APT attack detection method based on deep belief network-support vector data description

Abstract

The invention discloses an advanced persistent threat (APT) attack detection method based on deep belief network-support vector data description. A deep belief network (DBN) is used for feature dimension-reduction and excellent feature vector extraction; and support vector data description (SVDD) is used for the data classification and detection. At a DBN training state, the feature dimension-reduction is performed by using the DBN model after obtaining a standard data set; a low-level restricted Boltzmann machine (RBM) receives simple representation transmitted from the low-level RBM by usingthe high-level RBM so as to learn more abstract and complex representation after performing the initial dimension-reduction, and back propagation of a back propagation (BP) neural network is used forrepeatedly adjusting a weight value until the data with excellent feature is extracted. The data processed by the DBN is divided into a training set and a testing set, and the data set is provided for the SVDD to perform training and identification detection, thereby obtaining the detection result. The attack detection method disclosed by the invention is suitable for the unsupervised attack datadetection with large data size and high-dimension feature, is fit for the APT attack detection and can obtain an excellent detection result.

Description

technical field [0001] The present invention relates to the technical field of cloud computing security, in particular to an APT attack detection method based on deep belief network-support vector data description. Background technique [0002] Against the backdrop of the rapid development of global network informatization, advanced persistent threats (APTs) with concealment, penetration and pertinence pose increasingly serious threats to various high-level information security systems. The number of organized APT attacks on targets is increasing, and the network information systems and data security of countries and enterprises are facing severe challenges. For example, in 2008, the Great Wall Network of China was attacked and infiltrated by network hackers from the US Department of Defense, and was implanted with a back door to steal information; in 2010, after years of preparation and latent, "Stuxnet" successfully attacked a network located in a physically isolated intra...

AI Technical Summary

Problems solved by technology

Supervised learning methods often show excellent detection results, but need to mark the samples before training, which is not practical for large data sets

Images