Unknown malicious traffic active detection system and method based on deep embedding

Abstract

The invention discloses an unknown malicious traffic active detection system and method based on deep embedding. The system comprises a preprocessing module, a deep embedding module, an optimal boundary search module and a detection module. The preprocessing module represents the network flows with different lengths in each application as a flow matrix with a fixed size; the deep embedding moduletakes the flow matrix output by the preprocessing module as input in a training stage and learns nonlinear mapping by training a twin convolutional neural network, so that in an embedding space afterthe nonlinear mapping, network flow generated by the same application is distributed more compactly, and network flow generated by different applications is distributed more discretely; in a test stage, a to-be-identified flow matrix is mapped to an embedding space by using the trained convolutional neural network; the optimal boundary search module is used for searching an optimal classificationhyperplane for the network flow of each known category application in the embedded space, and finally a classifier is constructed; and the detection module is used for judging whether the network flowto be identified is from an unknown malicious application or not based on the classifier obtained by the optimal boundary search module.

Description

technical field [0001] The invention relates to a system and method for actively detecting unknown malicious traffic based on deep embedding, and belongs to the technical field of network security. Background technique [0002] In recent years, with the development of network technology, network attacks emerge in an endless stream. According to the "Internet Security Report 2017" released by Tencent Security, in 2017, as many as 86% of companies worldwide experienced at least one cyber attack. As the carrier of network attacks, network traffic often contains attack-related information. Therefore, anomaly detection of network traffic is crucial to effectively identify malware and ensure network security. [0003] Current malware detection methods can be classified into two categories: signature-based methods and machine learning-based methods. The signature-based method generates a signature database based on known malware samples, and detects malicious samples by matching ...

AI Technical Summary

Problems solved by technology

[0006] The technology of the present invention solves the problem: overcomes the deficiencies of the prior art, and provides a system and method for active detection of unknown malicious traffic based on deep embedding, which can identify unknown malicious traffic by solving the problem of open space classification, with lower false alarm rate and higher high detection rate

Images