基于流量分析的Web服务器数据篡改攻击检测方法研究  

Research on Webserver Data Tampering Attack Detection Method Based on Traffic Analysis

作　　者：邹洪 张佳发 曾子峰 许伟杰 江家伟 ZOU Hong;ZHANG Jiafa;ZENG Zifeng;XU Weijie;JIANG Jiawei(Cybersecurity Division/Research and Development Division,China Southern Power Grid Digital Grid Group Information and Communication Technology Co.,Ltd.,Guangzhou 510663,China)

机构地区：[1]南方电网数字电网集团信息通信科技有限公司,网络安全事业部/研发事业部,广东广州510663

出　　处：《微型电脑应用》2024年第6期148-150,155,共4页Microcomputer Applications

摘　　要：为了提升Web服务器对数据篡改攻击检测方法的性能,结合残差网络和长短期记忆网络,构建网络异常流量分析检测模型。实验数据显示,该模型的准确率和检测率分别为94.05%和84.12%,均优于其他3种传统机器学习模型。该模型构造的网络异常流量检测系统可实时检测进出口流量,攻击测试的准确率约为94.43%,检测率为93.89%,满足系统设计的需求。研究表明,结合机器学习和数据挖掘算法的流量分析方法是一种有效的检测手段,有助于提升Web服务器的安全性。In order to improve the performance of Web server data tampering attack detection methods,a network anomaly traffic analysis and detection model is constructed by combining residual network(ResNet)and long short-term memory(LSTM)network.The experimental data show that the accuracy and detection rate of this model are 94.05%and 84.12%,respectively,which are superior to the other three traditional machine learning models.The network anomaly traffic detection system constructed by this model can detect import and export traffic in real-time.The accuracy of attack testing is about 94.43%,and the detection rate is 93.89%,meeting the requirements of system design.Research shows that combining machine learning and data mining algorithms for traffic analysis is an effective detection method that helps improve the security of Web server.

关 键 词：流量分析 数据篡改 ResNet LSTM KPCA 攻击检测 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]