Intranet security threat multi-model collaborative defense method based on credibility

Abstract

The invention discloses an intranet security threat multi-model collaborative defense method based on credibility. The method is realized through the following steps: 1, extracting a heterogeneous logtemplate set from massive logs by using thirteen log analysis algorithms such as LogSig and the like, generating a feature matrix through block_id partitioning, learning the feature matrix by using three machine learning algorithms such as SVM and the like, and establishing thirty-nine log detection models; 2, calculating the credibility of the prediction result of the to-be-detected log by different detection models through a statistical learning algorithm; 3, fusing the multi-model prediction results by utilizing the credibility of the plurality of model prediction results obtained by calculation so as to realize collaborative defense of the heterogeneous model. Different from an analysis mode based on a threshold value and a single model, thirteen log analysis algorithms and three machine learning algorithms are used for generating a log detection model, and multi-model cooperation is achieved; and the statistical learning method is utilized to improve the detection capability of the abnormal log.

Description

technical field [0001] The invention belongs to the field of computer network security. Background technique [0002] With the continuous development of computer networks, network security issues have become the focus of attention and challenges. Intranet security threats are the focus of attention in network security issues, and intranet attacks are frequent and aggressive. At present, the amount of logs generated by equipment is increasing, making it difficult to analyze manually. At the same time, a single model will degrade over time, resulting in the inability to obtain comprehensive and accurate detection results. Therefore, it is necessary to build a machine that can analyze logs. And threats can be discovered through the multi-model collaborative defense model. [0003] This system comprehensively uses multiple log parsing algorithms, machine learning algorithms and statistical learning algorithms to collaboratively analyze intranet attack problems to improve accur...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to solve the problem that when a large number of logs are generated on the intranet, these logs are easy to be tampered with, cannot be combined and used, and the model will degenerate, resulting in the inability to obtain comprehensive and accurate results for prediction. Learned Intelligent Analysis Method for Intranet Security Threats

Images