Active machine learning system for hazardous host detection

Abstract

The invention discloses an active machine learning system for hazardous host detection. Hosts high in possibility of being destroyed are marked by the aid of SIEM (security information and event management) warning information, various safety logs and research notes of analysts. The active machine learning system comprises parts including data collection, feature engineering, mark production, machine learning, feedback algorithms of active learning analyst insights, real-time warning and the like; natural language progressing, text mining and graphics-based methods are adopted, targets are generated and characteristics are created for machine learning; a machine learning mechanism of deep belief network, multilayer deep neutral network, random forest, support vector machine, Logistic regression and the like are adopted for machine learning. The hazardous hosts in the network can be accurately detected, false alarm rate is greatly reduced, host security detection requests and SOC (security operation center) actual investigation are considered, important security events can be handled in time, and labor cost is reduced while network security monitoring capability is improved.

Description

technical field [0001] The invention belongs to the technical field of network security and machine learning, and in particular relates to an active machine learning system for detecting dangerous hosts. Background technique [0002] With the popularization and application of computer networks, especially the Internet, the network has become an important infrastructure on which people's production and life depend. At the same time, the importance of network security has become increasingly prominent. Nowadays, network security has become the key to determining whether the scope of network applications can be greatly expanded and the value of network applications can be maximized. [0003] Cybersecurity incidents, especially data breaches, can have significant financial and reputational impacts on businesses. In 2015, IBM and the Ponemon Research Institute conducted research on the losses caused by data breaches to 62 companies. The results showed that the average loss cause...

AI Technical Summary

Problems solved by technology

[0017] In order to overcome the existing safety information and event management system that has a large number of alarms and a high false alarm rate, resulting in the failure to deal with alarms in time and the possible omission of important alarm information, the present invention provides an active machine learning method for dangerous host monitoring system

Images