Method for detecting camouflage intrusion information

Abstract

The invention discloses a method for detecting camouflage intrusion information. The device mainly comprises three parts, namely a first part and a second part, the system comprises a data preprocessor, a dimension reduction reducer and a camouflage information determiner. According to the method, principal component analysis (PCA) is realized by using a method based on an SVD decomposition covariance matrix; the method is used for dimension reduction of mass data. Removing redundant attributes thereof, the method comprises the following steps: firstly, filtering and formatting a collected original data packet; then, a method based on an SVD decomposition covariance matrix is used for reducing the data; unnecessary data are deleted in the reduction process; according to the intrusion detection method and system, the information disguised by disordering the data transmission sequence is processed, the similarity is used for judging the disguised information, the information is rejectedafter the disguised intrusion behavior is detected, and safe operation of the network system can be well guaranteed.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a method for detecting masquerading intrusion information. Background technique [0002] With the rapid development of network and science and technology, our era is developing in the direction of digitization and informatization. The emergence of the network enables information transmission and information processing between all parts of the world to go beyond the limitations of time and space. Life offers convenience. The entire network information age presents the characteristics of liberalization, trans-regionality, and openness. However, while the Internet brings convenience to people, it also presents great challenges and risks. With the development of networked information, problems such as malicious information attacking network systems have emerged. In order to solve and alleviate this threat, intrusion detection systems have emerged. Correct u...

AI Technical Summary

Problems solved by technology

[0003] System intrusion detection is an important task when running each system, but the intrusion mechanism and the results after the intrusion are complicated. In order to better detect the intrusion behavior in the system, domestic and foreign scholars have proposed feature detection, statistical detection, expert system, file Integrity check and other detection methods, but the detection system is aimed at known attack methods. Once the form of intrusion information changes, the detection system cannot update its knowledge base for a while, which will cause problems such as missed detection and false detection. , so the current detection methods have certain limitations

[0004] As long as there is an intrusion in the network system that is not detected in time, the entire network system will be attacked, and in severe cases, it will even cause huge losses of personnel and property. How to detect intrusions in the network system in time and prevent the network system from being damaged Crash has become the key to ensure the safe operation of the network system

[0005] Therefore, intrusion detection technology is particularly important. Existing intrusion detection methods include misuse detection algorithms, anomaly detection algorithms, and artificial intelligence algorithms. Therefore, it is necessary to propose a system intrusion detection method that is robust and adaptable to various unfavorable situations to help managers quickly detect intrusion behavior and ensure the safe and stable operation of the network system.

The network intrusion detection system finds the attack behavior by matching the network data packets, but the intrusion detection tool often assumes that the attack information is transmitted in plain text, so a slight change to the information may fool its detection

Images