Intranet attack detection model construction method based on machine learning

Abstract

The invention discloses an intranet attack detection model construction method based on machine learning, and the method comprises the steps: carrying out the analysis of collected log records, carrying out the different traceability analysis of the log records according to different corresponding scenes, and determining an attack path and an attack behavior; The method comprises the steps of 1, log collection; step 2, defining an attack scene; step 3, defining behavior actions of each scene; and step 4, newly establishing an attack traceability analysis trigger point. The method has the advantages of high accuracy, decision risk reduction and the like.

Description

technical field [0001] The invention relates to the field of intelligent model construction, in particular to a method for constructing an intranet attack detection model. Background technique [0002] With the development of the modern Internet, network security issues are becoming more and more prominent, and there are more and more potential security attacks on the network. With the release of a large number of attack tools, attackers can use simple attack tools to cause harm to the target network. Skilled attackers use system vulnerabilities to carry out in-depth attacks on information systems, which has brought a lot of impact on people's lives. [0003] Attack detection on the intranet can effectively discover the intrusion behavior of attackers, and improving the accuracy of attack behavior detection is a key step in discovering attack behavior. The attack model is an important source of knowledge requirements for the development of attack technology, it helps to und...

AI Technical Summary

Problems solved by technology

In general, the existing attack modeling is not based on the attack classification, and the attack classification and the attack model lack an organic combination, which makes the attack modeling not comprehensive and hierarchical.

Images