Malicious traffic detection method in data imbalance scene

Abstract

The invention discloses a malicious traffic detection method in a data imbalance scene. The method comprises the following operation steps: S1, obtaining a training set and a test set: manually collecting traffic of each malicious software sample as a negative sample. The invention relates to the technical field of network information security. According to the malicious traffic detection method in the data imbalance scene, each network flow is identified by using a tetrad, statistical features of each flow are extracted and standardized, port information and the statistical features are combined to serve as feature vectors, and a training set and a test set are formed; in the algorithm level, a k-means clustering algorithm is combined with an SMOTE oversampling technology, noise is avoided only by performing oversampling in a safe area, the emphasis is on imbalance between classes and imbalance in the classes, the problem of minority class sample dispersion is solved by increasing minority class samples in a minority sample sparse area, the minority class sample size is expanded, and good training data is provided for a classification model.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a method for detecting malicious traffic in a data imbalance scenario. Background technique [0002] Usually, most of the data obtained from real-world scenarios are unbalanced, and the number of samples of the minority class is often much less than that of the majority class, but the samples belonging to the minority class often have greater significance, such as fraud detection, failure In the fields of diagnosis and network intrusion detection, researchers have been paying attention to the category imbalance problem in the field of machine learning. Therefore, it is necessary to detect this type of malicious traffic. A variety of solutions have been developed for this problem, which can be mainly divided into four categories: Classes: data sampling, cost-sensitive learning, decision boundary shifting, and ensemble learning methods, but the minority class i...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the deficiencies of the prior art, the present invention provides a malicious traffic detection method in a data unbalanced scenario, which solves the problem that the recall rate of malicious traffic is relatively low when a general learning algorithm is used for classification in the existing malicious traffic detection method. Low, the ability to distinguish minority classes is insufficient, and the accuracy of malicious traffic classification cannot be guaranteed in the case of imbalanced positive and negative samples

Images