Network killing chain detection method, prediction method and system

Abstract

The invention discloses a network killing chain detection method, a network killing chain prediction method and a network killing chain detection and prediction system. The network killing chain detection method specifically comprises the following steps of: (1) constructing a d-dimensional feature vector; (2) screening and subtracting the d-dimensional feature vector into a k-dimensional featurevector by using an unsupervised feature selection algorithm; (3) acquiring a network kill chain attack event sequence set through utilizing the k-dimensional feature vector, wherein in a real scene inwhich IDS alarm log data is subjected to killing chain mining, aiming at the problem that the number of killing chains contained in the data cannot be known in advance, an improved spectral clustering algorithm disclosed by the invention not only can realize unsupervised learning, but further can automatically identify the clustering number compared with other supervised learning methods; (4) based on the obtained network killing chain sequences, performing prediction analysis by adopting a Markov theory and three network killing chain variant models; and (5) realizing the killing chain detection and prediction system based on theoretical analysis.

Description

technical field [0001] The invention belongs to the field of network security, and further relates to the mining of log data, specifically a machine learning-based network kill chain detection method, prediction method and system. Background technique [0002] With the development of mobile technology and the popularity of social networking, the ubiquitous role and contribution of the Internet in daily life has made computers more vulnerable to cyber attacks. According to the 2018 Cyber ​​Attack Overview Statistics released by Symantec in April 2019, the proportion of banking Trojan attacks has risen from 4% to 16%, and new types of attacks are emerging in an endless stream. The motives for these cyber attacks vary, including but not limited to financial gain, personal injury, intellectual property theft, and political damage. Even with traditional security defenses with multiple layers of security defenses, attackers are able to infiltrate the network and remain persistent...

AI Technical Summary

Problems solved by technology

First of all, many researchers only proposed a theoretical framework to solve the problem of network kill chain at the macro level, and did not give direct analysis methods and specific underlying implementations.

Secondly, the algorithms proposed by some researchers for the kill chain model belong to the category of supervised learning and require labeled data sets as input, which is difficult to obtain in actual scenarios.

Finally, only a few researchers have applied the results of cyber kill chain analysis to cyber situational awareness scenarios, and there is a lack of intuitive visualization

Images