Intrusion detection method based on traceability graph

Abstract

The invention discloses an intrusion detection method based on a traceability graph, and belongs to the field of computer system security, and the method comprises the steps: obtaining a traceability graph of a to-be-detected behavior, and calculating the node importance; rapid judgment and accurate judgment are carried out. In the rapid judgment stage, N1 nodes with high importance and corresponding K1 neighborhood nodes are selected, the traceability graph is converted into a first neighborhood matrix through a mapping rule, so that main body features of the traceability graph are rapidly extracted, if the difference m1 between the features and normal rule behaviors is larger than a threshold ThH during detection, intrusion behaviors are judged, and if the difference m1lt is larger than a threshold ThH, the traceability graph is judged to be intrusive behaviors; if so, judging that the behavior is normal; if yes, judging whether TLt; tilt; Tilt; if yes, entering a precise judgment stage: expanding a central node N2 (N2gt; n1) and a neighborhood node K2 (K2gt; (K1) scale, deeply mining the traceability graph, constructing a second neighborhood matrix and extracting features, if the difference between the features and normal rule behaviors is m < 2lt >; if Th, determining the behavior as a normal behavior, otherwise, determining the behavior as an abnormal behavior. According to the invention, intrusion detection can be efficiently and accurately realized.

Description

technical field [0001] The invention belongs to the field of computer system security, and more particularly, relates to an intrusion detection method based on a traceability graph. Background technique [0002] As the network environment and attack methods become more and more complex, in the face of endless intrusion technologies and methods, how to identify a variety of network intrusion operations and attack behaviors in a timely manner, especially in the face of new network attacks and other never-before-seen attacks What kind of countermeasures to take becomes especially critical. [0003] Traditional host-based intrusion detection systems typically use system calls to analyze and identify intrusions. Since these methods do not use contextual information, they cannot identify the causal relationship between the attacker and the infected system, so they can only reduce the frequency of intrusions to a certain extent, but cannot fundamentally prevent hacking behaviors. ...

AI Technical Summary

Problems solved by technology

[0006] 1. Data collection overhead caused by excessive data volume: In order to build a complete system traceability map, the detection system needs to collect a large amount of data. Generally speaking, the amount of data collected by a single machine in a day will be on the order of GB

So storing and processing the data incurs a significant overhead

[0007] 2. Computational overhead caused by graph structure processing: Because of the original graph structure of the traceability graph, complete processing of its information will introduce a lot of overhead

[0008] 3. The preprocessing of the traceability graph leads to the loss of effective information: when preprocessing the data, only the dependencies between nodes in the traceability graph and the name information of the nodes themselves are used. This method loses important information such as the attributes of the nodes themselves. Therefore, there is a lack of in-depth mining of traceability information

[0009] In general, the existing traceability graph-based intrusion detection methods have performance overhead problems caused by massive traceability data and insufficient extraction of important information from traceability information.

Images