基于RBF神经网络的HTTP异常行为自动识别方法

随着互联网的高速发展和用户规模的不断扩大，各种针对网络服务端的攻击不断增加。目前大部分的网络防护措施主要针对对网络层和传输层的攻击，对针对应用层的攻击几乎没有防护能力，但越来越多的针对Web的攻击通过应用层完成。文章提出一种基于RBF神经网络的HTTP攻击行为自动识别方法。该方法通过模拟基于HTTP协议的正常行为和异常行为，对获取的Web通信过程中的数据包包体内容进行分析，结合数据包包头的相关信息，构造基于HTTP协议的网络行为。通过大量的模拟实验，形成大量的基于HTTP协议的正常行为记录和异常行为记录，再使用这些行为记录训练基于径向基函数的神经网络。系统可以利用训练好的神经网络从当前的基于HTTP协议的网络行为中自动识别异常HTTP行为，再将识别出的异常HTTP行为存入异常HTTP行为库中。

Automatic Identiifcation for Abnormal HTTP Behavior Based upon RBF Neural Network

With the rapid development of Internet and the fast growth in the amount of users, the number of kinds of attacks against network services is increasing. At present, most of the network protection measures aim at attacks which take place in network layer or transport layer, there is almost no protection measure that aims at attacks which take place in application layer.On the other hand, more and more attacks which aim at Web service occur in application layer. This paper proposes an automatic identification algorithm, which could identifies abnormal HTTP behaviors based on RBF neural network. Firstly, the normal HTTP behaviors and the abnormal HTTP behaviors are simulated. Secondly, by analyzing the content of packets acquired in the Web communication process, combining with related information of packet header, records of HTTP behaviors are extracted. A lot of simulation experiments are conducted to generate enough records of normal and abnormal HTTP behaviors, these records are used to train RBF neural network. The well-trained neural network is used to identify abnormal HTTP behaviors from all HTTP behaviors automatically, then these abnormal HTTP behaviors are stored to database.