基于SVM和Word2Vec的Web应用入侵检测系统

Intrusion detection system of Web application based on SVM and Word2Vec

高校应用系统中的Web日志数据是系统运维、安全分析的重要来源。针对数据中心产生的Web日志进行研究,同时考虑GET和POST请求的所有数据,采用Word2Vec构造特征向量,利用支持向量机进行模型构建。并基于MapReduce并行计算模型,给出了一种异常入侵检测算法,构建了一套基于Web日志的安全分析平台。系统运行结果表明,该平台可以有效地发现校园网中的异常入侵,检索效率高,能有效提高运维效率和异常排查速度。

The Web log data in the university application system is an important source of system operation and security analysis.This paper mainly studies the Web log generated by the data center,with considering all data for both GET and POST requests,constructs the feature vector with Word2Vec,and builds the model with support vector machine.Based on MapReduce parallel computing model,an anomaly intrusion detection algorithm is proposed,and a security analysis platform based on Web log is constructed.The system operation results show that the platform can effectively find abnormal intrusion in the campus network,with high retrieval efficiency,and can effectively improve the operation and maintenance efficiency and abnormal troubleshooting speed.