Network traffic multi-sequence matching method, system and device and readable storage medium

Abstract

The invention discloses a network flow multi-sequence matching method, system and device and a readable storage medium, and the method comprises the steps: compressing all to-be-matched sequences, reducing the total length of a calculation sequence, extracting vectors in all to-be-matched sequences, carrying out the duplication removal of the extracted vectors, building a bidirectional connection pointer, counting the occurrence frequency of each dimension of all vectors after deduplication, establishing a multi-fork decision tree based on information gain according to the occurrence frequency, sending each vector of a matched sequence into the multi-fork decision tree in sequence to obtain a vector matching result, decoupling vector matching and sequence matching, designing and optimizing a vector matching method and a multi-sequence matching method respectively, so that multiple sequence features are matched more quickly, the calculation process of the algorithm is accelerated, and the space-time complexity of a traditional algorithm is reduced. Under the condition that large-scale network flow multi-sequence matching is carried out, the calculation amount can be greatly reduced under the condition that the matching effect is ensured, and the time cost of model feature generation is saved.

Description

technical field [0001] The invention belongs to the field of network security and feature matching, and in particular relates to a network flow multi-sequence matching method, system, equipment and readable storage medium. Background technique [0002] In recent years, the scale of the Internet has continued to expand, but there are still a large number of potential threats in cyberspace. Faced with these threats, governments and companies have adopted various methods for network supervision. Passive traffic analysis is an important and effective part of network supervision. It can analyze and identify users' online behavior to a certain extent, so as to further detect, block, and obtain evidence for threatening behavior. The general method of traffic analysis is to establish a traffic mirror on the gateway, then send the mirrored traffic to the detection model, and the detection model outputs the result. The detection model will use different types of features as input inf...

AI Technical Summary

Problems solved by technology

However, this feature lacks application in practical application scenarios. The main reason is that it requires a large amount of calculation, which is usually several times that of statistical features. Due to the limitation of calculation, it still cannot be deployed on a large scale. The matching of sequence features is a problem with extremely high application value, and it is an urgent problem to be solved at present.

Images