Hierarchical network attack identification and unknown attack detection method based on deep learning

Abstract

The invention discloses a hierarchical network attack identification and unknown attack detection method based on deep learning, which comprises the following steps of: learning behavior modes of normal flow and abnormal flow by using an auto-encoder so as to judge whether the flow to be detected is the normal flow or the abnormal flow by using the learned auto-encoder; using a deep neural networkas a discrimination model to discriminate whether the attack type of the to-be-detected flow is a certain known attack type or an unknown type; and fusing the results of the auto-encoder and the discrimination model to complete network attack classification and unknown attack detection. According to the method, normal flow can be identified, known abnormal flow can be classified, novel unknown network attacks can be detected, and the detection accuracy is improved by combining the advantages of the generation model and the discrimination model.

Description

Technical field [0001] The invention relates to the field of computer network technology, and in particular to a method for layered network attack identification and unknown attack detection based on deep learning. Background technique [0002] With the rapid development of network technology, the Internet has covered all aspects of social life and has had a profound impact on social life. Although the widespread application of the Internet has promoted the rapid development of social economy, it has also become an important medium for hackers and criminals to spread malware and carry out network attacks. In recent years, new network attack methods targeting network protocols and application vulnerabilities have emerged one after another. Network security detection has become one of the important tasks in network supervision and operation and maintenance. In particular, the issue of unknown zero-day network attack detection has received widespread attention. [0003] Tradit...

AI Technical Summary

Problems solved by technology

Anomaly detection only needs normal traffic as input data, and the data requirements are small, and to a certain extent, unknown intrusion behaviors can be detected. problems of classification

Images