A Modified LSTM-Based Approach to Classifying APT Attack Malware Traffic

Abstract

The invention discloses a method for classifying APT attack malicious software traffic based on an improved LSTM, belongs to the field of network security, and solves the problem that it is difficult to classify APT attack malicious software traffic in the prior art. The present invention collects the flow data of malicious software commonly used in APT attacks and the normal flow data; extracts the static characteristic information of each protocol in the flow data of malicious software commonly used in APT attacks and the normal flow data; standardizes the static characteristic information to obtain each The static feature information of the protocol; through the improved LSTM network structure, extract the time series features of the static feature information of each protocol after the unified dimension; use the deep learning method to classify the extracted time series information, and train after classification The classifier obtains the model M; based on the model M, the traffic data to be detected is detected and classified. The invention is used for detection and classification of APT attack malicious software flow in computer communication and mobile network.

Description

technical field [0001] A method and a storage medium for classifying APT attack malware traffic based on an improved LSTM are used for detection and classification of APT attack malware traffic in computer communications and mobile networks, and belong to the field of network security. Background technique [0002] In recent years, with the rapid popularization and development of computer communications and mobile networks, malware-based network attacks have gradually become a new attack mode in the field of information security technology. In particular, Advanced Persistent Threat (APT) cyber-attacks are causing us major economic and social security problems. The malicious software / load in the APT attack process often conducts malicious communication behaviors in order to steal data and download new malware. And in the process of analyzing APT attacks, it is very important to find the organization and region to which the malicious information belongs. [0003] Malware tra...

AI Technical Summary

Problems solved by technology

[0004] For the problems of the above research, the object of the present invention is to provide a method and storage medium for classifying APT attack malware traffic based on improved LSTM, so as to solve the problem that the prior art is difficult to identify APT attack malware traffic, and it is difficult to detect malicious APT attacks. The problem of classifying software traffic

Images