基于TF-IDF逻辑回归算法的Web攻击行为检测方法研究  

Research of Web-Application-Firewall Based on TF-IDF and Logistic Regression Model

作　　者：郭晓明[1,2] 孙丹 

机构地区：[1]江西省计算技术研究所,江西南昌330003 [2]江西省软件工程技术研究中心,江西南昌330003

出　　处：《科技广场》2017年第6期111-115,共5页Science Mosaic

基　　金：江西省科研院所基础设施配套项目(编号:20151BBA13040)

摘　　要：针对各种变形的Web攻击行为难以检测的问题,本文提出了基于TF-IDF逻辑回归算法的Web攻击检测方法,利用数据统计方法 TF-IDF算法将无规律数据集转换成固定维数的特征矩阵,同时利用逻辑回归算法进行训练和分类。并借助三种分类模型评估方法验证该检测方法的可行性。With the rapid development of Web 2.0, there are a variety of ways to attack Web applications. However, the traditional Web application firewall technology is mostly based on the rule base. The accuracy of this detection technique depends on the strength of the rule base; and rule base is too complicated and needs to be updated when a new attack appears. In view of these problems, this paper presents a new Web application firewall detection model based on TF-IDF logical regression algorithm. This model is a new self-learning model using a machine learning idea. First, we collect the dataset; then, we calculate the feature matrix by TF-IDF algorithm; and finally, we use the trained detection model to test the data which are submitted by users, so as to protect Web applications. Experimental results show that the new model, which has been evaluated by three classification model evaluation methods, has a great ability of protecting the security and learning.

关 键 词：TF-IDF算法 逻辑回归算法 特征矩阵 分类模型评估方法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]