Network attack classification method based on network security data cleaning and fusion

By employing a data cleaning and fusion method based on DS evidence theory and Markov models, the quality issues of multi-source heterogeneous network security data were resolved, enabling accurate classification of network attacks and perception of network security situation, thereby improving the effectiveness and consistency of data use.

CN114826632BActive Publication Date: 2026-05-12INST OF SOFTWARE - CHINESE ACAD OF SCI
2 Cites 0 Cited by

Patent Information

Application Number
CN202110111319.1
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2021-01-27
Publication Date
2026-05-12
Estimated Expiration
2041-01-27

AI Technical Summary

Technical Problem

Existing data cleaning and fusion technologies cannot effectively address the characteristics of multi-source heterogeneous cybersecurity data, resulting in low data quality and affecting the accuracy of cybersecurity situational awareness and event classification.

Method used

A method based on DS evidence theory and Markov models is adopted to perform data cleaning and fusion in stages. Weights are calculated by information entropy, a hidden Markov model is constructed, and DS evidence theory is used for data fusion and classification to identify network attacks.

Benefits of technology

It improved the quality and classification accuracy of cybersecurity data, enhanced the ability to perceive cybersecurity situations, and improved the effectiveness and consistency of data use.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The application discloses a network attack classification method based on network security data cleaning and fusion, relates to the field of network security, and calculates information entropy of each sub attribute space as the weight of the sub attribute space by cleaning data of multi-source heterogeneous network security data; constructs a hidden Markov model for each sub attribute space and trains the hidden Markov model; takes the output results of k trained sub Markov models as k pieces of evidence; inputs attribute sequence values of to-be-tested data of a network attack into the Markov model, and obtains the probability of occurrence of each attack result; according to the probability of occurrence of each attack result, the weight of the above sub attribute space is used for weighted calculation, the k pieces of evidence are fused by using D-S evidence theory; the fused data are judged based on a trust function of the D-S evidence theory, and the network attack is classified according to the judgment result.
Need to check novelty before this filing date? Find Prior Art