Network attack detection method based on spectral clustering algorithm

Abstract

The invention discloses a network attack detection method based on a spectral clustering algorithm. An NS2 network simulator is used to realize effective simulation of a denial of service (DoS) attack stream, and a DoS attack model is established. Experimental data is acquired and verified. Algebraic transformation is applied, and a spectral clustering algorithm based on a transition probability matrix is designed, and then a channel of a suspicious concealed type network attack is screened out. The network attack detection method is advantageous in that a system is designed, tested, and verified, and then the conclusion and the suggestion of the Internet attack detection method are acquired; compared with the prior art, by adopting the abnormality detection method of the spectral clustering algorithm, the false alarm rate is low, and the detection rate is high.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a network attack detection method based on a spectral clustering algorithm. Background technique [0002] With the rapid development of the Internet, the advancement of industrial informatization and the integration of various networks, the network plays an important role in various enterprises and institutions, and the use of the network to process various information is also increasing. Behind the vigorous development of the Internet economy, network information security incidents occur from time to time. The dark side of cyber fraud and virus Trojan horses has also followed. At present, cyber attacks have a wide range of targets, from traditional computer Internet to various industries, such as industrial control systems, transportation, energy, aviation, mobile Internet and Internet of Things. The main purpose of cyber attacks is to steal information and obtain economic ben...

AI Technical Summary

Problems solved by technology

Domestic network protection is mainly border protection. Security devices are generally deployed at the gateway. There is no effective attack detection and protection within the network, and there is no effective monitoring method for intranet network data flow, which is easy to be breached.

Over the years, there has been a lack of forward-looking research on network security protection, and there has been no substantial change in core technical ideas. When new types of network attacks break through the core protection technology of the current protection system, the entire network security industry seems to be widened at once and is in a state of being exhausted.