Method for classifying APT attack malicious software traffic based on improved LSTM

Abstract

The invention discloses a method for classifying APT attack malicious software traffic based on improved LSTM, belongs to the field of network security, and solves the problem that the APT attack malicious software traffic is difficult to classify in the prior art. The method comprises the following steps: collecting flow data and normal flow data of malicious software commonly used for APT attacks; extracting static characteristic information of each protocol in the flow data and the normal flow data of the APT attack common malicious software; standardizing the static feature information toobtain static feature information of each protocol after unifying dimensions; through an improved LSTM network structure, carrying out time sequence feature extraction on the static feature information of each protocol after the unified dimension; performing classification processing on the extracted sequential information by adopting a deep learning mode, and training a classifier after classification processing to obtain a model M; and based on the model M, carrying out detection classification on the to-be-detected flow data. The method is used for detecting and classifying APT attack malicious software traffic in computer communication and mobile networks.

Description

technical field [0001] A method and a storage medium for classifying APT attack malware traffic based on an improved LSTM are used for detection and classification of APT attack malware traffic in computer communications and mobile networks, and belong to the field of network security. Background technique [0002] In recent years, with the rapid popularization and development of computer communications and mobile networks, malware-based network attacks have gradually become a new attack mode in the field of information security technology. In particular, Advanced Persistent Threat (APT) cyber-attacks are causing us major economic and social security problems. The malicious software / load in the APT attack process often conducts malicious communication behaviors in order to steal data and download new malware. And in the process of analyzing APT attacks, it is very important to find the organization and region to which the malicious information belongs. [0003] Malware tra...

AI Technical Summary

Problems solved by technology

[0004] For the problems of the above research, the object of the present invention is to provide a method and storage medium for classifying APT attack malware traffic based on improved LSTM, so as to solve the problem that the prior art is difficult to identify APT attack malware traffic, and it is difficult to detect malicious APT attacks. The problem of classifying software traffic

Images