Attack program identification method based on vulnerability attack database and decision tree

Abstract

The invention provides an attack program identification method based on a vulnerability attack database and a decision tree. The method comprises the following steps: step 1, constructing a vulnerability attack database facing network traffic; step 2, preprocessing a to-be-detected attack program data set to obtain a data set with higher quality and stronger representativeness; step 3, selecting key feature subsets in the vulnerability attack database and the attack program data set to be detected through a secondary feature selection method based on principal component analysis; step 4, training the key feature subsets selected in the vulnerability attack database by using a fast decision tree algorithm to construct a classification model; and step 5, completing the identification of attack programs according to the results of the step 3 and the step 4.

Description

technical field [0001] The invention belongs to the technical field of network flow attack programs, and relates to an attack program identification method based on a vulnerability attack database and a decision tree. Background technique [0002] Today's society is developing rapidly, and the Internet has become one of the most important information technologies. As the network scale continues to grow, network traffic data also shows an explosive growth trend. In addition, various applications in the network emerge in an endless stream, which facilitates our life but also brings many network security and network management problems, and various vulnerability attacks and malicious traffic in the network greatly threaten network security. At present, when identifying attack programs, the most common method is to divide the data set into a training set and a test set, train the training set to form a classification model, and then identify the test set. This method will vary ...

AI Technical Summary

Problems solved by technology

In addition, various applications in the network emerge in an endless stream, which facilitates our life, but also brings many network security and network management problems, and there are various vulnerability attacks and malicious traffic in the network, which greatly threatens network security.

At present, when identifying attack programs, the most common method is to divide the data set into a training set and a test set, train the training set to form a classification model, and then identify the test set. This method will vary depending on the training set. Affect the classification accuracy of the classification model, resulting in certain errors in the detection results

In addition, various attack programs existing in the current network have caused great security risks to the current network environment

Images