APT attack detection method

Abstract

The invention discloses an advanced persistent threat APT attack detection method. A semi-supervised learning algorithm is used to mark data having similar characteristics, and a small quantity of marked data are used to generate a large-scale training data set, and then an information gain ratio is introduced to determine the degrees of the influences of the different characteristics on detection. The information gate ratio is used for characteristic extraction of every sub-data set in a detection model, and accurate identification of unknown attacks is realized. An improved k-means algorithm is used to mark the data having the similar characteristics, and on the basis of the small quantity of marked data, the accurate marking of a lot of training data sets is realized, and therefore the detection accuracy of the model is guaranteed; and by introducing the information gain ratio in the model, the degrees of the influences of the different characteristics on the detection are determined, and influences of redundancy and noise characteristics in the data are reduced, and therefore important flow characteristics are selected, the generalization capability of the detection model is improved to detect the unknown attacks.

Description

Technical field [0001] The invention belongs to the field of network security, and particularly relates to an APT attack detection method. Background technique [0002] Advanced persistent threats are a new type of organized, targeted, and extremely long-lasting attack. With the exposure of Stuxnet, Duqu, Flame and Killdisk attacks against Ukrainian power plants in 2015, it can be seen that APT attacks pose a huge threat to the security of various industrial control networks and critical information infrastructure. The main goal of APT attacks is to steal confidential information such as military agencies, government agencies, national infrastructure, and high-tech enterprises or cause designated damage. Its characteristics mainly have the following two points: (1) Advanced attack methods. Attackers often use unknown attacks such as 0day vulnerabilities to invade, such as the attack on Iran's nuclear power plant. Attackers have used Flame virus, Stuxnet virus, Duqu virus and ot...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a method for APT attack detection, aiming to solve the problems of too little artificially marked data for training and detection models in the current machine learning-based APT attack detection, and difficult selection of traffic characteristics of unknown attacks

Images