A (en) * | 2020-10-22 | 2020-12-29 | 南京航空航天大学 | Method and system for detecting abnormal time sequence data of Internet of things |
| CN112506899A (en) * | 2020-11-25 | 2021-03-16 | 东华理工大学 | PM2.5 data abnormal value detection method based on improved LSTM |
| CN112711723A (en) * | 2019-10-25 | 2021-04-27 | 北京搜狗科技发展有限公司 | Malicious website detection method and device and electronic equipment |
| CN113180684A (en) * | 2021-06-03 | 2021-07-30 | 哈尔滨理工大学 | II-lead electrocardiosignal classification method |
| CN113239354A (en) * | 2021-04-30 | 2021-08-10 | 武汉科技大学 | Malicious code detection method and system based on recurrent neural network |
| CN113970697A (en) * | 2021-09-09 | 2022-01-25 | 北京无线电计量测试研究所 | Analog circuit state evaluation method and device |
| CN114169432A (en) * | 2021-12-06 | 2022-03-11 | 南京墨网云瑞科技有限公司 | Cross-site scripting attack identification method based on deep learning |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9213807B2 (en) * | 2013-09-04 | 2015-12-15 | Raytheon Cyber Products, Llc | Detection of code injection attacks |
| CN106951783A (en) * | 2017-03-31 | 2017-07-14 | 国家电网公司 | A kind of Method for Masquerade Intrusion Detection and device based on deep neural network |
| CN107798080A (en) * | 2017-10-13 | 2018-03-13 | 中国科学院信息工程研究所 | A kind of similar sample set construction method towards fishing URL detections |
| CN107992469A (en) * | 2017-10-13 | 2018-05-04 | 中国科学院信息工程研究所 | A kind of fishing URL detection methods and system based on word sequence |
| CN108399201A (en) * | 2018-01-30 | 2018-08-14 | 武汉大学 | A kind of Web user access path prediction technique based on Recognition with Recurrent Neural Network |
| CN108418792A (en) * | 2018-01-29 | 2018-08-17 | 华北电力大学 | Network escape behavior detection algorithm based on deep-cycle neural network |
| US20180285740A1 (en) * | 2017-04-03 | 2018-10-04 | Royal Bank Of Canada | Systems and methods for malicious code detection |
-
2018
- 2018-11-20 CN CN201811384973.4A patent/CN109561084B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US9213807B2 (en) * | 2013-09-04 | 2015-12-15 | Raytheon Cyber Products, Llc | Detection of code injection attacks |
| CN106951783A (en) * | 2017-03-31 | 2017-07-14 | 国家电网公司 | A kind of Method for Masquerade Intrusion Detection and device based on deep neural network |
| US20180285740A1 (en) * | 2017-04-03 | 2018-10-04 | Royal Bank Of Canada | Systems and methods for malicious code detection |
| CN107798080A (en) * | 2017-10-13 | 2018-03-13 | 中国科学院信息工程研究所 | A kind of similar sample set construction method towards fishing URL detections |
| CN107992469A (en) * | 2017-10-13 | 2018-05-04 | 中国科学院信息工程研究所 | A kind of fishing URL detection methods and system based on word sequence |
| CN108418792A (en) * | 2018-01-29 | 2018-08-17 | 华北电力大学 | Network escape behavior detection algorithm based on deep-cycle neural network |
| CN108399201A (en) * | 2018-01-30 | 2018-08-14 | 武汉大学 | A kind of Web user access path prediction technique based on Recognition with Recurrent Neural Network |
Non-Patent Citations (2)
| Title |
|---|
| 王聪等: "基于CNN和LSTM混合的Android恶意应用检测", 《通信技术》 * |
| 莫君生: "基于深度学习的Android软件恶意行为检测方法的研究与实现", 《中国优秀硕士学位论文全文数据库》 * |
Cited By (25)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111865552A (en) * | 2019-04-30 | 2020-10-30 | 北京大学 | Method for detecting coding attack resistance of distributed conversion encoder |
| CN111865552B (en) * | 2019-04-30 | 2021-07-09 | 北京大学 | Method for detecting coding attack resistance of distributed conversion encoder |
| CN110378392A (en) * | 2019-06-26 | 2019-10-25 | 华东师范大学 | A kind of indoor geriatric state's monitoring method based on LSTM-AE |
| CN110991471A (en) * | 2019-08-01 | 2020-04-10 | 南京航空航天大学 | Fault diagnosis method for high-speed train traction system |
| CN110619427A (en) * | 2019-08-26 | 2019-12-27 | 北京建筑大学 | Traffic index prediction method and device based on sequence-to-sequence learning model |
| CN112711723B (en) * | 2019-10-25 | 2024-04-30 | 北京搜狗科技发展有限公司 | Malicious website detection method and device and electronic equipment |
| CN112711723A (en) * | 2019-10-25 | 2021-04-27 | 北京搜狗科技发展有限公司 | Malicious website detection method and device and electronic equipment |
| CN110874744B (en) * | 2019-11-18 | 2022-08-02 | ***股份有限公司 | Data anomaly detection method and device |
| CN110874744A (en) * | 2019-11-18 | 2020-03-10 | ***股份有限公司 | Data anomaly detection method and device |
| CN111257754B (en) * | 2020-03-23 | 2021-03-16 | 北京航空航天大学 | Battery SOC robust evaluation method based on PLSTM sequence mapping |
| CN111257754A (en) * | 2020-03-23 | 2020-06-09 | 北京航空航天大学 | Battery SOC robust evaluation method based on PLSTM sequence mapping |
| CN111709754B (en) * | 2020-06-12 | 2023-08-25 | 中国建设银行股份有限公司 | User behavior feature extraction method, device, equipment and system |
| CN111709754A (en) * | 2020-06-12 | 2020-09-25 | 中国建设银行股份有限公司 | User behavior feature extraction method, device, equipment and system |
| CN111444507A (en) * | 2020-06-15 | 2020-07-24 | 鹏城实验室 | Method, device, equipment and storage medium for judging whether shell-added software is misinformed |
| CN111444507B (en) * | 2020-06-15 | 2020-11-03 | 鹏城实验室 | Method, device, equipment and storage medium for judging whether shell-added software is misinformed |
| CN112148955B (en) * | 2020-10-22 | 2024-06-18 | 南京航空航天大学 | Method and system for detecting abnormality of time sequence data of Internet of things |
| CN112148955A (en) * | 2020-10-22 | 2020-12-29 | 南京航空航天大学 | Method and system for detecting abnormal time sequence data of Internet of things |
| CN112506899A (en) * | 2020-11-25 | 2021-03-16 | 东华理工大学 | PM2.5 data abnormal value detection method based on improved LSTM |
| CN113239354A (en) * | 2021-04-30 | 2021-08-10 | 武汉科技大学 | Malicious code detection method and system based on recurrent neural network |
| CN113180684B (en) * | 2021-06-03 | 2023-10-24 | 哈尔滨理工大学 | II-lead electrocardiosignal classification method |
| CN113180684A (en) * | 2021-06-03 | 2021-07-30 | 哈尔滨理工大学 | II-lead electrocardiosignal classification method |
| CN113970697B (en) * | 2021-09-09 | 2023-06-13 | 北京无线电计量测试研究所 | Analog circuit state evaluation method and device |
| CN113970697A (en) * | 2021-09-09 | 2022-01-25 | 北京无线电计量测试研究所 | Analog circuit state evaluation method and device |
| CN114169432A (en) * | 2021-12-06 | 2022-03-11 | 南京墨网云瑞科技有限公司 | Cross-site scripting attack identification method based on deep learning |
| CN114169432B (en) * | 2021-12-06 | 2024-06-18 | 南京墨云科技有限公司 | Cross-site scripting attack recognition method based on deep learning |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109561084B (en) | 2020-03-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109561084A (en) | URL parameter rejecting outliers method based on LSTM autoencoder network | |
| CN102411687B (en) | Deep learning detection method of unknown malicious codes | |
| CN109829299A (en) | A kind of unknown attack recognition methods based on depth self-encoding encoder | |
| CN109101552A (en) | A kind of fishing website URL detection method based on deep learning | |
| CN111259393A (en) | Anti-concept drift method of malicious software detector based on generation countermeasure network | |
| CN111047006B (en) | Dual generation network-based anti-attack defense model and application | |
| CN110414219A (en) | Detection method for injection attack based on gating cycle unit Yu attention mechanism | |
| CN108630199A (en) | A kind of data processing method of acoustic model | |
| CN110110318B (en) | Text steganography detection method and system based on cyclic neural network | |
| CN104408153A (en) | Short text hash learning method based on multi-granularity topic models | |
| CN113297572B (en) | Deep learning sample-level anti-attack defense method and device based on neuron activation mode | |
| CN107203810A (en) | A kind of precipitation Forecasting Methodology based on depth network | |
| CN112560036B (en) | C/C + + vulnerability static detection method based on neural network and deep learning | |
| CN110717525B (en) | Channel adaptive optimization anti-attack defense method and device | |
| CN114676458A (en) | Pre-training language model privacy disclosure risk oriented evaluation method and system | |
| CN109815496A (en) | Based on capacity adaptive shortening mechanism carrier production text steganography method and device | |
| Sivasangari et al. | SQL injection attack detection using machine learning algorithm | |
| CN113298816A (en) | Remote sensing image semantic segmentation method and device and computer equipment | |
| Matsuda et al. | On predictive errors of SQL injection attack detection by the feature of the single character | |
| CN111125750B (en) | Database watermark embedding and detecting method and system based on double-layer ellipse model | |
| CN115660688A (en) | Financial transaction abnormity detection method and cross-region sustainable training method thereof | |
| CN112463956A (en) | Text summary generation system and method based on counterstudy and hierarchical neural network | |
| Ning et al. | Hibernated backdoor: A mutual information empowered backdoor attack to deep neural networks | |
| Ishak et al. | Mining temporal reservoir data using sliding window technique | |
| CN112887323B (en) | Network protocol association and identification method for industrial internet boundary security |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |