A method and system for identifying attack event types based on machine learning

Abstract

The present invention discloses a method and system for identifying attack event types based on machine learning. The method comprises: obtaining an attack event log file and string information corresponding to the attack event type; using the string information corresponding to the attack event type to perform similarity analysis and similarity sorting on multiple lines of log data in the attack event log file to obtain a sorted list of attack event types, and extracting a predetermined number of log data items from the list to form a group of regional network attack events; performing similarity analysis on the log data contained in the group of regional network attack events to obtain key string information; training a text classification model based on the key string information, and using the trained text classification model to identify the attack event log data to be tested to obtain the attack event type corresponding to the log data to be tested. The method and system provided by the present invention can distinguish different types of network attack events, reducing security risks in computer systems.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method and system for identifying attack event types based on machine learning. Background Art

[0002] A cyberattack, also known as a cyberattack, refers to any type of offensive action against computer information systems, infrastructure, computer networks, or even personal computer devices. For computer networks, any attempt to destroy, expose, modify, or disable the functionality of software or services, as well as to steal or access data from any computer without authorization, is considered a cyberattack.

[0003] Generally speaking, network attacks primarily include Internet Protocol (IP) packet attacks and Denial of Service (DoS) attacks. IP packet attacks involve sending flawed IP packets to a target system, using these packets to damage data, steal information, and disable its functions. IP packet attack methods include Ping of Death, Teardrop, and ExeBind. Another major network attack method is DoS attacks. DoS attacks use a large number of packets to bombard a target system, preventing it from accepting normal user requests or causing the target host to hang and malfunction. DoS attack methods include SYN floods and Fraggles. Among various network attack types, DoS attacks are the most common. This is because they require minimal skill and can be carried out using a variety of publicly available attack software. Therefore, the threat posed by DoS attacks is increasing. A successful DoS attack can cause a sharp decline in server performance, resulting in access failures for normal clients.

[0004] Existing computer systems have poor ability to distinguish network attacks, especially DoS network attacks. Since network attacks are highly hidden, have many overlapping features, and new features emerge in an endless stream, it is difficult for computer systems to distinguish different types of network attacks, posing a huge threat to the security of computer systems. Summary of the Invention

[0005] Therefore, the present invention provides a method and system for identifying attack event types based on machine learning, which can distinguish different types of network attack events through text classification models, reduce security risks in computer systems, and solve the problems raised in the above background technology.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a method for identifying attack event types based on machine learning, comprising:

[0008] Get the attack event log file and the string information corresponding to the attack event type;

[0009] Using the character string information corresponding to the attack event type, similarity analysis and similarity sorting are performed on multiple lines of log data in the attack event log file to obtain a sorted list of attack event types;

[0010] Extracting a predetermined number of log data items from the attack event type sorted list, and using the predetermined number of log data items to form a same group of regional network attack events;

[0011] Performing similarity analysis on the log data included in the same group of regional network attack events to obtain key string information;

[0012] A text classification model is trained according to the key character string information, and the trained text classification model is used to identify the log data to be tested of the attack event to obtain the attack event type corresponding to the log data to be tested.

[0013] Preferably, the step of obtaining a ranked list of attack event types includes:

[0014] Extracting character string information from multiple lines of log data in the attack event log file;

[0015] Performing similarity matching on the character string information of the multiple lines of log data and the character string information corresponding to the attack event type to obtain similarities between the multiple lines of log data and the attack event type;

[0016] The multiple lines of log data are sorted by similarity according to the similarity, to obtain a sorted list of attack event types to which the multiple lines of log data belong.

[0017] Preferably, the step of using a predetermined number of log data items to form a same group of regional network attack events includes:

[0018] Using a predetermined number of log data items as multiple sets of log data corresponding to the attack event type;

[0019] Extract the location information of each set of log data in the log file and its corresponding timestamp information, and associate the location information and timestamp information of each set of log data;

[0020] A judgment is made on whether the associated log data can form the same group of regional network attack events. If the location interval of the location information of the associated log data is less than or equal to the standard interval and the time interval of the timestamp information is less than or equal to the duration of a single attack, the associated log data are formed into the same group of regional network attack events.

[0021] Preferably, the step of obtaining key string information includes:

[0022] The log data included in the same group of regional network attack events is used as the key regional log data for investigation;

[0023] Performing similarity analysis on multiple lines of log data belonging to the key investigation area log data using the character string information corresponding to the attack event type;

[0024] String information with a similarity greater than or equal to a preset similarity threshold is extracted as key string information.

[0025] Preferably, the step of training a text classification model based on key string information includes:

[0026] Performing a word segmentation operation on the key character string information to obtain the key character string information after word segmentation;

[0027] Perform keyword extraction on the segmented key string information, and use the TF-IDF algorithm to obtain the inverse word frequency corresponding to each keyword;

[0028] Obtaining a target keyword and a tag set of the target keyword according to the reverse word frequency screening;

[0029] Construct a feature matrix using target keywords whose tag similarity is greater than or equal to the basic tag threshold;

[0030] After processing, the feature matrix is ​​input into the text classification model for training.

[0031] Preferably, the process of processing the feature matrix includes:

[0032] The target keyword whose tag similarity is greater than or equal to the basic tag threshold is regarded as a high-similarity keyword;

[0033] Using a vectorizer to generate word vectors for the high-similarity keywords and composing them into a feature matrix;

[0034] The principal component analysis algorithm is used to reduce the dimension of the feature matrix to obtain the reduced dimension feature matrix.

[0035] Preferably, the step of obtaining the attack event type corresponding to the log data to be tested includes:

[0036] Extracting keywords to be tested from character string information contained in the log data to be tested of the same set of network attack events;

[0037] A feature matrix corresponding to the keywords to be tested is constructed, and the feature matrix is ​​input into a trained text classification model for identification to obtain the attack event type corresponding to the log data to be tested.

[0038] In a second aspect, an embodiment of the present invention provides a system for identifying attack event types based on machine learning, including:

[0039] The data acquisition module is used to obtain the attack event log file and the string information corresponding to the attack event type;

[0040] A first similarity analysis module is configured to perform similarity analysis and similarity sorting on multiple lines of log data in the attack event log file using character string information corresponding to the attack event type to obtain a sorted list of attack event types;

[0041] a log data extraction module, configured to extract a predetermined number of log data items from the attack event type sorted list, and use the predetermined number of log data items to form a same group of regional network attack events;

[0042] A second similarity analysis module is used to perform similarity analysis on the log data contained in the same group of regional network attack events to obtain key string information;

[0043] The classification model training and identification module is used to train a text classification model according to the key string information, and use the trained text classification model to identify the log data to be tested of the attack event to obtain the attack event type corresponding to the log data to be tested.

[0044] In a third aspect, an embodiment of the present invention provides a computer device comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute a method for identifying attack event types based on machine learning according to the first aspect of the embodiment of the present invention.

[0045] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute a method for identifying attack event types based on machine learning according to the first aspect of the embodiment of the present invention.

[0046] The technical solution of the present invention has the following advantages:

[0047] The present invention provides a machine learning-based attack event type identification method and system. The method comprises obtaining an attack event log file and string information corresponding to the attack event type; performing similarity analysis and similarity sorting on multiple lines of log data in the attack event log file using the string information corresponding to the attack event type to obtain a sorted list of attack event types; extracting a predetermined number of log data items from the sorted list of attack event types, and using the predetermined number of log data items to form a group of regional network attack events; performing similarity analysis on the log data contained in the same group of regional network attack events to obtain key string information; training a text classification model based on the key string information, and using the trained text classification model to identify the attack event log data to be tested to obtain the attack event type corresponding to the test log data. The present invention can identify different types of network attack events through the text classification model, thereby reducing security risks in computer systems and ensuring the safe operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 A flowchart of a method for identifying attack event types based on machine learning provided in an embodiment of the present invention;

[0050] Figure 2 A diagram showing the module composition of a system for identifying attack event types based on machine learning, provided in an embodiment of the present invention;

[0051] Figure 3 A diagram showing the composition of a specific example of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only embodiments of a part of the present invention, not all embodiments, and are not intended to limit the scope of the present invention. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts disclosed in the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.

[0053] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0054] Example 1

[0055] The embodiment of the present invention provides a method for identifying attack event types based on machine learning, such as Figure 1 As shown, the method includes:

[0056] Step S1: Obtain the attack event log file and the character string information corresponding to the attack event type.

[0057] In this embodiment of the present invention, multiple log files to be classified are first obtained. Any of these log files can be selected to group the log data within them. Because each log file contains multiple lines of log data, each containing a string of information, the string information can be used to group the log data and obtain log data corresponding to different attack event types.

[0058] In this embodiment, the character string information corresponding to the attack event type is obtained from a public corpus, for example, the character string corresponding to the IP packet attack type or the character string corresponding to the DoS attack type. This is only used as an example and is not intended to be limiting. Adaptive modifications can be made based on actual needs.

[0059] Step S2: Using the character string information corresponding to the attack event type, similarity analysis and similarity sorting are performed on multiple lines of log data in the attack event log file to obtain a sorted list of attack event types.

[0060] In an embodiment of the present invention, string information corresponding to attack event types obtained from a public corpus is used to assign similarities and sort multiple lines of log data in an attack event log file to be classified. This yields a ranked list of attack event types corresponding to the log file. This ranked list of attack event types records possible attack event types, with the higher the ranking, the more likely the attack event type. This ranked list of attack event types links multiple lines of log data to network attack events through string information features, providing highly similar sample data for subsequent attack event type recognition models, thereby improving the model's recognition rate.

[0061] In this embodiment, the step of obtaining a ranked list of attack event types specifically includes:

[0062] Step S21: extracting character string information from multiple lines of log data in the attack event log file.

[0063] Step S22: performing similarity matching on the character string information of the multiple lines of log data and the character string information corresponding to the attack event type to obtain the similarity between the multiple lines of log data and the attack event type.

[0064] In the embodiment of the present invention, the similarities between the multiple lines of log data and the attack event types are obtained by conventional similarity matching technology, which is not limited here.

[0065] Step S23: sorting the multiple lines of log data by similarity according to the similarity, and obtaining a sorted list of attack event types to which the multiple lines of log data belong.

[0066] Specifically, by extracting string information from multiple lines of log data in the attack event log file, and performing similarity matching between the string information and the string information corresponding to the attack event type, the similarity corresponding to the multiple lines of log data and the attack event type is obtained. In this way, the multiple lines of log data can be linked to the network attack event through these features of the string information, and then the multiple lines of log data are sorted by similarity according to the size of the similarity to obtain a sorted list of attack event types described in the above multiple lines of log data. Because the multiple lines of log data may include multiple network attack events, and the more data volume of the recorded string information, the more likely the log file is to belong to the attack event type, in order to improve the accuracy of the similarity judgment, it is necessary to set a sorted list of attack event types, and put the most likely attack event type at the front of the list.

[0067] In one specific embodiment, because each group of network attack events contains a fixed number of multiple lines of log data, a similarity analysis is first performed on the multiple lines of log data in each group of log data with the string information corresponding to the attack event type in the corpus, for example, the string information corresponding to the IP packet attack type or the string information corresponding to the DoS attack type, to determine the matching degree between the log data and the string information. A similarity analysis is then performed on the multiple groups of log data in the current log file with the string information of the attack event type in the corpus, and the multiple groups of log data in the current log file are sorted by similarity to obtain a sorted list of attack event types in the log file that belong to IP packet attacks or a sorted list of attack event types in the log file that belong to DoS attacks. By obtaining this sorted list of attack event types, different groups of log data can be classified into different types of network attack events.

[0068] Step S3: extracting a predetermined number of log data items from the attack event type sorting list, and using the predetermined number of log data items to form a same group of regional network attack events.

[0069] In the examples of the present invention, the first predetermined number of items in the attack event type sorting list is set based on actual needs. For example, the first three items of log data are only used as examples and are not limited to this. In actual applications, the log data of the first three items reflect a higher probability of belonging to the type of attack event to which the multiple lines of log data in the log file belong. Therefore, the log data of the first predetermined number of items can form the same group of regional network attack events, and then the same group of regional network attack events has more similar string information and more similar features. Feature extraction of the same group of regional network attack events can more accurately identify the type of attack event to which the new log data belongs.

[0070] In this embodiment, the steps of using a predetermined number of log data items to form a same group of regional network attack events specifically include:

[0071] Step S31: using the previously predetermined number of log data items as multiple groups of log data corresponding to the attack event type.

[0072] Specifically, the log data of the first predetermined number of items in the attack event type sorting list has a higher probability of reflecting the attack event type to which the multiple lines of log data in the log file belong. Therefore, the log data of the first predetermined number of items can be used as a reference for the attack event type, and its specific setting is determined according to actual application.

[0073] Step S32: extracting the location information of each set of log data in the log file and its corresponding timestamp information, and associating the location information and timestamp information of each set of log data.

[0074] Specifically, the closer the positions of the log data in the log file are, the higher the possibility that the log data belongs to the same network attack event. Similarly, the shorter the timestamp information of the log data, the more it indicates that the previous predetermined number of log data belong to the same network attack event. Therefore, by associating the position information and timestamp information of the previous predetermined number of log data in pairs, the associated log data can be divided into the same group of regional network attack events.

[0075] Step S33: Determine whether the associated log data can form the same group of regional network attack events. If the location interval of the location information of the associated log data is less than or equal to the standard interval and the time interval of the timestamp information is less than or equal to the duration of a single attack, then the associated log data will be formed into the same group of regional network attack events.

[0076] In an embodiment of the present invention, by judging whether the position spacing in the position information of the associated log data is less than or equal to the standard spacing, if it is less than or equal to the standard spacing, and the event interval is less than or equal to the duration of a single attack, it means that the associated log data belongs to the same group of network attack events. In this way, log data in different rows can be associated, and the string features corresponding to the attack event type can be obtained by filtering the log data in the same group of regional network attack events. Specifically, the standard spacing is determined based on empirical values; the duration of a single attack is set at the minute level, and can generally be set to any standard spacing of 1 minute, 5 minutes or 10 minutes. The specific value is determined based on empirical values ​​and is not limited here. The specific settings of the above standard spacing and the duration of a single attack are only used as examples and are set according to actual application scenarios.

[0077] In a specific embodiment, taking IP packet attack as an example, first obtain a ranked list of attack event types of IP packet attack; select multiple groups of log data of the top k items from the ranked list of network attack event types of the IP packet attack as multiple groups of log data of the target IP packet attack, that is, the multiple groups of log data ranked at the bottom of the above attack event type ranked list are discarded and not analyzed, and only the top k items ranked at the top are meaningful; then extract the position information of the multiple groups of log data of multiple target IP packet attacks in the log file, and extract the timestamp information corresponding to each group of log data; associate the position information with the timestamp information, and when the position spacing of the log data associated with the two groups of position information is less than the standard group spacing distance and the time interval in the timestamp information is less than the standard attack duration of a single IP packet attack, it is determined that the above two groups of log data can constitute the same group of regional network attack events; and classify the same group of regional network attack events as log data of the key investigation area.

[0078] Step S4: performing similarity analysis on the log data included in the same group of regional network attack events to obtain key string information.

[0079] In an embodiment of the present invention, because the log data in the same group of regional network attack events are interrelated, similarity analysis is performed on the log data of the same group of regional network attack events, so that the key string information corresponding to the same group of regional network attack events, that is, the event characteristics of the same group of regional network attack events, can be extracted.

[0080] In this embodiment, the step of obtaining key character string information specifically includes:

[0081] Step S41: taking the log data included in the same group of regional network attack events as key regional log data for investigation;

[0082] Step S42: using the character string information corresponding to the attack event type to perform similarity analysis on multiple lines of log data belonging to the key investigation area log data;

[0083] Step S43: extracting character string information with a similarity greater than or equal to a preset similarity threshold as key character string information. Specifically, the preset similarity threshold is set based on an empirical value and is not specifically limited here.

[0084] In this embodiment, by targeting log data within the same group of regional network attack events as key regional log data, and then conducting further similarity analysis on multiple lines of log data belonging to this key regional log data, key string information can be determined for both the grouped log data and the same line of log data. By obtaining string information with a similarity greater than or equal to a preset similarity threshold as key string information, the specific attack content of the IP packet attack can be accurately identified. By analyzing key string information within the group and within the line of the same regional network attack events, and specifically performing similarity analysis on phrases and other strings within the group with string information belonging to standard IP packet network attack events, the vocabulary size for subsequent processing can be significantly reduced, while avoiding the problem of reduced analysis accuracy caused by mixing similarity analysis of two types. Furthermore, the dimensionality of the feature phrases is reduced, thereby reducing the computational complexity of log file classification.

[0085] Step S5: training a text classification model according to the key character string information, and using the trained text classification model to identify the log data to be tested of the attack event to obtain the attack event type corresponding to the log data to be tested.

[0086] Specifically, the steps of training a text classification model based on key string information include:

[0087] Step S51: performing a word segmentation operation on the key character string information to obtain the key character string information after word segmentation.

[0088] Specifically, each line of log data is separated by spaces. This is not a limitation and other word segmentation symbols may be used in actual processing. This is only used as an example and adaptive modifications may be made based on actual applications.

[0089] Step S52: performing keyword extraction on the segmented key character string information, and using the TF-IDF algorithm to obtain the inverse word frequency corresponding to each keyword.

[0090] Specifically, in this embodiment, the text-based logs must first be converted into features and data formats that can be recognized by machine learning. While various methods exist for this purpose, the present embodiment uses the common and easy-to-understand TF-IDF (Term Frequency-Inverse Document Frequency) algorithm. The TF-IDF algorithm is a commonly used weighting technique for information retrieval and data mining, often used to mine keywords from a group of regional cyberattack incidents and extract keywords within the same group. This simple and efficient algorithm can be used to determine the similarity between two documents.

[0091] Step S53: obtaining a target keyword and a tag set of the target keyword according to the reverse word frequency screening.

[0092] Specifically, the TF-IDF algorithm is directly proportional to the number of times a word appears in all texts and inversely proportional to the number of times it appears in all text lines. Therefore, the TF-IDF algorithm can, to a certain extent, characterize the importance of a word within the entire text; it should be noted that a word that appears in all texts is generally less important. This embodiment of the present invention uses the TF-IDF algorithm to calculate word frequency and inverse word frequency analysis to process the key string information within the current group of regional network attack events to obtain target keywords.

[0093] Step S54: constructing a feature matrix using target keywords whose tag similarity is greater than or equal to the basic tag threshold.

[0094] Specifically, the basic label threshold is set based on an empirical value and is not specifically limited here.

[0095] Step S55: After processing the feature matrix, the feature matrix is ​​input into the text classification model for training.

[0096] Specifically, the text classification model in the embodiment of the present invention is a general text classification model, such as the FastText model and the TextCNN model, which are only used as examples and are not intended to be limiting.

[0097] In a specific embodiment, firstly, a sample of the string information within the group corresponding to the same group of standard regional network attack events is extracted, and the sample is used as a typical sample or training sample. Then, the TF-IDF algorithm is used to process the string information within the group after word segmentation, and its typical sample is specifically processed to extract the keywords of the string information within the group or row of the same group of regional network attack events to which the key investigation area log data belongs. Then, the TF-IDF value corresponding to each keyword is calculated, and based on the TF-IDF value corresponding to the above keyword, the keyword greater than the preset fixed threshold is selected as the target keyword, and the label set of the target keyword is extracted; at the same time, the recognition results of the labels of multiple target keywords are summarized. It should be noted that each target keyword has multiple labels to form a multi-label set; for example: the label set of target keyword 1 is the IP message anomaly identification label, and the IP message anomaly identification label is missing. This is only used as an example, and adaptive modifications are made according to actual applications.

[0098] In this embodiment, by screening key character string information and subsequently segmenting and statistically processing the vocabulary to construct a feature matrix, the sample data dimension and the calculation of the text classification model can be reduced, further improving the recognition accuracy of the model.

[0099] In an embodiment of the present invention, after dividing the string information into multiple keywords and calculating the TF-IDF value, a standard machine learning matrix input is obtained, in which all non-repeated keywords constitute a word vector space. However, for a large amount of logs, the number of all non-repeated words is extremely large, which will cause the input matrix dimension to be extremely high and extremely sparse. Therefore, before inputting the feature matrix into the text classification model for training, it is also necessary to reduce the dimension of the string information to reduce the dimension of the log feature vector and improve the accuracy of the algorithm training. Specifically, the process of processing the feature matrix includes: taking the target keyword whose label similarity is greater than or equal to the basic label threshold as a high-similarity keyword; using a vectorizer to generate the word vector of the high-similarity keyword and composing it into a feature matrix; using a principal component analysis algorithm to reduce the dimension of the feature matrix to obtain a feature matrix after dimensionality reduction.

[0100] Specifically, the principal component analysis (PCA) algorithm is used for dimensionality reduction. First, the target keywords whose filtered label similarity is higher than the basic label threshold are regarded as high-similarity keywords within the group or row. This filtering itself has a dimensionality reduction effect. Then, in order to reduce the dimension of the feature matrix corresponding to the high-similarity keywords within the group or row from n dimensions to L dimensions, the embodiment of the present invention uses the PCA algorithm to calculate the feature matrix corresponding to the high-similarity keywords of the original data, and then performs a dimensionality reduction operation. This dimensionality reduction operation can alleviate the dimensionality explosion problem, further improve the efficiency of the operation and the recognition effect, improve the model training effect, and minimize information loss while compressing the data.

[0101] In this embodiment, after the text classification model is trained through the above steps, the log data to be tested is input into the model for identification to obtain the attack event type corresponding to the log data to be tested. The specific steps include: extracting the keywords to be tested from the character string information contained in the log data to be tested of the same group of network attack events; constructing a feature matrix corresponding to the keywords to be tested, inputting the feature matrix into the trained text classification model for identification, and obtaining the attack event type corresponding to the log data to be tested.

[0102] In a specific embodiment, a label similarity analysis and filtering is performed based on the label set of all target keywords, and the target keywords with label similarity higher than the basic label threshold are further filtered as keywords with high similarity within the group or row; a feature matrix is ​​constructed based on the keywords with high similarity within the group or row. Finally, the feature matrix is ​​input into the text classification model for training, and the keywords of the string information to be processed are classified based on the trained text classification model to obtain the corresponding recognition results. Among them, the keywords of the string information to be processed belong to the same group of regional network attack events to which the log data of the key investigation area belongs, specifically including the keywords of the string information within the group and within the row corresponding to the same group of regional network attack events. The above operation reduces the dimension of the log feature vector, thereby simplifying the dimensionality explosion caused by the training sample.

[0103] The machine learning-based attack event type identification method provided by the present invention distinguishes different types of network attack events through a text classification model, reduces the security risks of computer systems, and solves the problem in the prior art that computer systems have difficulty distinguishing different types of network attacks, posing huge security risks.

[0104] Example 2

[0105] The embodiment of the present invention provides a system for identifying attack event types based on machine learning, such as Figure 2 As shown, including:

[0106] The data acquisition module is used to obtain the attack event log file and the character string information corresponding to the attack event type; this module executes the method described in step S1 of embodiment 1, which will not be repeated here.

[0107] The first similarity analysis module is used to use the character string information corresponding to the attack event type to perform similarity analysis and similarity sorting on multiple lines of log data in the attack event log file to obtain a sorted list of attack event types; this module executes the method described in step S2 of Example 1 and will not be repeated here.

[0108] A log data extraction module is used to extract the first predetermined number of log data items from the attack event type sorted list, and use the first predetermined number of log data items to form the same group of regional network attack events; this module executes the method described in step S3 of Example 1, which will not be repeated here.

[0109] The second similarity analysis module is used to perform similarity analysis on the log data contained in the same group of regional network attack events to obtain key string information; this module executes the method described in step S4 of Example 1, which will not be repeated here.

[0110] A classification model training and identification module is used to train a text classification model based on the key string information, and use the trained text classification model to identify the log data to be tested of the attack event to obtain the attack event type corresponding to the log data to be tested; this module executes the method described in step S5 of Example 1 and will not be repeated here.

[0111] The machine learning-based attack event type identification system provided by the present invention can distinguish different types of network attack events and reduce security risks in computer systems.

[0112] Example 3

[0113] An embodiment of the present invention provides a computer device, such as Figure 3As shown, it includes: at least one processor 301, at least one communication interface 303, memory 304 and at least one communication bus 302. Among them, the communication bus 302 is used to realize the connection and communication between these components, the communication interface 303 may include a display screen and a keyboard, and the optional communication interface 303 may also include a standard wired interface and a wireless interface. The memory 304 can be a high-speed volatile random access memory, or a non-volatile memory, or at least one storage device located away from the aforementioned processor 301. The processor 301 can execute the method for identifying the type of attack event based on machine learning in Example 1. A set of program codes is stored in the memory 304, and the processor 301 calls the program code stored in the memory 304 to execute the method for identifying the type of attack event based on machine learning in Example 1.

[0114] The communication bus 302 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The fact that only one line is used does not mean that there is only one bus or one type of bus.

[0115] The memory 304 may include volatile memory, such as random access memory (RAM); the memory may also include non-volatile memory, such as flash memory, hard disk drive (HDD) or solid-state drive (SSD); the memory 304 may also include a combination of the above types of memory.

[0116] The processor 301 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP.

[0117] The processor 301 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0118] Preferably, the memory 304 is further configured to store program instructions. The processor 301 may call the program instructions to implement the method for identifying attack event types based on machine learning in Example 1 of the present invention.

[0119] An embodiment of the present invention further provides a computer-readable storage medium having computer-executable instructions stored thereon, which can execute the machine learning-based attack event type identification method of Example 1. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD); the storage medium can also include a combination of the aforementioned types of memory.

[0120] Obviously, the above embodiments are merely examples for clarity of explanation and are not intended to limit the implementation methods. Those skilled in the art will readily appreciate that other variations or modifications based on the above descriptions are possible. It is not necessary and impossible to enumerate all implementation methods here. Obvious variations or modifications arising therefrom remain within the scope of protection of the present invention.

Claims

1. A method for identifying attack event types based on machine learning, characterized in that: include: Get the attack event log file and the string information corresponding to the attack event type; Using the character string information corresponding to the attack event type, similarity analysis and similarity sorting are performed on multiple lines of log data in the attack event log file to obtain a sorted list of attack event types; Extracting a predetermined number of log data items from the attack event type sorted list, and using the predetermined number of log data items to form a same group of regional network attack events; Performing similarity analysis on the log data included in the same group of regional network attack events to obtain key string information; A text classification model is trained according to the key character string information, and the trained text classification model is used to identify the log data to be tested of the attack event to obtain the attack event type corresponding to the log data to be tested.

2. The method for identifying attack event types based on machine learning according to claim 1, characterized in that: The step of obtaining a ranked list of attack event types includes: Extracting character string information from multiple lines of log data in the attack event log file; Performing similarity matching on the character string information of the multiple lines of log data and the character string information corresponding to the attack event type to obtain similarities between the multiple lines of log data and the attack event type; The multiple lines of log data are sorted by similarity according to the similarity, to obtain a sorted list of attack event types to which the multiple lines of log data belong.

3. The method for identifying attack event types based on machine learning according to claim 1, characterized in that: The step of using the previously predetermined number of log data items to form a same group of regional network attack events includes: Using a predetermined number of log data items as multiple sets of log data corresponding to the attack event type; Extract the location information of each set of log data in the log file and its corresponding timestamp information, and associate the location information and timestamp information of each set of log data; A judgment is made on whether the associated log data can form the same group of regional network attack events. If the location interval of the location information of the associated log data is less than or equal to the standard interval and the time interval of the timestamp information is less than or equal to the duration of a single attack, the associated log data are formed into the same group of regional network attack events.

4. The method for identifying attack event types based on machine learning according to claim 3, characterized in that: The step of obtaining the key character string information includes: The log data included in the same group of regional network attack events is used as the key regional log data for investigation; Performing similarity analysis on multiple lines of log data belonging to the key investigation area log data using the character string information corresponding to the attack event type; String information with a similarity greater than or equal to a preset similarity threshold is extracted as key string information.

5. The method for identifying attack event types based on machine learning according to claim 4, characterized in that: The step of training a text classification model according to the key string information includes: Performing a word segmentation operation on the key character string information to obtain the key character string information after word segmentation; Perform keyword extraction on the segmented key string information, and use the TF-IDF algorithm to obtain the inverse word frequency corresponding to each keyword; Obtaining a target keyword and a tag set of the target keyword according to the reverse word frequency screening; Construct a feature matrix using target keywords whose tag similarity is greater than or equal to the basic tag threshold; After processing, the feature matrix is ​​input into the text classification model for training.

6. The method for identifying attack event types based on machine learning according to claim 5, characterized in that: The process of processing the feature matrix includes: The target keyword whose tag similarity is greater than or equal to the basic tag threshold is regarded as a high-similarity keyword; Using a vectorizer to generate word vectors for the high-similarity keywords and composing them into a feature matrix; The principal component analysis algorithm is used to reduce the dimension of the feature matrix to obtain the reduced dimension feature matrix.

7. The method for identifying attack event types based on machine learning according to claim 6, characterized in that: The step of obtaining the attack event type corresponding to the log data to be tested includes: Extracting keywords to be tested from character string information contained in the log data to be tested of the same set of network attack events; A feature matrix corresponding to the keywords to be tested is constructed, and the feature matrix is ​​input into a trained text classification model for identification to obtain the attack event type corresponding to the log data to be tested.

8. A system for identifying attack event types based on machine learning, characterized in that: include: The data acquisition module is used to obtain the attack event log file and the string information corresponding to the attack event type; A first similarity analysis module is configured to perform similarity analysis and similarity sorting on multiple lines of log data in the attack event log file using character string information corresponding to the attack event type to obtain a sorted list of attack event types; a log data extraction module, configured to extract a predetermined number of log data items from the attack event type sorted list, and use the predetermined number of log data items to form a same group of regional network attack events; A second similarity analysis module is used to perform similarity analysis on the log data contained in the same group of regional network attack events to obtain key string information; The classification model training and identification module is used to train a text classification model according to the key string information, and use the trained text classification model to identify the log data to be tested of the attack event to obtain the attack event type corresponding to the log data to be tested.

9. A computer device, characterized in that: include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to cause the at least one processor to perform the method for identifying attack event types based on machine learning as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method for identifying attack event types based on machine learning as described in any one of claims 1 to 7.

Images