Network security verifying device based on improved K-means algorithm

Abstract

The invention provides a network security verifying device based on an improved K-means algorithm. A data mining method is used for the extraction of network attack characteristics. Firstly, traffics entering and exiting a system are monitored through creating a height-controllable target range verifying environment, then abnormal traffics and abnormal behaviors which enter and exit the system are captured by layers by using a layering mechanism, and finally, collected information data are subjected to characteristic analysis by using an improved K-means algorithm, and therefore, the attack behaviors can be efficiently detected and a potential unknown attack in a network is accurately found.

Description

technical field [0001] The invention relates to the technical field of the Internet, and provides a network security verification device based on an improved K-means algorithm. Background technique [0002] In the past ten years, although various defense technologies and products have emerged, network attacks and worms are still active on the Internet, causing hundreds of millions of losses every year. In order to accurately and quickly detect network attacks and respond to worm outbreaks in a timely manner, network security researchers have made unremitting efforts and achieved remarkable results. However, most of the current security detection systems use passive defense technologies, such as firewall technology and intrusion detection technology and so on. Because firewall technology only provides static data packet filtering and cannot prevent attacks from inside the network; at the same time, intrusion detection technology not only cannot effectively detect unknown typ...

AI Technical Summary

Problems solved by technology

However, due to the characteristics of large data volume and high dimensionality of attack data, it is impossible to efficiently analyze massive attack data and extract unknown attack characteristics from massive tool data only by relying on daily security audit technology.

Therefore, this patent cannot handle massive attack data well, in other words, the false negative rate of this patent is relatively high

Images