Malicious traffic detection method based on image analysis, terminal equipment and storage medium

Abstract

The invention relates to a malicious traffic detection method based on image analysis, terminal equipment and a storage medium. The method comprises the following steps: S1, collecting to-be-detected network traffic data and malicious traffic data of a known type; s2, preprocessing all the data, and generating corresponding gray feature images; s3, for the gray feature image of each piece of data, performing noise reduction processing through singular value decomposition, extracting a low-frequency part of the image through discrete wavelet transform, and obtaining a binary hash code of the image through the low-frequency part of the image; and S4, according to the Hamming distance between the to-be-detected network traffic data and the binary hash code of the malicious traffic data of the known type, obtaining the similarity between the to-be-detected network traffic data and the binary hash code of the malicious traffic data of the known type, and when the similarity is smaller than a similarity threshold value, judging that the type of the to-be-detected network traffic data belongs to the type of the malicious traffic data of the known type. According to the method, the classification purpose can be realized without independently training samples and extracting features.

Description

Technical field [0001] The present invention relates to the field of malicious flow detection, and more particularly to an image analysis-based malicious flow detecting method, a terminal device, and a storage medium. Background technique [0002] The rapid development of Internet technology has made it played an important role in daily life. It greatly facilitates social life and production, improves the efficiency of information exchange, and provides an important support for information exchanges around the world, accelerating industrial integration development. At present, the new generation of network technologies represented by network payment, network finance, and network live broadcast is rapidly. Electronic information has gradually become mainstream information carrier, and various network applications produce quantities of huge user privacy information every day. Network server is information The construction of society provides important support, so it is increasingly...

AI Technical Summary

Problems solved by technology

The advantage of this method is that the false positive rate is low, but it relies heavily on the integrity of the expert knowledge base and is not suitable for complex network environments.

Images