Malicious behavior mining method and device

Abstract

The invention provides a malicious behavior mining method and a malicious behavior mining device and relates to the technical field of cloud computing. The malicious behavior mining method includes the steps of collecting multi-dimensional heterogeneous data, conducting the distributed real-time processing of the multi-dimensional heterogeneous data and generating real-time data flows, determiningwhether malicious behavior exists in the real-time data flows based on a pre-established malicious behavior attack feature library, standardizing the real-time data flows and forming a behavioral data link to be input into a database to conduct mining if no malicious behavior exists in the real-time data flows. The malicious behavior mining method has the advantages that the attack feature library can be obtained through the training of extracted data features in each dimension, and whether malicious behavioral data exists can be quickly determined when real time data is dealt with; furthermore, the feature library can be constantly updated through the data, the method model is accurate in result determination, and a large amount of complex data can be completely, quickly and continuouslyjudged.

Description

Technical field [0001] The invention relates to the technical field of cloud computing, and in particular to a method and device for mining malicious behavior. Background technique [0002] With the advent of the big data era, the rapid development of other network trends such as mobile communications, cloud computing, and virtualization has brought new problems to traditional network information security, especially as the scale of cloud computing platforms or data centers expands and The network traffic of the cloud platform is growing rapidly, and many malicious attacks (such as APT) are hidden in the large-scale network traffic to attack or steal the cloud platform or core data. Therefore, how to effectively detect malicious behaviors under the cloud platform and carry out effective protection, thereby ensuring the security of confidential data under the platform, is a key issue that needs to be solved urgently in the field of information security. [0003] Traditional data mi...

AI Technical Summary

Problems solved by technology

[0005] The above-mentioned methods are all based on traditional data mining techniques. In today's era of big data, the existing mining methods for malicious behaviors do not take into account the unobvious features, strong correlations, and dimensions of network attacks under the new situation. Due to its advanced characteristics, traditional mining algorithms for malicious behavior cannot be directly transplanted to the cloud computing big data model, which cannot make full use of the high-dimensional and deep correlation characteristics of big data, and cannot guarantee information security in the era of big data

In the context of big data, the scale and speed of network traffic are astonishing. In this case, it is difficult to capture and analyze the correlation of content in network data streams in a timely manner, and network attacks in network data streams are easily mixed into the system; In addition, due to the good latent characteristics of network attacks in the new situation, it is very difficult to dig out the attack behavior of potential platforms

Images