Unknown threat perception method and system based on active self-paced learning, storage medium and terminal

Abstract

The invention provides an unknown threat perception method and system based on active self-paced learning, a storage medium and a terminal. The unknown threat perception method comprises the followingsteps: selecting a label-free sample with the information amount greater than a first preset threshold value for manual labeling based on an active learning selection strategy; Selecting a label-freesample with the confidence higher than a second preset threshold based on a self-learning selection strategy to carry out prediction labeling; Training a log classification model based on samples ofmanual annotation and predictive annotation; And sensing unknown threats in the network data based on the trained log classification model. According to the unknown threat perception method and systembased on active self-paced learning, the storage medium and the terminal, the accuracy of network threat recognition is improved through a mode of combining manual annotation and predictive annotation, and an unknown network can be recognized.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to an unknown threat perception method, system, storage medium and terminal based on active self-paced learning. Background technique [0002] Network security means that the hardware and software of the network system and the data in the system are protected from being damaged, changed, or leaked due to accidental or malicious reasons, the system runs continuously and reliably, and the network service is not interrupted. In the existing technology, the perception of unknown threats is usually based on network log data, extracting data features, manually labeling a sufficient amount of sample data, and using a single machine learning method for model training. After the model is trained, the Known types of network threat behaviors in network flow data are identified and classified, and alarms are given. [0003] However, the above method has the following defects: ...

AI Technical Summary

Problems solved by technology

[0004] (1) Use a single machine learning method to determine and identify known types of cyber threats, resulting in insufficient accuracy and poor robustness of cyber threat identification;

[0005] (2) The sample data used must be sufficient, otherwise the trained model is prone to overfitting and a large number of false positives;

[0006] (3) The model can only target one known network threat, for example, it can identify DDOS attacks, but cannot identify Advanced Persistent Threat (APT) alarms;

[0007] (4) Unable to identify and call the police on unknown network threats. For example, the ransomware attack that appeared in 2017 escaped the monitoring of many security systems

Images