Time sequence point-based network attack event prediction method, system and device and a medium

Abstract

The invention discloses a time sequence point-based network attack event prediction method, system and device and a medium, and the method comprises the steps: obtaining historical attack event data, generating a first event sequence according to the historical attack event data, and determining a first event feature and event occurrence time; constructing a first event atlas according to the first event feature, and processing the first event atlas through a graph embedding algorithm to obtain a first feature vector; inputting the first feature vector and the event occurrence time into a pre-constructed recurrent neural network for model training of a depth point process to obtain a trained time sequence point process model; and predicting the occurrence time and the event type of the next network attack event according to the time sequence point process model. According to the method, the event atlas is converted into the feature vectors through graph embedding, the feature vectors and the occurrence time are trained through the depth point process, the accuracy of network attack event prediction is improved, and the method can be widely applied to the technical field of network security.

Description

technical field [0001] The present invention relates to the field of network technology, in particular to a network attack event prediction method, system, device and medium based on timing points. Background technique [0002] In the field of network security, it is crucial to accurately predict the attacker's next activity. In order to predict the persistence of attacks and predict upcoming attack events, it is usually necessary to collect the attacker's behavior and conduct attack modeling on it for later use. But ignoring the time dimension, the predicted events often cannot reflect the reality. Therefore, by modeling a series of historical events of network attacks, each event corresponds to its occurrence time and event type, based on this series of historical events, it is possible to efficiently predict the occurrence time of the next network attack and its event type. [0003] In the prior art, the most widely used method is to find network attack events by means...

AI Technical Summary

Problems solved by technology

On the other hand, due to the complexity and variety of attack types and the increasingly advanced evasion techniques of attackers, the data that can be collected is not necessarily comprehensive

The traditional time-series point process does not handle the missing data very well, and sometimes only a part of the events can be observed

Images