基于BiLSTM-Attention-CNN的XSS攻击检测方法  

XSS attack detection method based on BiLSTM-Attention-CNN

作　　者：李克资 徐洋[1,2] 张庆玲 张思聪 LI Kezi;XU Yang;ZHANG Qingling;ZHANG Sicong(Key Laboratory of Information and Computing Science of Guizhou Province,Guizhou Normal University,Guiyang,Guizhou 550001,China;Big Data and Network Security Development Research Center of Guizhou Public Security Department&Guizhou Normal University,Guiyang,Guizhou 550001,China)

机构地区：[1]贵州师范大学贵州省信息与计算科学重点实验室,贵州贵阳550001 [2]贵州省公安厅-贵州师范大学大数据及网络安全发展研究中心,贵州贵阳550001

出　　处：《贵州师范大学学报（自然科学版）》2022年第4期76-83,共8页Journal of Guizhou Normal University：Natural Sciences

基　　金：国家自然科学基金项目(U1831131);中央引导地方科技发展专项资金(黔科中引地〔2018〕4008);贵州省科技计划项目(黔科合支撑[2020]2Y013号)。

摘　　要：在基于深度学习XSS检测的研究中,双向长短期记忆网络(BiLSTM)和CNN模型均无法区分输入特征信息中关键特征和噪音特征对模型效果的影响。针对这一问题,引入注意力机制,提出一种将BiLSTM和CNN相结合的XSS检测模型。首先利用BiLSTM提取XSS攻击载荷双向序列信息特征,然后引入注意力机制计算不同特征在XSS检测中的权重,最后将加权后的特征向量输入CNN提取局部特征。实验表明BiLSTM-Attention-CNN相比SVM、ADTree、AdaBoost机器学习算法分别提高了9.45%、7.9%和5.5%的准确率,相比单一的CNN、GRU、BiLSTM提高了检测精度,相比BiLSTM-CNN在保持检测精度的同时减短了5.1%收敛时间。In the research of XSS detection based on deep learning,neither bidirectional LSTM nor CNN model can distinguish the influence of key features and noise features in input feature information on model effect.To solve this problem,an attention mechanism was introduced,and an XSS detection model combining BiLSTM and CNN was proposed.First,bidirectional sequence information features of XSS attack loads were extracted by BiLSTM.Then,attention mechanism was introduced to learn different weights according to different features to XSS detection.After that,weighted features were input into CNN to extract the local features for XSS detection.The experiment shows that BiLSTM-Attention-CNN improves the accuracy of 9.45%,7.9%and 5.5%respectively compared with SVM,Adtree and Adaboost machine learning algorithm.Compared with single CNN,GRU and BiLSTM,BiLSTM-Attention-CNN improves the detection accuracy.Compared with BiLSTM-CNN,the convergence time is reduced by 5.1%while maintaining the detection accuracy.

关 键 词：WEB应用安全 XSS CNN 双向长短期记忆网络 注意力机制 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]