URL abnormality positioning method and device, and server and storage medium

1. A URL abnormal field locating method, comprising:

obtaining a plurality of URL samples comprising a plurality of abnormal URL samples and a plurality of normal URL samples, wherein each of the plurality of URL samples comprises a plurality of fields;

for each of the plurality of URL samples, obtaining a plurality of feature vectors representing the plurality of fields of the URL sample;

assigning a plurality of training labels to the plurality of feature vectors of each of the plurality of URL samples by:

for each of the plurality of the abnormal URL samples, randomly selecting one or more of the plurality of feature vectors of the abnormal URL sample and assigning one or more positive training labels respectively to the one or more selected feature vectors;

for each of the plurality of the normal URL samples, assigning a plurality of negative training labels respectively to the plurality of feature vectors of the normal URL sample; and

obtaining, based on a classifier, a plurality of predicted labels for the plurality of feature vectors of each of the plurality of URL samples;

updating the plurality of training labels based on the plurality of predicted labels;

training the classifier with the plurality of updated training labels; and

deploying the trained classifier to identify an abnormal field in a URL.

2. The method of claim 1 , wherein the randomly selecting one or more of the plurality of feature vectors of the abnormal URL sample and assigning one or more positive training labels respectively to the one or more selected feature vectors comprises:

assigning a negative training label to each of the plurality of feature vectors that are not selected.

3. The method of claim 1 , wherein each of the plurality of feature vectors comprises at least one of following features of the corresponding field: a total number of characters, a total number of alphabets, a total number of digits, and a total number of symbols.

4. The method of claim 1 , wherein the updating the plurality of training labels based on the plurality of predicted labels comprises:

keeping the plurality of training labels for each of the plurality of normal URL samples unchanged; and

updating the plurality of training labels for each of the plurality of abnormal URL samples according to the plurality of predicted labels for the abnormal URL sample.

5. The method of claim 4 , wherein the obtaining a plurality of predicted labels for the plurality of feature vectors of each of the plurality of URL samples based on a classifier comprises:

by classifying each of the plurality of feature vectors of the URL sample, the classifier generates the plurality of predicted labels for the plurality of feature vectors and a plurality of corresponding scores, each score indicating a probability of a corresponding classification; and

the updating the plurality of training labels based on the plurality of predicted labels comprises:

in response to the plurality of predicted labels for the abnormal URL sample being all negative, selecting one of the plurality of vector features of the abnormal URL sample corresponding to the predicted label with a lowest score; and

updating the plurality of training labels for the abnormal URL sample by assigning a positive training label to the selected vector feature of the abnormal URL sample.

6. The method of claim 1 , wherein the training the classifier with the plurality of updated training labels comprises:

training the classifier until the plurality of training labels are unchanged after being updated based on the plurality of predicted labels.

7. The method of claim 1 , wherein the training the classifier with the plurality of updated training labels comprises:

training the classifier based on a multiple-instance learning algorithm.

8. The method of claim 1 , wherein the deploying the trained classifier to identify an abnormal field in a URL comprises:

obtaining a plurality of feature vectors corresponding to a plurality of fields in the URL;

inputting the plurality of feature vectors into classifier to predict a plurality of labels for the plurality of fields in the URL; and

locating one or more abnormal fields in the URL according to the plurality of abnormality labels for the URL.

9. The method of claim 1 , wherein the plurality of fields of the URL sample comprise a parameter request field in the URL sample.

10. A system comprising a processor and a non-transitory computer-readable storage medium storing instructions executable by the processor to cause the system to perform operations comprising:

obtaining a plurality of URL samples comprising a plurality of abnormal URL samples and a plurality of normal URL samples, wherein each of the plurality of URL samples comprises a plurality of fields;

for each of the plurality of URL samples, obtaining a plurality of feature vectors representing the plurality of fields of the URL sample;

assigning a plurality of training labels to the plurality of feature vectors of each of the plurality of URL samples by:

for each of the plurality of the abnormal URL samples, randomly selecting one or more of the plurality of feature vectors of the abnormal URL sample and assigning one or more positive training labels respectively to the one or more selected feature vectors;

for each of the plurality of the normal URL samples, assigning a plurality of negative training labels respectively to the plurality of feature vectors of the normal URL sample; and

obtaining, based on a classifier, a plurality of predicted labels for the plurality of feature vectors of each of the plurality of URL samples;

updating the plurality of training labels based on the plurality of predicted labels;

training the classifier with the plurality of updated training labels; and

deploying the trained classifier to identify an abnormal field in a URL.

11. The system of claim 10 , wherein the randomly selecting one or more of the plurality of feature vectors of the abnormal URL sample and assigning one or more positive training labels respectively to the one or more selected feature vectors comprises:

assigning a negative training label to each of the plurality of feature vectors that are not selected.

12. The system of claim 10 , wherein the updating the plurality of training labels based on the plurality of predicted labels comprises:

keeping the plurality of training labels for each of the plurality of normal URL samples unchanged; and

updating the plurality of training labels for each of the plurality of abnormal URL samples according to the plurality of predicted labels for the abnormal URL sample.

13. The system of claim 12 , wherein the obtaining a plurality of predicted labels for the plurality of feature vectors of each of the plurality of URL samples based on a classifier comprises:

by classifying each of the plurality of feature vectors of the URL sample, the classifier generates the plurality of predicted labels for the plurality of feature vectors and a plurality of corresponding scores, each score indicating a probability of a corresponding classification; and

the updating the plurality of training labels based on the plurality of predicted labels comprises:

in response to the plurality of predicted labels for the abnormal URL sample being all negative, selecting one of the plurality of vector features of the abnormal URL sample corresponding to the predicted label with a lowest score; and

updating the plurality of training labels for the abnormal URL sample by assigning a positive training label to the selected vector feature of the abnormal URL sample.

14. The system of claim 10 , wherein the training the classifier with the plurality of updated training labels comprises:

training the classifier until the plurality of training labels are unchanged after being updated based on the plurality of predicted labels.

15. The system of claim 10 , wherein the deploying the trained classifier to identify an abnormal field in a URL comprises:

obtaining a plurality of feature vectors corresponding to a plurality of fields in the URL;

inputting the plurality of feature vectors into classifier to predict a plurality of labels for the plurality of fields in the URL; and

locating one or more abnormal fields in the URL according to the plurality of abnormality labels for the URL.

16. A non-transitory computer-readable storage medium configured with instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

obtaining a plurality of URL samples comprising a plurality of abnormal URL samples and a plurality of normal URL samples, wherein each of the plurality of URL samples comprises a plurality of fields;

for each of the plurality of URL samples, obtaining a plurality of feature vectors representing the plurality of fields of the URL sample;

assigning a plurality of training labels to the plurality of feature vectors of each of the plurality of URL samples by:

for each of the plurality of the abnormal URL samples, randomly selecting one or more of the plurality of feature vectors of the abnormal URL sample and assigning one or more positive training labels respectively to the one or more selected feature vectors;

for each of the plurality of the normal URL samples, assigning a plurality of negative training labels respectively to the plurality of feature vectors of the normal URL sample; and

obtaining, based on a classifier, a plurality of predicted labels for the plurality of feature vectors of each of the plurality of URL samples;

updating the plurality of training labels based on the plurality of predicted labels;

training the classifier with the plurality of updated training labels; and

deploying the trained classifier to identify an abnormal field in a URL.

17. The storage medium of claim 16 , wherein the randomly selecting one or more of the plurality of feature vectors of the abnormal URL sample and assigning one or more positive training labels respectively to the one or more selected feature vectors comprises:

assigning a negative training label to each of the plurality of feature vectors that are not selected.

18. The storage medium of claim 16 , wherein the updating the plurality of training labels based on the plurality of predicted labels comprises:

keeping the plurality of training labels for each of the plurality of normal URL samples unchanged; and

updating the plurality of training labels for each of the plurality of abnormal URL samples according to the plurality of predicted labels for the abnormal URL sample.

19. The storage medium of claim 18 , wherein the obtaining a plurality of predicted labels for the plurality of feature vectors of each of the plurality of URL samples based on a classifier comprises:

by classifying each of the plurality of feature vectors of the URL sample, the classifier generates the plurality of predicted labels for the plurality of feature vectors and a plurality of corresponding scores, each score indicating a probability of a corresponding classification; and

the updating the plurality of training labels based on the plurality of predicted labels comprises:

in response to the plurality of predicted labels for the abnormal URL sample being all negative, selecting one of the plurality of vector features of the abnormal URL sample corresponding to the predicted label with a lowest score; and

updating the plurality of training labels for the abnormal URL sample by assigning a positive training label to the selected vector feature of the abnormal URL sample.

20. The storage medium of claim 18 , wherein the training the classifier with the plurality of updated training labels comprises:

training the classifier until the plurality of training labels are unchanged after being updated based on the plurality of predicted labels.