Masquerade intrusion detection method and device based on deep neural network

Abstract

The invention discloses a masquerade intrusion detection method based on a deep neural network. The masquerade intrusion detection method comprises obtaining behavior flow data of at least two users; initializing a super parameter set and a parameter set; acquiring positive samples and negative samples to form a training data set by aiming at each user; sequentially calculating the parameter value of each parameter by means of the training data set, a loss function and an optimization algorithm; querying behavior data corresponding to the behavior sequence to be detected of the user from a behavior embedding representation query table and adding the behavior data to a behavior embedding representation sequence; carrying out convolution operation, pooling operation and operation corresponding to the long short-term memory artificial neural network on the behavior embedding representation sequence to obtain a second behavior sequence; calculating the probability of that the second behavior sequence is a normal behavior sequence; and determining whether the user's behavior is a masquerade intrusion behavior or not in dependence on the probability value. According to the invention, local strong relativity, long-range dependence and time sequence of the behavior are taken into account at the same time, and the masquerade intrusion detection accuracy is improved.

Description

technical field [0001] The present application relates to the technical field of information data processing, and more specifically, to a detection method and device for masquerading and intrusion. Background technique [0002] Masquerade intrusion refers to the intrusion behavior that unauthorized users enter a certain system by pretending to be legitimate users, access and modify key data or perform other illegal operations. This intrusion has become one of the most serious security threats to computer and network infrastructure. [0003] The current masquerade intrusion detection methods mostly use the anomaly detection method. The anomaly detection method is based on the masquerading intrusion detection based on the relevant information of user behavior. This type of method considers the relevant information between adjacent behaviors through the n-gram model, and at the same time considers adjacent behaviors. The two types of related information, such as non-adjacent be...

AI Technical Summary

Problems solved by technology

[0004] However, the above-mentioned anomaly detection methods cannot accurately capture the timing of the entire behavior sequence, resulting in low accuracy of intrusion detection.

Images