Network unknown threat detection method based on feature extension CNN

Abstract

The invention discloses a network unknown threat detection method based on a feature extension CNN, and the method comprises the steps: constructing a feature extension CNN model according to the characteristics that many network unknown threats and known threats are from the same family, and are represented as sample features are similar, firstly carrying out the convolution operation of original data at each layer of the CNN, and obtaining a native feature map; performing linear random operation on the native feature map to obtain an extended feature map; finally, combining the two to obtain extended reconstruction data of the original data, the dimension of which is lower than that of the original data, and realizing dimension reduction extended reconstruction of the data; and constructing a security data classification model based on a shallow machine learning algorithm to realize detection of unknown threats in the network security big data. According to the network unknown threat detection method based on the feature extension CNN provided by the invention, the generated extension reconstruction feature not only realizes dimension reduction, but also expands the data representation of the unknown threat, realizes high-precision detection of the unknown threat, and also reduces the calculation complexity.

Description

technical field [0001] The invention belongs to the technical field of data analysis, relates to network security big data analysis and modeling, and in particular to a network unknown threat detection method based on feature extended CNN. Background technique [0002] The attack and defense of network security is like a cat-and-mouse game. Hackers and cybercriminals are constantly trying various hidden and new attack methods to gain more benefits, such as stealing data, controlling hosts, and extorting money. But these new attacks weren't created in a vacuum. Cybercriminals usually find an existing malware and make some minor adjustments to transform it into a new malware that meets their needs. They even find and exploit a 0day vulnerability to evade detection by security software. Most of these new malware functions are the same as the old ones, often treating viruses with similar functions as a family. In view of the fact that many malicious codes come from the same fa...

AI Technical Summary

Problems solved by technology

However, with more than 1 million new malware being released every day, traditional machine learning methods are no longer up to the task

Images