Network behavior abnormity detection method based on sub-track mode

Abstract

The invention discloses a network behavior abnormity detection method based on a sub-track mode. The method comprises the steps of firstly collecting the network traffic data and converting into a user behavior track sequence according to the definition of a user behavior; and then considering that the network abnormal behavior generally occurs on a certain short-term time period, dividing each behavior track sequence into a plurality of sub-behavior track sequences with a unified behavior mode according to a minimum description length criterion; calculating the similarity between each sub-behavior sequence and other behavior sequences according to a word vector method, and obtaining the density of each sub-behavior sequence; and finally, according to a density-based anomaly detection method, comprehensively obtaining the local anomaly degree of the to-be-detected behavior track sequence, and according to the local anomaly degree, determining an abnormal behavior track sequence. According to the method, the network abnormal behavior is detected according to the sub-track mode, so that the accuracy of abnormal detection is greatly improved, meanwhile, the specific time period when the user has the abnormal behavior can be confirmed, and the technical support is provided for the follow-up abnormal behavior mode analysis and network attack behavior prevention.

Description

technical field [0001] The invention belongs to the technical field of network security, and more specifically relates to a method for detecting abnormal network behavior based on a sub-track mode. Background technique [0002] With the rapid development of information technology and the increasing popularity of network applications, communication networks have become an indispensable medium for information dissemination in people's daily life. However, while network technology brings convenience to users, there are more and more attacks on communication networks. Although most institutions and organizations have established relatively stable information network security protection mechanisms, the means of network attacks are becoming more and more diverse, and their nature and consequences are becoming more and more serious. In this serious situation, taking effective measures to prevent network attacks is an urgent problem in the field of network security. However, it is...

AI Technical Summary

Problems solved by technology

However, the traditional method based on network data flow analysis has the problem of relying on manual feature extraction and high false positive rate.

At the same time, these two traditional detection methods are for anomaly detection on the entire user behavior sequence, and it is impossible to confirm that the detected abnormal behavior is the user’s abnormality in a specific time period, so that it is impossible to gain deeper insights into network behavior and Difficulty providing support for exception handling mechanisms

Images