Unsupervised autonomous attack detection method in endogenous security system

Abstract

The invention discloses an unsupervised autonomous attack detection method in an endogenous security system, which comprises the following steps of: constructing a dynamic graph model of nodes and a logical relationship in a target network, coding the graph model into an implicit vector, initializing a sub-graph and each node based on the implicit vector, generating edges between the nodes through two strategies of node selection and node expansion, carrying out attack detection on the edges between the nodes, and continuously repeating the steps until decoding reconstruction is finished; finally, calculating a reconstruction accuracy rate, and if the reconstruction accuracy rate is smaller than a threshold value, judging that the target network is attacked, and for the condition that the target network is judged to be attacked, positioning an attacked area in a graph matching mode, and returning a judgment result.

Description

technical field [0001] The invention relates to the technical field of computer network communication, in particular to an unsupervised autonomous attack detection method in an endogenous security system. Background technique [0002] Traditional security defenses are usually carried out in isolation in specific areas such as anti-malware, network traffic anomaly detection, network security operations, and system security assessment. Endogenous security system From the perspective of bionics, build an information system endogenous security system based on the biological nervous system. The difference from the existing intelligent security research is that "endogenous security" integrates the human bionic system, immunity, artificial intelligence and mobile communication network, and arranges a huge number of sensors with reference to the characteristics of distributed perception of the human nervous system, real-time monitoring system Each part changes, using the method of ...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide an unsupervised autonomous attack detection method in an endogenous security system, which overcomes the deficiencies of the prior art, and solves the problem of low recognition rate of traditional feature-based matching methods and lack of reliable pre-annotated data based on machine learning methods. To deal with the problem of unknown attacks, the autonomous attack detection method of the present invention realizes unsupervised attack identification and location functions

Images