Attack stage prediction method based on LSTM and attacker information

Abstract

The invention discloses an attack stage prediction method based on LSTM and attacker information, and belongs to the field of attack prediction. The method comprises the following steps: collecting warning information of network attacks in a long period of time through an LSTM system; collecting historical information of attackers in a large amount of warning information; preprocessing the historical data to construct a training set, a verification set and a test set required by LSTM model training; then training an LSTM model by using the training set, and determining whether to stop learning of the LSTM on the training set in advance by using the loss of the verification set; and enabling the finally obtained model to be capable of predicting the preprocessed input data, and obtaining the step that the next attack in the multi-stage network attack in the future through prediction.

Description

technical field [0001] The invention relates to an attack prediction method based on LSTM model and attacker's historical information, belonging to the field of attack prediction. Background technique [0002] To predict subsequent attacks, it is often necessary to record the attacker's behavior and build a description of the attack for later use. Bou-Harb et al. dissect a cyber attack into the following steps: [0003] 1. Network scan [0004] 2. Enumeration [0005] 3. Intrusion attempts [0006] 4. Elevate privileges [0007] 5. Perform malicious tasks [0008] 6. Deploying malware / backdoors [0009] 7. Perform malicious tasks [0010] 8. Delete evidence and exit [0011] Many types of cyberattacks follow this simple sequence of events, which can be observed in network traffic or on targeted systems. Prediction of ongoing attacks is inherently very simple. If we see a series of events that fit the attack model, we can assume that the attack will continue accordi...

AI Technical Summary

Problems solved by technology

[0005] 3. Intrusion attempts

Historically, initial approaches relied on attack libraries that had to be populated manually, requiring significant effort and constant updates

Images