Attack mode detection method based on event slide window

Abstract

The invention relates to an attack mode detection method based on an event slide window. The method comprises the steps of S1, normalizing, integrating, compressing and preprocessing warning information, and aggregating the warning information with approximate attribute similarity into super warning; S2, carrying out protocol on frequent items, thereby obtaining frequent correlation sequence patterns according to a causal correlation matrix; S3, for the new frequent correlation sequence patterns at each time and warning pairs of the frequent correlation sequence patterns with different attributes, carrying out weight average on the participating attributes; and S4, generating an attack pattern graph consistent with invasion characteristics. According to the method, attack patterns existing in warning logs can be mined efficiently and accurately, new invasion access behaviors can be identified or intercepted rapidly, and the accuracy and speed of mining the attack patterns in the massive and seemingly meaningless warning logs can be greatly improved.

Description

technical field [0001] The invention relates to the application of data mining in the fields of network attack identification and the like, specifically an attack mode detection method based on an event sliding window. Background technique [0002] The emergence and popularization of distributed computing provides convenient operations for processing massive data. At the same time, network security is also an issue of concern in various fields. The number of resources and threats to key information in the network environment is rising sharply. How to conduct distributed analysis through relevant data and actively respond to network attacks has become a research hotspot in the field of network security in recent years. The assessment of network security situation by analyzing log files has been more and more widely recognized. [0003] However, in the current distributed log association analysis and other analysis systems, the security analysis is performed on known and vis...

AI Technical Summary

Problems solved by technology

[0003] However, in the current distributed log association analysis and other analysis systems, the security analysis is performed on known and visible small-scale data blocks, but it is necessary to deal with the current continuously updated and massive log files, especially log streams. In a heterogeneous network environment, its tools and analysis methods are not good enough for collection and analysis tasks, and it lacks a comprehensive analysis of the overall log data, and cannot respond to log analysis and security protection in a timely manner

Images