Operating system recognition method based on CAVWNB _ KL algorithm

Abstract

The invention discloses an operating system recognition method based on a CAVWNB _ KL algorithm, which comprises the following steps: analyzing an operating system recognition rule in nmap, extractingM thousand data from a large number of split data sets as training data, and extracting m thousand data again as simulation test data by the same method; carrying out box sealing operation on the obtained M thousand data; calculating the correlation degree between the attributes and the classes by using KL divergence to serve as the weight of each attribute; calculating a prior probability and aposterior probability of the preprocessed M thousand data, and storing the prior probability and the posterior probability as fingerprints; calculating a test precision measurement index by taking themten thousand data set; calculating the test precision of the real flow; and screening the collected real flow, performing incremental training in a Bayesian incremental learning mode, correcting anoriginal fingerprint model, and completing recognition. According to the method, a CAVWNB _ KL algorithm is adopted, so that independent conditions required by naive Bayesian attributes are greatly relieved, and the classification precision is improved.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to an operating system identification method based on a CAVWNB_KL (Correlation-based Attribute Value Weighted Naive Bayes_KL) algorithm. Background technique [0002] In the field of network security, the object of security is assets, and the operating system is a major category of assets. At present, the high false positive rate of operating systems is a major pain point for security asset management customers. Therefore, how to accurately identify operating systems and improve The recognition rate of the operating system has always been a hot issue in the field of network security. [0003] At present, in the field of network security, for the identification of operating systems, most of them use on-site fingerprint collection, and most of them use a method similar to binary classification, that is, through one-by-one comparison plug-in identification, and man...

AI Technical Summary

Problems solved by technology

However, the simple Naive Bayesian algorithm may reduce the accuracy of classification for the condition of independence between attributes

Images