An automated network attack classification and trapping system based on ensemble learning

Abstract

The present invention relates to the technical field of network security attack defense, and discloses an automated network attack classification and trapping system based on ensemble learning. The system comprises a network attack trapping module for building a network attack trapping subsystem; a monitoring module for monitoring the network attack trapping subsystem; a control module for transmitting system call logs obtained by the monitoring module from the network attack trapping subsystem to an automatic attack classification module, and for rolling back and restoring the network attack trapping subsystem damaged by the attacker; an automatic attack classification module for converting the system call logs into triples and abstracting them, then extracting text word frequency features and performing data enhancement in the numerical dimension; performing feature selection on the enhanced data, and using different classifiers to select corresponding feature subsets for training sub-classifiers; using the prediction results of the sub-classifiers to train a meta-classifier; and using the meta-classifier to generate classification results. The present invention can significantly improve classification accuracy.

Description

Technical Field

[0001] The present invention relates to the technical field of network security attack defense, and in particular to an automated network attack classification and trapping system based on ensemble learning. Background Art

[0002] Machine learning is playing an increasingly important role in various fields, and automated attack technologies based on machine learning are constantly emerging. Traditional passive defense technologies are struggling to keep up with attackers. To transform passive defense into active defense, quickly detect and respond to attacks when they occur, and collect information on attacker behavior, the development and application of network attack deception systems are essential.

[0003] Cyberattack trapping systems, also known as intelligent honeynet systems, are active defense strategies that can effectively detect new attacks and have attracted extensive research. Shan et al. (Shan, Y., Yao, Y., Zhao, T., Yang, W., 2023. Neupot: A neural network-based honeypot for detecting cyberthreats in industrial control systems.) designed a new time series prediction model based on the Modbus framework, enhancing the honeypot's interactivity and threat detection capabilities. Bardi et al. (Bardi, S., Conti, M., Pajola, L., Tricomi, PP, 2023. Social honeypot for humans: Luring people through self-managed Instagram pages, in: Tibouchi, M., Wang, X. (Eds.), Applied Cryptography and Network Security, Springer Nature Switzerland, Cham. pp. 309–336.) proposed a social honeypot framework that automatically generates content, aiming to capture spam and malicious bot activity on the internet. Sheng et al. (Sheng, C., Yao, Y., Fu, Q., Yang, W., Liu, Y., 2021. Study on the intelligent honeynet model for containing the spread of industrial viruses. Comput. Secur. 111, 102460.) proposed a novel intelligent honeynet mathematical model that combines intelligent honeynet with traditional defense mechanisms to prevent the spread of industrial viruses in data acquisition networks (SCADA), providing active and dynamic system-level and network-level defense.Tan L et al. (Tan, L., Yu, K., Ming, F., Cheng, X., Srivastava, G., 2022. Secure and resilient artificial intelligence of things: A honeynet approach for threat detection and situational awareness. IEEE Consum. Electron. Mag. 11, 69–78.) proposed a honeynet framework that combines threat detection and situational awareness for the artificial intelligence of things (AIoT). This framework uses Docker technology to build a honeynet environment, which can improve the security and resilience of AIoT. Franco J et al. (Franco J, Aris A, Babun L, et al. S-Pot: A Smart Honeypot Framework with Dynamic Rule Configuration for SDN[C] / / GLOBECOM 2022-2022 IEEE Global Communications Conference. IEEE, 2022: 2818-2824.) proposed an open source smart honeypot framework called S-Pot, which uses machine learning to learn attack behaviors and dynamically configure SDN rules. In recent years, research on the application of honeypots and honeynets in cloud environments has also been increasing. Marydas M et al. (Marydas, M., Priyah, J.V., 2019. A cloud-based honeynet system for attack detection using machine learning techniques. IRJET 6, 330–335.) used attack traffic captured in a honeynet in a cloud environment to train a machine learning model. This model can be used to detect attack traffic on protocols such as FTP and SSH. H et al. ( H., Dionysiou, I., 2015. Cloudhoneycy-an integrated honeypot framework for cloud infrastructures, in: Proc. IEEE Intl. Conf. Utility Cloud Comput., IEEE. pp. 630–635.) proposed an open source honeypot framework, CloudHoneyCY, which supports the deployment of a collection of high-interaction honeypots and low-interaction honeypots to collect and analyze attack data in cloud environments. Gill KS et al. (Gill, KS, Saxena, S., Sharma, A., 2020. Gtm-csec: Game theoretic model for cloud security based on ids and honeypot. Comput. Secur. 92, 101732.) proposed a game theoretic model GTM-CSec, which can intelligently select the most appropriate module to detect attacks, improving the overall efficiency of the defense system. Sivamohan S et al. (Sivamohan, S., Sridhar, S., Krishnaveni, S., 2022. Efficient multi-platform honeypot for capturing real-time cyber attacks, in: Proc. Int. Conf. Intell. Data Commun. Technol. Internet Things. Springer, pp. 291–308.) proposed an IDS active protection architecture based on Docker containers and honeynets. The architecture uses the T-Pot open source honeypot platform to host the honeypot network and provide active threat detection in the cloud environment infrastructure.

[0004] In summary, whether in cloud environments or the IoT, existing research focuses on enhancing the capture capabilities of network attack trapping systems to achieve better detection results. Automatic attack classification after attack trapping is a pressing issue facing these systems. A high-performance automatic attack classification method can help network security personnel quickly identify attacks and take appropriate measures. Summary of the Invention

[0005] In response to the above-mentioned deficiencies in the prior art, the present invention provides an automated network attack classification and trapping system based on ensemble learning to solve the problem that the existing system relies on manual analysis after capturing attack behaviors and lacks the ability to automatically analyze attack behaviors.

[0006] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0007] An automated network attack classification and trapping system based on ensemble learning, comprising:

[0008] The network attack trapping module is used to build a network attack trapping subsystem to simulate the real system environment to trap attackers;

[0009] The monitoring module is used to monitor the network attack trapping subsystem status, system call logs, interactive commands, and network access;

[0010] The control module is used to transmit the system call log obtained by the monitoring module from the network attack trapping subsystem to the automatic attack classification module, and to roll back and restore the network attack trapping subsystem destroyed by the attacker;

[0011] The automatic attack classification module is used to convert system call logs into triples and abstract them, then extract text word frequency features and perform data augmentation in the numerical dimension; feature selection is performed on the augmented data, and different classifiers are used as feature evaluators to select feature subsets suitable for different models to train sub-classifiers, and the prediction results of the sub-classifiers are used to train the meta-classifier, which is then used to generate classification results.

[0012] Furthermore, the target machines of the network attack trapping subsystem include Tomato, Cereal-1, Code:1 and Kioptrix level 1, the systems include Ubuntu, Centos and Rockylinux, the services include FTP, HTTP, SSH and MYSQL, and the vulnerabilities include sensitive information leakage, file inclusion vulnerabilities, deserialization vulnerabilities, soft link privilege escalation and SQL injection vulnerabilities.

[0013] Furthermore, the monitoring information acquired by the monitoring module includes the basic status of the target machine, interactive commands, remote access, file access and modification information, rebound shell, login log and system call log.

[0014] Furthermore, the automatic attack classification module converts the system call log into triples including:

[0015] The feature fields of parent process name, operation type and operation object are extracted from the system call log, and a triple is constructed based on the feature fields of parent process name, operation type and operation object.

[0016] Furthermore, the automatic attack classification module abstracts the triples including:

[0017] First, each field in the triple is classified, and then each triple is abstracted into different specific actions according to the classification of each field.

[0018] Furthermore, the automatic attack classification module extracts text word frequency features from triples, including:

[0019] First, the triple is converted into a feature vector containing the number of times each word appears in the text. Then, the TF-IDF value is calculated based on the number of times each word appears in the text. Finally, the TF-IDF value is used to weight the feature vector to obtain the text word frequency feature.

[0020] Furthermore, calculating the TF-IDF value based on the number of occurrences of each word in the text includes:

[0021] Calculate the TF value based on the number of times each word appears in the text;

[0022] Calculate the IDF value based on the total number of texts and the number of texts containing the word;

[0023] The TF-IDF value is calculated by multiplying the TF value and the IDF value.

[0024] Furthermore, the TF value is calculated as follows:

[0025]

[0026] Among them, tf(s,d) represents the TF value, n s Indicates the number of times word s appears in text d, n i represents the number of times the i-th word appears in the text d, and n represents the total number of words.

[0027] Furthermore, the IDF value is calculated as follows:

[0028]

[0029] Among them, idf(s) represents the IDF value, N represents the total number of texts, df s Indicates the number of texts containing word s.

[0030] Furthermore, the automatic attack classification module performs data enhancement on the text word frequency feature in the numerical dimension, including:

[0031] A data augmentation model is trained separately for each type of text word frequency feature sample. Each data augmentation model includes an encoder, a multi-layer perceptron and a decoder. The encoder is used to learn the mean vector and standard deviation vector of the original sample. The multi-layer perceptron is used to calculate the positive diagonal coefficients and then update the latent space in combination with the normalized flow of the Riemann Hamiltonian equation. The decoder is used to decode the latent space into an approximation of the original sample to obtain the data augmentation result.

[0032] The present invention has the following beneficial effects:

[0033] (1) The present invention processes the system call logs of the network attack trapping system into triples for abstraction, and performs data enhancement on this basis, thereby solving the problem that the network attack trapping system lacks system logs that reflect different attack behaviors.

[0034] (2) The present invention proposes a stacking model that combines different classifiers with different features. Compared with the traditional model that directly uses text sequence or word frequency features for training, this model combines ensemble learning, where each sub-classifier is trained with different features, and the prediction results of the sub-classifier are used to train the meta-classifier, which can significantly improve the classification accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a schematic diagram of the structure of an automated network attack classification and trapping system based on ensemble learning;

[0036] Figure 2 Schematic diagram of data augmentation;

[0037] Figure 3 Schematic diagram of Stacking classification model training. DETAILED DESCRIPTION

[0038] The specific embodiments of the present invention are described below to facilitate understanding of the present invention by those skilled in the art. However, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the appended claims, these changes are obvious, and all inventions and creations utilizing the concepts of the present invention are protected.

[0039] like Figure 1 As shown, an embodiment of the present invention provides an automated network attack classification and trapping system based on ensemble learning, comprising:

[0040] The network attack trapping module is used to build a network attack trapping subsystem to simulate the real system environment to trap attackers;

[0041] The monitoring module is used to monitor the network attack trapping subsystem status, system call logs, interactive commands, and network access;

[0042] The control module is used to transmit the system call log obtained by the monitoring module from the network attack trapping subsystem to the automatic attack classification module, and to roll back and restore the network attack trapping subsystem destroyed by the attacker;

[0043] The automatic attack classification module is used to convert system call logs into triples and abstract them, then extract text word frequency features and perform data augmentation in the numerical dimension; feature selection is performed on the augmented data, and different classifiers are used as feature evaluators to select feature subsets suitable for different models to train sub-classifiers, and the prediction results of the sub-classifiers are used to train the meta-classifier, which is then used to generate classification results.

[0044] In an optional embodiment of the present invention, this embodiment uses Vulnhub to build a decoy subsystem. Four Vulnhub target machines are used, covering operating systems such as Ubuntu, CentOS, and RockyLinux, and services such as FTP, HTTP, SSH, and MySQL. Vulnerabilities include sensitive information leakage, file inclusion vulnerabilities, deserialization vulnerabilities, soft link privilege escalation, and SQL injection vulnerabilities. These virtual machines encompass most systems and services, faking a real production environment.

[0045] Vulnhub is an open-source vulnerability testing platform that provides a large number of virtual machine images for testing various attack and defense technologies. These targets already meet the camouflage requirements of the decoy system, that is, they can disguise real systems, but lack monitoring and recording capabilities and cannot monitor and record the attacker's behavior and methods. In order to meet the requirements, these target machines need to be adjusted. These target machines are complete system images and do not provide a root password. Therefore, after importing the target machine image into VMware, you must first enter the system's boot parameter interface and forcibly change the target machine's root password. After changing the password, you need to enter the target machine and install some necessary software such as sysdig for monitoring system call logs and filebeat for monitoring log files and pushing them to ELK. Table 1 lists the target information of the network attack decoy module:

[0046] Table 1

[0047]

[0048] In an optional embodiment of the present invention, a monitoring module based on the ELK framework and a control module are used to coordinate the trapping subsystem and the automatic attack classification module. The monitoring module monitors seven types of system information: basic status of the target machine, interactive commands, remote access, file access and modification information, rebound shells, login logs, and system call logs. The control module transmits the system call logs obtained from the trapping subsystem to the automatic attack classification module for attack classification. The results are then sent to the ELK for visualization and storage, generating attack reports and performing rollback and recovery of honeypot systems compromised by attackers.

[0049] This embodiment uses the ELK open source framework to implement a monitoring module to monitor attack behaviors occurring in the trapping system. ELK consists of four components: filebeat is a lightweight log collection component used to collect and transmit log data from various sources to a centralized log storage and analysis system; logstash is an open source data collection and processing engine that can collect data from various data sources, convert data formats, and transmit data to the target system. It has powerful processing capabilities, supports multiple data format conversions and filtering, and can also perform data aggregation and statistical analysis as needed; elasticsearch is a distributed, open source full-text search engine and analysis engine. It uses an inverted index and sharding mechanism to quickly and accurately search and analyze large amounts of data, meeting performance requirements in various scenarios; kibana is an open source data visualization tool used for real-time data analysis and visualization of data stored in Elasticsearch. It can convert data into various visual charts and dashboards, allowing users to more intuitively understand data and trends. Table 2 lists the information to be monitored in detail.

[0050] Table 2

[0051]

[0052] In an optional embodiment of the present invention, the automatic attack classification module converts the system call log into a triplet including:

[0053] The feature fields of parent process name, operation type and operation object are extracted from the system call log, and a triple is constructed based on the feature fields of parent process name, operation type and operation object.

[0054] This embodiment uses GrAALF to filter and simplify the system call log and extract the key 6 fields. The fields contained in the processed system call log are: user (user name), from_id (parent process number), from_name (parent process name), evt_type (operation type), to_name (operation object, including process, file and remote IP, etc.), to_id (operation object process number, etc.). In the processed system call log, the three fields of from_name, evt_type, and to_name contain the key information of a system call log, namely "what operation a certain process did". For example, ["from_name": "init", "env_type": "exec", "to_name": "sshd"] means that the init process runs the executable file sshd. Therefore, the three fields (from_name, evt_type, to_name) are called system call log triples here, that is, each log can be represented by this triple.

[0055] In an optional embodiment of the present invention, the automatic attack classification module abstracts the triples including:

[0056] First, each field in the triple is classified, and then each triple is abstracted into different specific actions according to the classification of each field.

[0057] Obviously, due to the existence of various programs with similar but different functions, many different triples represent similar meanings. For example, (nano, write, file) and (vi, write, file) both represent document editing, and (ftp, recv, ip) and (samba, recv, ip) both represent downloading files from a remote host. Therefore, triples need to be abstracted, and different triples representing similar meanings are abstracted into the same type of operation. This abstraction process is similar to part-of-speech tagging in NLP, where different words share the same attributes.

[0058] This embodiment uses a rule-based approach to abstract triples. First, each field in the triple is classified, as shown in Table 3. From_name is divided into 12 major categories. For example, file_ops includes file operations such as chatter, cp, and chmod, and system_server includes common system services such as myqld, ftpd, and sshd. evt_type is divided into nine major categories, such as file reading and writing, socket operations, and process communication. To_name is divided into four categories: process, ip_address, unknow_process, and file_name. Based on these categories, the triple is then abstracted into a specific action based on custom rules. For example, (bash, exec, any process) represents bash_start_process, which indicates opening a process via bash; (file_edit, file_write_read, file_name) represents file_edit, which refers to editing a file; and (system_server, socket_ops, ip_address) represents server_download_upload, which refers to the system service downloading or uploading a file.

[0059] Table 3

[0060]

[0061] Finally, a total of 54 abstract actions were classified. Table 4 lists the abstract actions of this embodiment in detail.

[0062] Table 4

[0063]

[0064]

[0065] In an optional embodiment of the present invention, the automatic attack classification module extracts text word frequency features from triples, including:

[0066] First, the triple is converted into a feature vector containing the number of times each word appears in the text. Then, the TF-IDF value is calculated based on the number of times each word appears in the text. Finally, the TF-IDF value is used to weight the feature vector to obtain the text word frequency feature.

[0067] The automatic attack classification module performs data enhancement on the text word frequency feature in the numerical dimension, including:

[0068] A data augmentation model is trained separately for each type of text word frequency feature sample. Each data augmentation model includes an encoder, a multi-layer perceptron and a decoder. The encoder is used to learn the mean vector and standard deviation vector of the original sample. The multi-layer perceptron is used to calculate the positive diagonal coefficients and then update the latent space in combination with the normalized flow of the Riemann Hamiltonian equation. The decoder is used to decode the latent space into an approximation of the original sample to obtain the data augmentation result.

[0069] The data enhancement technology proposed in this embodiment includes two modules: word frequency feature extraction and data enhancement. Due to the small number of training samples, the trained model may be overfitted or underfitted. The present invention performs data enhancement on the extracted text numerical features to expand the data set and thus improve the model's capabilities. However, in the application environment of the present invention, it is very difficult to directly perform data enhancement on the attack sequence text. To generate high-quality text data, it is necessary to use a pre-trained model trained with a large amount of data, which is very difficult to achieve. Therefore, the present invention does not directly enhance at the text level, but first extracts the word frequency features of the text, and then performs data enhancement on the dimension of the numerical features.

[0070] This embodiment uses scikit-learn's CountVectorizer and TfidfTransformer to extract the word frequency features of the text. This embodiment uses CountVectorizer to convert the original text into a vector containing the number of times each word appears in the text. The parameter n-gram value in TfidfTransformer will affect the conversion effect. This embodiment will verify the optimal value of n-gram in the experiment. TF-IDF can reflect the importance of a word or a phrase in a text. It consists of two parts: TF (Term Frequency) and IDF (Inverse Document Frequency). The TF value is calculated as follows:

[0071]

[0072] Among them, tf(s,d) represents the TF value, n s Indicates the number of times word s appears in text d, n i represents the number of times the i-th word appears in the text d, and n represents the total number of words;

[0073] The IDF value is calculated as follows:

[0074]

[0075] Among them, idf(s) represents the IDF value, N represents the total number of texts, df s Indicates the number of texts containing word s;

[0076] Finally, TF-IDF can be expressed as: TF-IDF = tf(s, d) × idf(s). It reflects the importance of a word or phrase in a text and is effective in filtering out noisy words. This embodiment uses TF-IDF to process the resulting vector, considering the frequency of a word in the entire text, penalizing high-frequency words and weighting low-frequency words, thereby obtaining a more discriminative feature vector.

[0077] After extracting the word frequency features, data enhancement is required. This embodiment uses RHVAE to enhance small sample data. In order to control the number of samples of each category generated, this embodiment trains a model for each category of samples separately. Figure 2 As shown in the figure, the whole model consists of three neural network models. The encoder is a 4166→500→10 model with ReLU activation function, which will learn the mean vector μ and standard deviation vector σ of the original sample. Another MLP (multi-layer perceptron) model structure is 4166→400→10, which is used to calculate the diagonal coefficients, and then combined with To update the latent space d as the final latent vector input to the decoder, It uses a normalized flow of Riemannian Hamiltonian equations. The decoder is a 10→500→4166 model (with ReLU and Sigmoid activation functions), decoding the latent space d into an approximation of the input data to achieve data augmentation.

[0078] In an optional embodiment of the present invention, a stacking classification model is proposed that combines different classifiers with different features. Traditional machine learning methods are not effective in processing complex data such as imbalanced, high-dimensional, and noisy data. Augmented data is high-dimensional and sparse. Including too many features in the model will lead to overfitting, making the model too complex and performing poorly on new data. Therefore, this embodiment first performs feature selection, using SVM, KNN, and DT as feature evaluators of MP-MOABC, and selects three sets of feature subsets S that are suitable for different models. SVM 、S KNN and S DT . Among them S SVM Contains 1822 features, S KNN Contains 1206 features, S DT It contains 879 features, which is a significant reduction compared to the original 4166 features.

[0079] SVM, KNN, and DT are classic classification algorithms with considerable classification efficiency and results. This embodiment selects them as sub-classifiers and DT as a meta-classifier. After feature selection, this embodiment divides the data set into a training set and a test set in a ratio of 4:1 to enhance the generalization ability of the model. For each sub-classifier, this embodiment uses five-fold cross-validation during the training process to prevent the model from overfitting. The sub-classifier is trained using a feature subset selected by feature selection. Each sub-classifier will produce five prediction results. The training results of the three sub-classifiers are superimposed together as the training input of the meta-classifier. The test set is input into the corresponding sub-classifier, and the results obtained by each classifier are superimposed together as the test set of the meta-classifier. Finally, a Stacking classification model combining different classifiers with different features is trained, such as Figure 3 shown.

[0080] Augmented data is high-dimensional and sparse, and including too many features in the model can lead to overfitting, making the model too complex and performing poorly on new data. Therefore, augmented data cannot be used directly for model training. Feature selection can reduce the number of features, prevent overfitting, and improve the model's generalization ability. Therefore, each subclassifier is trained using a selected subset of features.

[0081] The present invention processes the system call logs of the network attack trapping system into triples for abstraction, and performs data enhancement on this basis, thereby solving the problem of lack of system logs reflecting different attack behaviors in the network attack trapping system.

[0082] This paper proposes a stacking model that combines different classifiers with different features. Compared with traditional models that directly use text sequence or word frequency features for training, this model combines ensemble learning. Each sub-classifier is trained with different features, and the prediction results of the sub-classifier are used to train the meta-classifier, which can significantly improve classification accuracy.

[0083] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0084] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0085] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0086] Specific embodiments are used in the present invention to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

[0087] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and it should be understood that the scope of protection of the present invention is not limited to such specific descriptions and embodiments. Those skilled in the art can make various other specific variations and combinations based on the technical teachings disclosed in the present invention without departing from the essence of the present invention, and such variations and combinations are still within the scope of protection of the present invention.

Claims

1. An automated network attack classification and trapping system based on ensemble learning, characterized by: include: The network attack trapping module is used to build a network attack trapping subsystem to simulate the real system environment to trap attackers; The monitoring module is used to monitor the network attack trapping subsystem status, system call logs, interactive commands, and network access; The control module is used to transmit the system call log obtained by the monitoring module from the network attack trapping subsystem to the automatic attack classification module, and to roll back and restore the network attack trapping subsystem destroyed by the attacker; The automatic attack classification module converts system call logs into triples and abstracts them. It then extracts text word frequency features and performs data augmentation in the numerical dimension. Feature selection is performed on the augmented data, and different classifiers are used as feature evaluators. Feature subsets suitable for different models are selected to train sub-classifiers. The prediction results of the sub-classifiers are used to train a meta-classifier, which then generates classification results. The automatic attack classification module converts the system call log into a triplet, comprising: extracting characteristic fields of the parent process name, operation type, and operation object from the system call log, and constructing a triplet based on the characteristic fields of the parent process name, operation type, and operation object; The automatic attack classification module abstracts the triples by first classifying each field in the triples, and then abstracting each triple into different specific actions according to the classification of each field.

2. The automated network attack classification and trapping system based on ensemble learning according to claim 1 is characterized in that: The target machines of the network attack trapping subsystem include Tomato, Cereal-1, Code:1 and Kioptrix level 1, the systems include Ubuntu, Centos and Rockylinux, the services include FTP, HTTP, SSH and MYSQL, and the vulnerabilities include sensitive information leakage, file inclusion vulnerabilities, deserialization vulnerabilities, soft link privilege escalation and SQL injection vulnerabilities.

3. The automated network attack classification and trapping system based on ensemble learning according to claim 1 is characterized in that: The monitoring information acquired by the monitoring module includes the basic status of the target machine, interactive commands, remote access, file access and modification information, rebound shell, login log and system call log.

4. The automated network attack classification and trapping system based on ensemble learning according to claim 1, characterized in that: The automatic attack classification module extracts text word frequency features from triples, including: First, the triple is converted into a feature vector containing the number of times each word appears in the text. Then, the TF-IDF value is calculated based on the number of times each word appears in the text. Finally, the TF-IDF value is used to weight the feature vector to obtain the text word frequency feature.

5. The automated network attack classification and trapping system based on ensemble learning according to claim 4 is characterized in that: Calculating the TF-IDF value based on the number of occurrences of each word in the text involves: Calculate the TF value based on the number of times each word appears in the text; Calculate the IDF value based on the total number of texts and the number of texts containing the word; The TF-IDF value is calculated by multiplying the TF value and the IDF value.

6. The automated network attack classification and trapping system based on ensemble learning according to claim 5, characterized in that: The TF value is calculated as follows: Among them, tf(s,d) represents the TF value, n s Indicates the number of times word s appears in text d, n i represents the number of times the i-th word appears in the text d, and n represents the total number of words.

7. The automated network attack classification and trapping system based on ensemble learning according to claim 5, characterized in that: The IDF value is calculated as follows: Among them, idf(s) represents the IDF value, N represents the total number of texts, df s Indicates the number of texts containing word s.

8. The automated network attack classification and trapping system based on ensemble learning according to claim 1 is characterized in that: The automatic attack classification module performs data enhancement on the text word frequency feature in the numerical dimension, including: A data augmentation model is trained separately for each type of text word frequency feature sample. Each data augmentation model includes an encoder, a multi-layer perceptron and a decoder. The encoder is used to learn the mean vector and standard deviation vector of the original sample. The multi-layer perceptron is used to calculate the positive diagonal coefficients and then update the latent space in combination with the normalized flow of the Riemann Hamiltonian equation. The decoder is used to decode the latent space into an approximation of the original sample to obtain the data augmentation result.

Images