Network behavior abnormity detection method based on LSTM

Abstract

The invention discloses a network behavior abnormity detection method based on LSTM. Firstly, network traffic data is collected and converted into a user behavior sequence according to the definition of user behaviors, and then the difference between network user main body behavior modes is considered, so that the user behavior sequence is classified according to a k-center point algorithm. Thirdly, the classified behavior sequence data is taken as the input of an LSTM long-short-term memory network, and a neural network model is trained in combination with an Attention mechanism; and finally, a to-be-detected behavior sequence is predicted through the trained model to determine the abnormal degree of the to-be-detected behavior sequence. According to the invention, the network traffic data is processed from the perspective of behaviors; the incidence relation between internal factors can be fully considered; a network behavior mode is established to distinguish user behaviors, then a manual feature extraction method adopted by traditional network anomaly detection is broken through, anomaly information is distinguished by combining the development fitting effect of an LSTM long-short-term memory network on large-scale network behavior sequence data streams, and the accuracy and efficiency of network anomaly detection are remarkably improved.

Description

technical field [0001] The invention belongs to the technical field of network security, and more specifically relates to an LSTM-based method for detecting abnormal network behavior. Background technique [0002] With the rapid development of the global network information industry, various data interactions are becoming more and more frequent. Today, when computers are more and more integrated into people's lives, people are increasingly inseparable from the Internet. In particular, the rise of the mobile Internet in recent years has brought people into the era of network information. However, in an increasingly complex network environment, attacks against network entities are becoming more and more frequent, and attack methods are becoming more and more diversified and complex. It will cause information leakage, network paralysis, and huge economic losses. Therefore, how to detect abnormal network behaviors in an efficient and accurate manner is very important for both ...

AI Technical Summary

Problems solved by technology

The LSTM algorithm has been widely used in many artificial intelligence fields such as machine translation, sentiment analysis, image analysis, document summarization, speech recognition, and recommendation systems. Applications are still in their infancy for LSTM networks

Images