Traffic data feature extraction method, malicious traffic identification method and network system

Abstract

The invention discloses a traffic data feature extraction method, a malicious traffic identification method and a network system. The feature extraction method comprises the steps of S1, obtaining traffic data including m data streams, extracting n features from each data stream, and constructing a matrix X; S2, performing normalization processing on the matrix X to obtain a feature value matrix;S3, solving the similarity of every two elements in each column of data for the feature value matrix to construct a self-similarity matrix of corresponding features of the column of data; S4, solvinga feature value histogram of features corresponding to each column of data of the feature value matrix; taking an upper triangular element of the self-similarity matrix of each feature to obtain a feature difference histogram; combining the feature value histogram and the feature difference histogram of each feature into a feature vector; and S5, integrating the vectors of the n features into a feature vector of the traffic data. The feature vectors have variation tolerance capability for the traffic features and are used as input of the classification model, so that the classifier can accurately identify malicious traffic and variants thereof.

Description

technical field [0001] The invention relates to the technical field of flow detection, in particular to a flow data feature extraction method, a malicious flow identification method and a network system. Background technique [0002] The future space-ground integrated network is a mixed network composed of various heterogeneous networks, and the security of the network will face severe challenges. Due to the openness of space links and ground networks, illegal users can also intercept data by attacking ground networks and conduct indirect attacks on space vehicles through ground networks. In the future space network environment of satellite-based interconnection, malicious traffic attacks may be a serious threat. For example, attackers may hijack satellites to hide their identities, replace satellites to communicate with targets, and obtain content illegally; more seriously, attackers may also evade security detection by changing communication flow characteristics, that is,...

AI Technical Summary

Problems solved by technology

Among them, signature matching can only detect known malicious behaviors through signature sets, and is powerless against new malicious attacks; dynamic behavior analysis consumes a lot of resources and time, and the high amount of calculation and continuous changes in the data distribution of space-ground integration make it difficult to analyze dynamic behaviors. difficult

In addition, in the past, network attacks were organized in a simple and random manner, but the current attacks are systematic and long-term, with the characteristics of rapid update and strong attack

Images