Abstract: With the rapid development of Internet and the fast growth in the amount of users, the number of kinds of attacks against network services is increasing. At present, most of the network protection measures aim at attacks which take place in network layer or transport layer, there is almost no protection measure that aims at attacks which take place in application layer.On the other hand, more and more attacks which aim at Web service occur in application layer. This paper proposes an automatic identification algorithm, which could identifies abnormal HTTP behaviors based on RBF neural network. Firstly, the normal HTTP behaviors and the abnormal HTTP behaviors are simulated. Secondly, by analyzing the content of packets acquired in the Web communication process, combining with related information of packet header, records of HTTP behaviors are extracted. A lot of simulation experiments are conducted to generate enough records of normal and abnormal HTTP behaviors, these records are used to train RBF neural network. The well-trained neural network is used to identify abnormal HTTP behaviors from all HTTP behaviors automatically, then these abnormal HTTP behaviors are stored to database.

Key words: HTTP behavior, packet, radial basis function (RBF), neural network, abnormal behavior automatic identification