A method and device for masquerading intrusion detection based on deep neural network

Abstract

The present application discloses a masquerade intrusion detection method based on a deep neural network, including: obtaining behavior flow data of at least two users; initializing a hyperparameter set and a parameter set; for each user, collecting positive samples and negative samples to form a training data set; Use the training data set, loss function and optimization algorithm to calculate the parameter value of each parameter in turn; query the behavior data corresponding to the user's behavior sequence to be detected from the behavior embedding representation query table corresponding to the user, and add it to the behavior embedding representation sequence ; Perform convolution operation, pooling operation, and long-short-term memory artificial neural network corresponding operations on the behavior embedding representation sequence to obtain a second behavior sequence; calculate the probability that the second behavior sequence is a normal behavior sequence; and according to the size of the probability To determine whether the user's behavior is a masquerading intrusion behavior, the method can simultaneously take into account the local strong correlation, long-range dependence and timing of the behavior, and improves the accuracy of masquerading intrusion detection.

Description

technical field [0001] The present application relates to the technical field of information data processing, and more specifically, to a detection method and device for masquerading and intrusion. Background technique [0002] Masquerade intrusion refers to the intrusion behavior that unauthorized users enter a certain system by pretending to be legitimate users, access and modify key data or perform other illegal operations. This intrusion has become one of the most serious security threats to computer and network infrastructure. [0003] The current masquerade intrusion detection methods mostly use the anomaly detection method. The anomaly detection method is based on the masquerading intrusion detection based on the relevant information of user behavior. This type of method considers the relevant information between adjacent behaviors through the n-gram model, and at the same time considers adjacent behaviors. The two types of related information, such as non-adjacent be...

AI Technical Summary

Problems solved by technology

[0004] However, the above-mentioned anomaly detection methods cannot accurately capture the timing of the entire behavior sequence, resulting in low accuracy of intrusion detection.

Images