Attack traffic classification method based on SVM

Abstract

The invention discloses an attack traffic classification method based on SVM. The method comprises the steps: giving Nt as a training sample in malicious traffic detection, and enabling a single sample xi to belong to Rd and represent a d-dimensional network traffic; in the flow classification step, a decision function f (x) = wx + b is solved in a d-dimensional space, so that a boundary is found,samples are mapped to corresponding flow classification labels, and the samples are distributed on the two sides of the boundary; in the two-dimensional plane, the boundary is a straight line; in thehigh-dimensional space, the boundary is a hyperplane; the core of the SVM-based classification problem is to find a boundary obeying the minimum misclassification ratio; after the parameters of the quadratic programming problem are solved, unknown flow samples can be classified by calculating a decision function. The device is wide in application range and convenient to expand. And the method canbe extended to abnormal flow detection scenes of protocols such as FTP, telnet and SMTP. Abnormal flow detection is carried out by utilizing data packet loads, and attack flow classification is realized.

Description

technical field [0001] The invention relates to an attack flow classification method based on SVM. Background technique [0002] Abnormal network traffic detection can effectively defend against network security threats. The core of this method lies in the collection and analysis of traffic data. The network traffic data used for malicious traffic detection can be divided into 4 categories, namely: 1). Packet level-traffic header and load information; 2). Data flow level-network flow statistics; 3). Connection level - connection data information between two IPs; 4). Host data - host activity information. Among them, the data packet information is the most abundant. By analyzing the load information, the traffic can be classified more accurately, which greatly reduces system security risks and improves system security. At present, the detection of malicious traffic at the data packet level mainly uses the deep packet detection technology. The commonly used software is: SNOR...

AI Technical Summary

Problems solved by technology

However, in the face of multi-classification problems, machine learning algorithms have exposed the shortcomings of existing multi-classification mechanisms, such as excessive calculation and low classification accuracy due to feature confusion.

Images