Network intrude detecting method based on inherent subsequence mode decomposition

Abstract

The invention discloses a network intrusion detection method which makes decomposition based on an inherent subsequence mode, including the following steps: 1, network data interception and pretreatment are done; 2, the sequence of a normal training set and a suspected sequence respectively go through the inherent sequence pattern mining, wherein, a sequence chart is established for the sequences; a closed path in the sequence chart is located and identified as a candidate sequence for the inherent subsequence mode; the inherent subsequence modes composing each candidate sequence are located according to the original sequence; 3, stratification is made in accordance with the support degree; 4, anomaly detection is done as follows: firstly, the inherent subsequence modes of the suspected sequence and the normal sequence respectively and independently form a plurality of layers in accordance with the respective support degree, then the inherent subsequence mode of the suspended sequence and the normal subsequence are matched in the corresponding layer, finally, the anomaly degree is calculated based on the number of matches so as to judge whether the suspected sequence is abnormal. The method overcomes the deficiencies in the prior art and can accurately and effectively identify the existing attacks and the increasing number of new attacks.

Description

technical field [0001] The invention relates to the technical field of computer networking network security, in particular to a network intrusion detection method. Background technique [0002] The development of computer networking technology has changed the computing model dominated by stand-alone computers. However, the risks and opportunities of network intrusion have correspondingly increased dramatically. Designing security measures to prevent unauthorized access to system resources and data is a very important and urgent problem in the field of network security. Intrusion detection is a kind of network security technology produced and developed under this background. Specifically, intrusion detection is to monitor the operating status of the network system, detect and discover various attack attempts, attack behaviors or attack results, so as to ensure the confidentiality, integrity and availability of system resources. Intrusion detection technology is mainly divi...

AI Technical Summary

Problems solved by technology

[0052] This method has a large amount of calculation, the establishment of first-order and second-order models, the calculation of parameters, and the process of training and building models for normal data are very complicated, and it is difficult to apply them in practice.

And this method only considers the relationship between the two steps before and after the process to call the Native API, but the Native API call process in the actual situation is very complicated, and only considering the two steps before and after the relationship model is not enough to describe the complex call process of the process to the Native API in the actual operating environment

Therefore, this method is only applicable to the detection of certain intrusions, and cannot be generally applied to intrusion detection in real-time environments.

Images