Network anomaly detection method and system, terminal and storage medium

Abstract

The invention relates to a network anomaly detection method and system, a terminal and a storage medium. The method comprises the following steps: carrying out vector conversion on network traffic byadopting an ngram model to obtain a vector matrix of the network traffic; performing spatial-temporal feature extraction on the vector matrix of the network traffic by adopting a long-short-term memory network and a bidirectional gating cycle unit to obtain an implicit state of the network traffic; extracting an artificial feature of the network traffic through an artificial feature extractor, andperforming spatial-temporal feature extraction on the artificial feature to obtain an implicit state of the artificial feature; and splicing the hidden state of the network flow and the hidden stateof the artificial feature, inputting the spliced state into a deep neural network to perform classification prediction on the network flow, and judging whether the network flow is abnormal according to a prediction result. Modeling of the model is performed by using the fused features so that the network flow can be better expressed, the upper limit of the model prediction effect can be increasedand the better classification effect can be achieved.

Description

technical field [0001] The present application belongs to the technical field of network security, and in particular relates to a network anomaly detection method, system, terminal and storage medium. Background technique [0002] According to the 45th Statistical Report on Internet Development in China by China Internet Network Information Center (CNNIC), as of March 2020, the number of Internet users in my country has exceeded 900 million, and the Internet penetration rate has reached 64.5%. However, with the vigorous development of network technology, network security incidents also emerge in endlessly. According to the report of Sangfor Technology, malware was very active in 2019, and malicious behaviors such as virus infection, ransomware, and network attacks emerged in an endless stream. The current network security threats are very serious. If these abnormal network traffic can be found in the early stage of network intrusion and intercepted, it can effectively reduc...

AI Technical Summary

Problems solved by technology

Most of the research work is based on artificially set traffic feature data sets, which obviously cannot determine the upper limit of the classifier if the feature design is good or bad.

There are also some works that try to use raw data modeling, but the traffic embedding method used is mostly byte-level one-hot encoding, which has certain defects and cannot well reflect the internal implicit relationship of the data.

Images