Method and device for detecting malicious network behaviors

Abstract

The invention relates to a method and a device for detecting malicious network behaviors. The device comprises a calculation module and a determination module; the calculation module is used for calculating a correlation degree value of to-be-detected network behaviors and each of multiple behavior classes according to characteristic parameters of each behavior class so as to obtain multiple correlation degree values, the behavior classes include a normal behavior class and at least one network behavior class, and the characteristic parameters of the behavior classes are obtained by means of training by taking the known malicious network behaviors and normal network behaviors as training samples; the determination module is used for determining that the to-be-detected behaviors belong to normal network behaviors or malicious network behaviors according to that the maximum correlation degree value in the correlation degree values is the correlation degree value of the to-be-detected network behaviors and the normal behavior class or the correlation degree value of the to-be-detected network behaviors and one of the malicious behavior classes. By the method and the device, accuracy in malicious network behavior detection can be improved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and device for detecting malicious network behaviors. Background technique [0002] With the advancement of mobile communication technology, the mobile Internet has been extensively developed. Subsequently, there have also been many network attacks against the mobile Internet, which have created a great threat to the mobile Internet and mobile terminals. [0003] Traditionally, signature-based matching techniques are used to detect malicious network behaviors in the mobile Internet. However, malicious network behaviors are not fixed. Usually, attackers will make some small changes to malicious network behaviors to generate polymorphic and deformed malicious network behaviors. However, using signature-based matching techniques cannot effectively detect polymorphisms. and deformed malicious cyber behavior. [0004] To this end, many data mining techniques have been propo...

AI Technical Summary

Problems solved by technology

Although compared with the signature-based matching technology, the current data mining technology can detect polymorphic and deformed malicious network behaviors more effectively, but the detection accuracy is still not high enough, and false detections often occur

Images