Port network intrusion detection method based on Bayesian network

Abstract

The invention relates to the field of industrial Internet, and provides a port network intrusion detection method based on a Bayesian network, which comprises the following steps: S1, collecting, acquiring and preprocessing an abnormal port network flow data set to obtain a network flow characteristic set; S2, constructing and obtaining a Bayesian network model by utilizing the network data packetfeature set; S3, inputting a training set and training parameters of the Bayesian network model, and obtaining conditional probability parameters of the Bayesian network model by using a Bayesian theorem; and S4, detecting an input prediction set by using a conditional probability parameter and the Bayesian theorem to obtain a detection result. The invention discloses a network intrusion detection method based on a Bayesian network model. On the basis of a Bayesian network model, network intrusion detection is realized by modeling network traffic behaviors and characteristic attributes, and online dynamic adjustment can be performed on a detection model to cope with the change of a network environment, so that the accuracy of detecting and protecting network intrusion and the robustness of the model are improved, and finally, a remarkable effect is achieved.

Description

technical field [0001] The invention relates to the field of intrusion detection of industrial Internet network security. Background technique [0002] In recent years, intrusion detection has gradually become a research hotspot in the industry and academia, and many new technologies, algorithms and systems related to intrusion detection have emerged and will continue to emerge. According to the analysis of the 2016 ICS-CERT Industrial Internet Security Situation Report, more than 80% of the country's critical infrastructure relies on the Industrial Internet to automate the production process. However, there are many problems in the existing Industrial Internet intrusion detection. With the rise of intelligent electronic terminal devices, network traffic is growing explosively. Huge network traffic has promoted the integration of the Internet economy and the real economy. While enjoying the dividends of the Internet, we are also facing a series of challenges in network secu...

AI Technical Summary

Problems solved by technology

At present, there are some anomaly detection models based on machine learning or even deep learning. Most of the learning models are discriminant models based on expectation maximization. For online network intrusion detection models, deep learning and other models are used as network intrusion detection models. Although the method is superior to other methods in terms of numerical indicators and other effects, the deep learning model is a typical black-box model that is difficult to visualize and explain. The results are not well interpretable and not convincing enough.

Images