基于TF-IDF逻辑回归算法的Web攻击行为检测方法研究

Research of Web-Application-Firewall Based on TF-IDF and Logistic Regression Model

针对各种变形的Web攻击行为难以检测的问题,本文提出了基于TF-IDF逻辑回归算法的Web攻击检测方法,利用数据统计方法 TF-IDF算法将无规律数据集转换成固定维数的特征矩阵,同时利用逻辑回归算法进行训练和分类。并借助三种分类模型评估方法验证该检测方法的可行性。

With the rapid development of Web 2.0, there are a variety of ways to attack Web applications. However, the traditional Web application firewall technology is mostly based on the rule base. The accuracy of this detection technique depends on the strength of the rule base; and rule base is too complicated and needs to be updated when a new attack appears. In view of these problems, this paper presents a new Web application firewall detection model based on TF-IDF logical regression algorithm. This model is a new self-learning model using a machine learning idea. First, we collect the dataset; then, we calculate the feature matrix by TF-IDF algorithm; and finally, we use the trained detection model to test the data which are submitted by users, so as to protect Web applications. Experimental results show that the new model, which has been evaluated by three classification model evaluation methods, has a great ability of protecting the security and learning.