Abstract: A key information infrastructure security detection technology was proposed based on "memory" to overcome the limitations of the traditional IDS (intrusion detection technology) and WAF (web application firewall) technology in Web attack detection,in this paper. Analyzing comprehensively the three processes of the Web application attack cycle, an attack chain technology based method was used to be able to analyze the real-time data and historical data of Web data bidirectionally, detect various fragmented and persistent attack means, and simultaneously perceive all kinds of vulnerabilities when hackers use attacks, so as to understand and grasp the status of network risk in real time.