Host Intrusion Detection Method Based on Relational Network

Abstract

The invention discloses a host intrusion detection method based on a relational network, comprising: step 1, characterizing the host system call sequence sample set; step 2, dividing the data set processed in step 1 into training sets, supporting Set and test set; Divide the training set into sample set and query set again; Step 3, construct relational network model; Described relational network model includes embedding module, connection module and relational module; Step 4, define the target of relational network model Function; step 5, train the constructed relational network model to obtain the host intrusion detection model; step 6, input the trained host intrusion detection model into the host intrusion detection model after step 1 to detect the host system call sequence to be detected. The invention proposes a host intrusion detection method based on a relational network, which can realize host intrusion detection of existing intrusion modes and host intrusion detection of unknown intrusion modes under the condition of small samples.

Description

technical field [0001] The invention relates to the field of network space security, in particular to a host intrusion detection method based on a relational network. Background technique [0002] With the rapid development of the Internet, while bringing convenience to people's lives, it also makes the cyberspace security environment increasingly complex. Many hackers use the host as the attack target to carry out large-scale intrusions, and with the diversification, complexity, intelligence, and concealment of intrusion viruses and intrusion behaviors, the host intrusion detection faces great challenges. In order to deal with the above problems, the deep neural network method is widely used for host intrusion detection. Deep neural networks have achieved good results in supervised recognition tasks, but deep neural networks require sufficient and fully labeled data for each class. At the same time, in the face of new intrusion viruses and intrusion behaviors, deep neural ...

AI Technical Summary

Problems solved by technology

[0003] 1. Due to the high cost of labeling samples, for the model trained with a small number of samples, the detection rate is low and the false positive rate is high;

[0004] 2. For new intrusion viruses and intrusion behaviors, the original model cannot recognize them, and the model needs to be retrained

But FSL is currently only applied in the field of image and natural language processing

Images