Network attack abnormality detection method

Abstract

The invention discloses a network attack abnormality detection method, and relates to the technical field of information security. The technical point of the network attack abnormality detection method disclosed by the invention is as follows: a step 1, deploying a traffic data collection device at a network traffic aggregation node; a step 2, extracting a network behavior feature value from the collected traffic data; a step 3, carrying out dimensionality reduction and standardization on the network behavior feature value; a step 4, determining normal network behavior feature values, and establishing a normal behavior model based on a set of the normal network behavior feature values; and a step 5, detecting other network behavior feature values based on the normal behavior model, and judging whether abnormal network behaviors occur; and when detecting abnormal network behaviors, updating the normal behavior model according to a new normal network behavior feature value.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for detecting abnormal network behaviors based on behavioral characteristics. Background technique [0002] With the rapid popularization of the Internet, while people feel the convenience brought by the Internet, they also face various attacks and threats: confidentiality leakage, data loss, network abuse, identity fraud, illegal intrusion, etc. Vulnerabilities in networks and systems provide opportunities for attackers to take advantage of. With the continuous development of computer technology, new attacks emerge in an endless stream, causing great losses to governments, banks and even military systems. According to the latest statistics, the average economic loss caused by security incidents caused by data leakage in the United States has reached more than 7 million US dollars. Cyberspace security has risen to the level of national security and even mil...

AI Technical Summary

Problems solved by technology

[0010] 1. For specific attacks, the current existing methods have a high false positive rate, and too many false positives reduce the credibility of the detection system, which to a certain extent leads to the unavailability of these detection methods

[0011] 2. In the era of big data, all we are faced with are high-speed massive data streams. Existing methods still have problems in quickly processing high-dimensional massive data streams.

[0012] 3. In terms of normal behavior modeling, the processed data is high-speed flow, and the behavior of the detection subject is also varied. Many existing detection methods use offline calibration and offline learning to model, which is difficult to adapt to dynamic changes. network behavior

Images