An intrusion-oriented traceability data clustering method and device

Abstract

The invention discloses an intrusion-oriented traceability data clustering method and device, which belong to the field of computer technology. The method includes: collecting traceability information of the system kernel, and performing preprocessing to filter nodes irrelevant to intrusion behavior and nodes related Dependency relationship; convert the preprocessed traceability information into a traceability graph, and construct the adjacency matrix and node attribute matrix of the traceability graph; select multiple root nodes from the traceability graph as seed nodes for random walk, and make the seed nodes walk according to The strategy performs a random walk to obtain the walking path of the traceability graph and the weight of the traceability edge; the walk strategy is: any node in the seed node walks from the adjacency matrix to its adjacent node with the probability p, and with the probability (1‑ p) Walk from the node attribute matrix to the node with the same attribute; perform clustering according to the walking path and the weight of the tracing edge. It can accurately distinguish different traceability events and provide more accurate data for subsequent detection and query.

Description

technical field [0001] The invention belongs to the field of computer technology, and more specifically relates to an intrusion-oriented traceability data clustering method and device. Background technique [0002] In the big battlefield of cyberspace, the two sides of the offensive and defensive game are essentially a confrontation of information acquisition capabilities. Only by obtaining more and more complete information can we formulate effective offensive and defensive strategies and gain an advantage in the game of cyberspace battlefield. The current host-based intrusion detection methods are mainly based on recording and analyzing Unix shell command data or system call information of intrusion behavior, such as the sequence and occurrence probability of system calls. However, these methods do not reveal detailed internal intrusion event information (such as system vulnerabilities and intrusion sources), and their detection accuracy is not high. Although unstructured...

AI Technical Summary

Problems solved by technology

[0004] In view of the above defects or improvement needs of the prior art, the present invention provides an intrusion behavior-oriented traceability data clustering method and device, aiming at solving the technical problem of difficulty in distinguishing different user behaviors

Images