A Method for Abnormal Detection of Host Network Communication Behavior Based on Temporal Motifs

Abstract

The invention discloses a timing motif-based abnormality detection method for host network communication behavior, and relates to the technical field of network detection. The network communication behavior anomaly detection method, by establishing a weighted directed graph model of the host network communication behavior, based on the timing motif mining algorithm on the graph model, the structure, attributes, and dynamic change information of the network communication behavior Introduced into the model to learn representation vectors capable of anomaly detection. The invention extracts the quantity distribution characteristics of the timing motif in the host network communication behavior graph model by modeling, analyzes the attribute change characteristics in the timing motif based on the unsupervised noise reduction autoencoder, constructs a similarity calculation formula, and realizes network communication behavior anomaly detection. Compared with statistical analysis methods that rely on expert experience and neural network training methods that require a large amount of labeled data, it can effectively improve the accuracy of detection and expand the scope of application of anomaly detection.

Description

A method for abnormal detection of host network communication behavior based on timing motif technical field The invention belongs to the technical field of network detection, and relates to a host network communication system based on a graph model timing motif. anomaly detection method Background technique [0002] According to the China Internet Network Security Report issued by the National Internet Emergency Center in recent years, various security incidents The number of incidents has been on the rise, and hosts that provide various applications on the Internet still have greater security risks. Institutional defense Insufficient protection mechanism and insensitivity to the importance of data, etc., often lead to information leakage, website tampering and other security issues. question. As an important carrier of information, the abnormal behavior of host network communication is often caused by abnormal host behavior and security incidents. important cogni...

AI Technical Summary

Problems solved by technology

[0005] Traditional detection models often study each type of feature separately, resulting in loss of information

For example, statistical analysis methods or neural network models only study the attribute characteristics of communication behaviors, without considering the interactive network relationship between hosts

However, most graph learning methods mainly focus on the structural characteristics of the network, and find the overall abnormality of the network structure by looking for structural changes in the static network, and cannot detect abnormalities for a single host node.

And this kind of scanner behavior shows strong timing in the network structure of communication behavior, which has not yet been reflected in traditional graph learning methods.

Images