【作者】 于洋；

【导师】 桑国明；

【作者基本信息】 大连海事大学 ， 计算机科学与技术， 2021， 硕士

【摘要】 互联网技术的不断发展为人们日常生活及工作提供了便利,浏览器已成为大多数人访问互联网的工具,与此同时,网络安全问题也成为人们关注的话题。跨站脚本攻击是一种常见的网络攻击方法,攻击者可以利用网站存在的缺陷实施攻击,盗取用户的敏感信息。传统的过滤方法已经难以检测出形式复杂的恶意脚本,很多研究者利用机器学习算法及深度学习模型来进行恶意脚本的检测,这些算法及模型都依赖于对数据自身的特征描述。然而攻击是一个动态的过程,防御技术日益加强,攻击技术也在逐渐发展,攻击脚本的特征也变得越来越复杂,因此对于数据特征的描述具有一定的局限性。图卷积神经网络以传统的卷积神经网络为基础,通过学习数据之间的联系对数据自身的特征进行更新,可以有效地解决传统模型只关注数据自身特征而产生的问题。因此本文提出了基于图卷积神经网络的跨站脚本攻击检测方法,主要研究工作如下:(1)将图卷积神经网络应用于跨站脚本攻击检测中。相对于传统深度学习模型,图卷积神经网络可以学习到数据之间的相似性,更适用于跨站脚本攻击的检测。(2)数据的获取及预处理。为了保证模型的有效性及通用性,通过XSSED网站获取了XSS攻击数据,通过Git Hub获取了正常数据,构成了XSSED数据集。为了统一数据格式,本文对所有获得的数据进行了预处理操作,并且利用正则匹配方法对数据进行了分词。(3)数据构图。本文在构图时不再关注数据自身的特征描述,而是关注数据之间的联系,即数据之间的相似性,将数据转化为异构加权图。本文利用点互信息PMI及TF-IDF来计算节点之间边的权重值。(4)对池化层引入softmax机制。本文在池化层引入了softmax机制,通过边的选择实现数据节点的合并,这种方法既保留了边所包含的信息,又能达到降维的目的。更多还原

【Abstract】 The continuous development of Internet technology has provided convenience for people’s daily life and work.The browser has become a tool for most people to access the Internet.At the same time,network security issues have also become a topic of concern.Cross-site scripting attack is a common network attack method,which uses vulnerabilities in websites to carry out attacks and steal users’ personal information.Traditional filtering methods have difficulties to detect complex malicious scripts.Many researchers use machine learning algorithms and deep learning models which rely on the feature description of the data to detect malicious scripts.However,the attack is a dynamic process.The defense technology is strengthened day by day,and the attack technology is also gradually developing.Therefore,the description of data characteristics has certain limitations.The graph convolutional neural network is developed from the traditional convolutional neural network.The characteristics of the data are updated by learning the connections between the data,which can effectively solve the problem caused by traditional models only focusing on the characteristics of the data itself.Therefore,this thesis proposes a Cross-site Scripting attack detection method based on Graph Convolutional Neural Network.The main research work is as follows:(1)Apply graph convolutional neural network to cross-site scripting attack detection.Compared with traditional deep learning models,graph convolutional neural networks can learn the similarities between data and are more suitable for the detection of cross-site scripting attacks.(2)Data acquisition and pre-processing.In order to ensure the validity and versatility of the model,the XSS attack data was obtained through the XSSED website,and the normal data was obtained through Git Hub to form the XSSED data set.Due to the inconsistency of the obtained data format,this article preprocessed all the obtained data,and used the regular matching method to segment the data.(3)Build graph structure.When composing the graph,this article no longer focuses on the feature description of the data itself,but focuses on the similarity between the data and converts the data into a weighted graph.This paper uses PMI and TF-IDF to calculate the weight value between data.(4)Introduce the softmax mechanism to the pooling layer.This paper introduces the softmax mechanism in the pooling layer to realize the merging of data nodes through edge selection.This method not only ensures that the data will not be deleted,but also achieves the purpose of dimension’s reduction.更多还原