An abnormal network connection detection method based on deep learning

Abstract

The invention relates to an abnormal network connection detection method based on deep learning. The method comprises the following steps of extracting a network connection identification field for each network flow record, and aggregating all network flow records according to the network connection identification fields; constructing a network connection model based on a deep neural network; constructing an abnormal network connection detector, using the output of the network connection model as the input, and synchronously training with the network connection model in order to obtain a detection result for network connection; utilizing a data set to carry out parameter adjustment optimization and false alarm control on the network connection model and the abnormal network connection detector, and if an expected effect is achieved, finishing training and storing network parameters and structures; and inputting network connection records to be detected into a combined model of the trained network connection model and the abnormal network connection detector, and outputting the abnormal network connection records. According to the method, the abnormal network connection can be foundout, and the method does not depend on an artificial network connection model.

Description

technical field [0001] The invention relates to a method for detecting abnormal network connections based on deep learning, which belongs to the technical field of network security. Background technique [0002] With the rapid development of computer technology and the Internet, the Internet has increasingly become an indispensable tool in people's daily work, which is profoundly affecting all aspects of human society. At the same time, the network security problems faced by the Internet are also unprecedented, various attacks are becoming more frequent and serious, and abnormal network connections when people use the Internet are becoming more and more common. These abnormal network connections can lead to serious information security issues such as slow web page opening speed, abnormal web page jumps, and even personal information leakage. Therefore, it is particularly important to quickly and effectively detect abnormal network connections. [0003] The main process of ...

AI Technical Summary

Problems solved by technology

[0007] The technology of the present invention solves the problem: it solves the deficiencies in the detection of abnormal network connections in the prior art, and provides a method for detecting abnormal network connections based on deep learning. The method of deep learning is used as the method for detecting abnormal network connections, and it is directly based on historical data of network flows. Modeling the network connection mode can ensure the effect of model training and detection, and has the advantages of not manually modeling the behavior mode, good robustness, and easy to update.

Images