Host operation instruction exception identification method and system

Abstract

The invention provides a host operation instruction exception identification method and system. The method comprises the following steps: S1, extracting sample data; S2, carrying out data processing;obtaining a behavior sequence record and the use frequency of each host operation instruction; S3, screening non-common instructions to obtain a target operation instruction sequence; S4, training a compact prediction tree to obtain a target compact prediction tree; S5, carrying out compact prediction tree prediction to acquire a training data set with a label; S6, training an operation instruction vector by utilizing word2vec to form a pre-training vector; S7, establishing a classification and identification model by using Bi-LSTM; and S8, performing prediction by utilizing the classificationmodel. According to the method, user host operation instruction sequences are analyzed by adopting the compact prediction tree, and a behavior relationship between the instruction behavior sequencesis researched, so that whether the user host operation instruction is abnormal is judged. Based on this, the internal relation between the user operation instructions is fully considered, the logic relation of the instructions in the time dimension is studied, and the object recognition accuracy of the abnormal host operation instructions is improved.

Description

technical field [0001] The invention relates to computer data security, in particular to a method and system for identifying abnormality of host operation instructions. Background technique [0002] Computer system security is one of the key contents of information security. It has become the core technology of computer information system and an important foundation and supplement of network security. [0003] With the continuous development of modern information technology, computer applications involve all walks of life. For computer information security, the country has established a computer network information security mechanism to protect information security and other fields, but it is also difficult to manage computers with a high degree of use. When the protection system is not complete, the computer system still has the threat of information network technology, such as information leakage, information tampering and other dangerous behaviors, which have caused pote...

AI Technical Summary

Problems solved by technology

For example, in the distance-based method, there are certain difficulties in the selection of the distance function and parameters; in the statistical-based method, the distribution of the data is required to be known in advance, but the distribution function of the data is difficult to obtain in advance; in the density-based method, the time complexity is large ; cluster-based methods mainly focus on clustering problems

These problems limit the application of abnormal data mining methods, and mainly deal with deterministic data. There is no effective theoretical model and method for uncertain information processing and discrete sequence data, and the internal logical relationship between sequence behaviors cannot be considered.

For sequence anomaly detection methods, the commonly used Markov model and directed graph model are inefficient for processing large data sets.

[0005] The classification recognition algorithm model of the prior art is based on instruction features, and the relationship between instructions is not fully considered, and it cannot make full use of the inherent logical relationship between the front and back instructions of the host operation in the time dimension.

Images