Malicious program identification method based on improved support vector machine

Abstract

The invention provides a malicious program identification method based on an improved support vector machine, which comprises the following steps of: acquiring data in network traffic through Netflow,and normalizing an acquired data packet; in order to complete identification of a malicious program, carrying out feature extraction; in order to eliminate redundant features, carrying out feature attribute dimension reduction, and carrying out normalization processing; carrying out classification training by an OFSVM algorithm; and finally, constructing a network traffic identification model byusing an NTMI identification algorithm, and finally realizing identification of malicious programs in the network traffic.

Description

technical field [0001] The invention belongs to the field of detecting malicious programs in network traffic, and relates to a method for identifying malicious programs based on an improved support vector machine. Background technique [0002] With the continuous growth of the population, the scale of the network is expanding day by day, and the network traffic is filled with all kinds of complicated data. Some thieves use some loopholes in the network to carry out network attacks, resulting in the leakage of important information. As well as the security problem of illegal access, what's more, it paralyzes the enterprise system and brings great troubles to people's lives. [0003] In this huge network traffic, network malicious attackers will publish some phishing websites or worm viruses to steal important information of users, and then use these vulnerabilities to convert normal programs into malicious programs, thereby causing the user's host to be controlled by hackers ...

AI Technical Summary

Problems solved by technology

These technologies scan the malicious attacks that may appear in the network and analyze them after obtaining the corresponding data, which has a high delay. At the same time, the final test results of classification and identification are quite different from the expected results. Therefore, The malicious program identification method based on the improved support vector machine proposed in this paper is of great significance

Images