Method and system for identifying abnormality of host operation instructions

Abstract

The present invention provides a method and system for abnormal identification of host operation instructions, including S1. sample data extraction; S2. data processing; obtaining behavior sequence records and frequency of use of each host operation instruction; S3: screening unused instructions to obtain target operations Instruction sequence; S4: compact prediction tree training to obtain the target compact prediction tree; S5: compact prediction tree prediction to obtain the training data set with labels; S6: use word2vec training to operate instruction vectors to form pre-training vectors; S7: use Bi ‑LSTM establishes a classification recognition model; S8: Use the classification model to make predictions. The invention adopts the compact prediction tree to analyze the operation instruction sequence of the user host, and studies the behavior relationship between the instruction behavior sequences, thereby judging whether the operation instruction of the user host is abnormal. Based on this, the internal relationship between user operation instructions is also fully considered, and the logical relationship of instructions in the time dimension is studied to improve the object recognition accuracy of abnormal host operation instructions.

Description

technical field [0001] The invention relates to computer data security, in particular to a method and system for identifying abnormality of host operation instructions. Background technique [0002] Computer system security is one of the key contents of information security. It has become the core technology of computer information system and an important foundation and supplement of network security. [0003] With the continuous development of modern information technology, computer applications involve all walks of life. For computer information security, the country has established a computer network information security mechanism to protect information security and other fields, but it is also difficult to manage computers with a high degree of use. When the protection system is not complete, the computer system still has the threat of information network technology, such as information leakage, information tampering and other dangerous behaviors, which have caused pote...

AI Technical Summary

Problems solved by technology

For example, in the distance-based method, there are certain difficulties in the selection of the distance function and parameters; in the statistical-based method, the distribution of the data is required to be known in advance, but the distribution function of the data is difficult to obtain in advance; in the density-based method, the time complexity is large ; cluster-based methods mainly focus on clustering problems

These problems limit the application of abnormal data mining methods, and mainly deal with deterministic data. There is no effective theoretical model and method for uncertain information processing and discrete sequence data, and the internal logical relationship between sequence behaviors cannot be considered.

For sequence anomaly detection methods, the commonly used Markov model and directed graph model are inefficient for processing large data sets.

[0005] The classification recognition algorithm model of the prior art is based on instruction features, and the relationship between instructions is not fully considered, and it cannot make full use of the inherent logical relationship between the front and back instructions of the host operation in the time dimension.

Images