信息网络安全

信息网络安全 ›› 2014, Vol. 14 ›› Issue (12): 16-20.doi: 10.3969/j.issn.1671-1122.2014.12.004

• 技术研究 • 上一篇    下一篇

基于RBF神经网络的HTTP异常行为自动识别方法

王景中, 徐友强   

  1. 北方工业大学信息工程学院,北京 100144
  • 收稿日期:2014-10-09 出版日期:2014-12-15
  • 通讯作者: 徐友强 xuyouqiang88@163.com
  • 作者简介:王景中（1962-）,男,内蒙古,教授,硕士,主要研究方向：信息安全;徐友强（1987-）,男,江西,硕士研究生,主要研究方向：信息安全。
  • 基金资助:
    国家自然科学基金[61371142]; 北京市创新团队建设提升计划[HT20130502]

Automatic Identification for Abnormal HTTP Behavior Based upon RBF Neural Network

WANG Jing-zhong, XU You-qiang   

  1. School of Information Engineering, North China University of Technology, Beijing 100144, China
  • Received:2014-10-09 Online:2014-12-15

RichHTML

4

摘要： 随着互联网的高速发展和用户规模的不断扩大,各种针对网络服务端的攻击不断增加。目前大部分的网络防护措施主要针对对网络层和传输层的攻击,对针对应用层的攻击几乎没有防护能力,但越来越多的针对Web的攻击通过应用层完成。文章提出一种基于RBF神经网络的HTTP攻击行为自动识别方法。该方法通过模拟基于HTTP协议的正常行为和异常行为,对获取的Web通信过程中的数据包包体内容进行分析,结合数据包包头的相关信息,构造基于HTTP协议的网络行为。通过大量的模拟实验,形成大量的基于HTTP协议的正常行为记录和异常行为记录,再使用这些行为记录训练基于径向基函数的神经网络。系统可以利用训练好的神经网络从当前的基于HTTP协议的网络行为中自动识别异常HTTP行为,再将识别出的异常HTTP行为存入异常HTTP行为库中。

关键词: HTTP行为, 数据包, 径向基函数, 神经网络, 异常行为自动识别

Abstract: With the rapid development of Internet and the fast growth in the amount of users, the number of kinds of attacks against network services is increasing. At present, most of the network protection measures aim at attacks which take place in network layer or transport layer, there is almost no protection measure that aims at attacks which take place in application layer.On the other hand, more and more attacks which aim at Web service occur in application layer. This paper proposes an automatic identification algorithm, which could identifies abnormal HTTP behaviors based on RBF neural network. Firstly, the normal HTTP behaviors and the abnormal HTTP behaviors are simulated. Secondly, by analyzing the content of packets acquired in the Web communication process, combining with related information of packet header, records of HTTP behaviors are extracted. A lot of simulation experiments are conducted to generate enough records of normal and abnormal HTTP behaviors, these records are used to train RBF neural network. The well-trained neural network is used to identify abnormal HTTP behaviors from all HTTP behaviors automatically, then these abnormal HTTP behaviors are stored to database.

Key words: HTTP behavior, packet, radial basis function (RBF), neural network, abnormal behavior automatic identification

中图分类号: