Method for extracting network interactive behavioral pattern and analyzing similarity

Abstract

The invention discloses a method for extracting a network interactive behavioral pattern and analyzing similarity, which comprises the following steps: the behavior of a network activity implementer is monitored on a honey-pot host computer; the captured journal information is transmitted to a journal server; the journal server associates journals to a behavior sequence belonging to a particular network activity implementer according to the source address and the process information in the journal information; the behavior sequence of the network activity implementer is pretreated before sequence pattern excavation; the behavior sequence data of the pretreated network activity implementer is processed by the sequence excavation; and the similarity between the network activity implementers is analyzed. By analyzing the similarity between the different network activity implementers, the network activity implementers are deeply associated and researched, which has a certain help for judging the purpose of the network activity implementers, adopting corresponding counter-measure for behaviors such as network attack and the like and obtaining the evidence of network attack.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a method for extracting interactive behavior patterns of network activity implementers and similarity analysis between different network activity implementers. Background technique [0002] With the rapid development of the Internet, its characteristics of openness, interactivity, and decentralization meet people's needs for information sharing, openness, flexibility, and speed. But at the same time, with the continuous expansion of the network scale, there are more and more attacks on the network, which has seriously threatened the security of the network and information. [0003] In the current security situation of the Internet, an asymmetric game is going on between attackers and defenders, especially the information asymmetry. Therefore, security managers first need to have an in-depth understanding of attackers, including their attack techniques, skills and tactics...

AI Technical Summary

Problems solved by technology

[0011] However, these methods only use sequential patterns to detect attack behaviors, and when there are multiple attack sources, these methods cannot analyze the relationship between different sources

Images