Network security monitoring method and device based on HTM algorithm

Abstract

The invention discloses a network security monitoring method and device based on an HTM algorithm. The method comprises the following steps: acquiring network protocol flow data of a user host; and processing the network protocol flow data through an HTM algorithm to obtain the network security of the user host. Subtle network protocol flow changes can be discovered, so that malicious attack behaviors can be discovered in time, and the user host protection capability is improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security monitoring method and device based on a Hierarchical Temporal Memory (HTM) algorithm. Background technique [0002] Cyber ​​attacks have evolved with the birth of the Internet and with the development of the Internet. Advanced Persistent Threat (APT) highlights the directional and concealment of attacks, and poses a huge challenge to cyberspace security. How to identify hidden abnormal network attack behaviors from massive network data has become a research focus in the field of network security. [0003] The currently adopted network security monitoring method takes network traffic as the detection object, and judges the security of the network by detecting whether the network traffic is abnormal. Network traffic anomaly detection includes univariate anomaly detection and multivariate anomaly detection. Among them, univariate anomaly detection can ...

AI Technical Summary

Problems solved by technology

[0006] To this end, the present invention provides a method and device for network security monitoring based on the HTM algorithm to solve the problem of inaccurate monitoring in the prior art due to monitoring all traffic of user hosts

Images