A network anomaly detection method, system, terminal and storage medium

Abstract

The present application relates to a network anomaly detection method, system, terminal and storage medium. Including: using the n-gram model to perform vector conversion on the network traffic to obtain the vector matrix of the network traffic; using a long-short-term memory network and a bidirectional gating cycle unit to extract the spatio-temporal features of the vector matrix of the network traffic to obtain the The hidden state of the network traffic; the artificial feature of the network traffic is extracted by the artificial feature extractor, and the spatio-temporal feature is extracted to the artificial feature to obtain the hidden state of the artificial feature; the hidden state of the network traffic is combined with the After splicing the hidden states of the artificial features, input the deep neural network to classify and predict the network traffic, and determine whether the network traffic is abnormal according to the prediction results. This application uses the fused features to model the model, which can better represent the network traffic, increase the upper limit of the prediction effect of the model, and achieve a better classification effect.

Description

technical field [0001] The present application belongs to the technical field of network security, and in particular relates to a network anomaly detection method, system, terminal and storage medium. Background technique [0002] According to the 45th Statistical Report on Internet Development in China by China Internet Network Information Center (CNNIC), as of March 2020, the number of Internet users in my country has exceeded 900 million, and the Internet penetration rate has reached 64.5%. However, with the vigorous development of network technology, network security incidents also emerge in endlessly. According to the report of Sangfor Technology, malware was very active in 2019, and malicious behaviors such as virus infection, ransomware, and network attacks emerged in an endless stream. The current network security threats are very serious. If these abnormal network traffic can be found in the early stage of network intrusion and intercepted, it can effectively reduc...

AI Technical Summary

Problems solved by technology

Most of the research work is based on artificially set traffic feature data sets, which obviously cannot determine the upper limit of the classifier if the feature design is good or bad.

There are also some works that try to use raw data modeling, but the traffic embedding method used is mostly byte-level one-hot encoding, which has certain defects and cannot well reflect the internal implicit relationship of the data.

Images