Abnormal behavior detection method based on weighted probability fusion parallel Bayesian network

Abstract

The invention provides an abnormal behavior detection method based on a weighted probability fusion parallel Bayesian network, and the method comprises the steps: constructing a local sub-Bayesian network, carrying out the weighted fusion, obtaining a global Bayesian network, and carrying out the detection of user abnormal behaviors of a to-be-detected data set through employing the trained global Bayesian network; quantitatively expressing the change condition of the adaptation degree between the network model and the data in unit time through an incremental scoring function, and achieving the balance of new and old data in the network model by adopting a measure of updating part of specific nodes obtained through calculation. According to the method, the effect of improving the efficiency and the accuracy of learning the Bayesian network model is achieved when facing Internet user behavior data, and the accuracy and the stability of data expression by the Bayesian network model along with the increase of newly added data are ensured.

Description

technical field [0001] The invention belongs to the technical field of data processing, and in particular relates to an abnormal behavior detection method based on weighted probability fusion parallel Bayesian network. Background technique [0002] In recent years, network security issues have attracted the attention of the state and society. Through the analysis of Internet user behavior data, it is possible to detect abnormal user behavior, find problems in time, and try to avoid network attacks. [0003] The UNSW-NB15 intrusion detection dataset was generated in 2015 in a synthetic environment at the University of New South Wales (UNSW) Cyber ​​Security Laboratory, which contains 9 types of attacks. The types of attacks are: analysis: penetration of web applications through email, web scripts, etc. Backdoor: Authentication Bypass and Unauthorized Access. DoS: An attempt to exhaust the target's resources. Exploit: An attack that benefits from vulnerabilities and bugs. ...

AI Technical Summary

Problems solved by technology

However, in the face of the above abnormal data of Internet user behavior, the Bayesian network model will have problems such as long calculation time and unstable structure due to lack of computing power and memory limitations. Therefore, Bayesian network is learned from Internet user behavior data sets. Structuring is a very expensive task and has a high failure rate

Secondly, it is difficult to determine which Bayesian network learning algorithm can perform well on the specific data set of Internet user behavior data, so a method is needed to effectively integrate the sub-Bayesian network structure of distributed learning to Form an accurate and stable Bayesian network structure following large data sets

Images