Malicious data flow detection method and system for adversarial network

Abstract

The invention provides a malicious data flow detection method and system for an adversarial network, which can analyze and construct a noise simulation network malicious data model based on historicalaccess data. The method comprises the following steps that the noise simulation network malicious data model is trained by using real network malicious data flow, wherein the model has the capabilityof continuously compounding and mutating network malicious data; meanwhile, the weak correlation bit of the network malicious data to the resistance sample is modified, so that the executability andaggressivity of the resistance sample are reserved, and the method is better used for deep learning training; after the noise simulation network malicious data model is trained, the noise simulation network malicious data model is accessed to the machine learning module to serve as a simulation malicious data source of the machine learning module, the machine learning module is trained by malicious data uninterruptedly, and the detection capability of the machine learning module is improved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a method and system for detecting malicious data flow in an adversarial network. Background technique [0002] Although the existing statistical analysis and machine learning can detect malware, malicious code, malicious behavior, etc., there are still two shortcomings: first, the malicious data in the training process is insufficient, which is far less than normal data, and the lack of data and the lack of The balance will cause the detection model to be unbalanced, resulting in poor detection stability; second, with the development of technology, the means of malicious data of malicious attackers are constantly changing, but they cannot be used for model training in advance, resulting in the model being unable to detect unknown malicious data. Therefore, there is an urgent need for a method and system that can self-generate usable malicious data, enhance tra...

AI Technical Summary

Problems solved by technology

[0002] Although the existing statistical analysis and machine learning can detect malware, malicious code, malicious behavior, etc., there are still two shortcomings: first, the malicious data in the training process is insufficient, which is far less than normal data, and the lack of data and the lack of The balance will cause the detection model to be unbalanced, resulting in poor detection stability; second, with the development of technology, the means of malicious data of malicious attackers are constantly changing, but they cannot be used for model training in advance, resulting in the model being unable to detect unknown malicious data

Images