Extensible network attack behavior classification method

Abstract

The invention discloses an extensible network attack behavior classification method. The method comprises the following steps: carrying out data preprocessing on network flow data; extracting a new feature expression and an optimal original feature set from the multi-dimensional feature attributes of the network traffic data; obtaining model related parameters used for preliminary judgment of network behavior attack categories through classification model training; and obtaining the weight values of the known attack category and the normal behavior of the network behavior and the weight valueof the new attack category to comprehensively judge the attack category of the network behavior. According to the invention, the classification result of the network attack behaviors is optimized; anda supervised learning model and an unsupervised learning model are optimized respectively by extracting new feature expressions from multi-dimensional feature attributes of the network traffic data and selecting an optimal original feature set capable of maximally expressing data features, so that a new attack category can be effectively identified on the basis of ensuring the judgment accuracy of the known attack category.

Description

technical field [0001] The invention relates to the field of network intrusion detection, in particular to an expandable network attack behavior classification method. Background technique [0002] The classification of network attack behavior is to establish the relevant rules of network attack classification by mining and analyzing the inherent characteristics and laws of real-time network traffic data, so as to accurately and effectively detect network attack behavior, so as to realize the protection of the network environment. [0003] At present, the classification method of network attack behavior mainly includes (1) artificially constructing relevant rules of network attack behavior, and the network behavior conforming to the rules is an attack behavior; (3) Establish normal behavior standards, and those with a large gap from the standards are network attack behaviors. However, the first two methods are usually unable to effectively identify new attack behavior categ...

AI Technical Summary

Problems solved by technology

However, the first two methods are usually unable to effectively identify new attack behavior categories, while the third method has low detection efficiency, low accuracy rate, and high false positive rate

Images