Communication abnormity discovery method and device based on baseline behavior description

Abstract

The invention discloses a communication abnormity discovery method and device based on baseline behavior description, and the method comprises the steps of carrying out the data cleaning and preprocessing of to-be-measured traffic data, and obtaining a traffic matrix y; and constructing an auto-encoder by using a CapsNet model, obtaining a reconstructed traffic matrix of the traffic matrix y based on the auto-encoder, and obtaining a communication anomaly discovery result according to the traffic matrix y and the reconstructed traffic matrix. According to the method, the features can be automatically extracted from the input data, the specific positions between the traffic features and the arrangement sequence between the data can be used as learning features, and the direction of the vector can represent attributes such as the size and the relative position of the feature value, so that normal behaviors can be identified, known abnormal behaviors can be detected, and novel unknown network attacks can be found.

Description

technical field [0001] The invention belongs to the interdisciplinary technical field of network security and computer science, and in particular relates to a method and device for discovering communication abnormalities based on baseline behavior characterization. It proposes an abnormal communication behavior discovery model, which establishes a normal behavior baseline based on a capsule autoencoder. Provides clues for discovering uncharacterized or unknown network anomalies. The invention covers preprocessing of network traffic data, model training based on a capsule autoencoder, and abnormal detection of communication relations. Background technique [0002] As the status of the Internet in social life is getting higher and higher, people's dependence on the Internet is getting stronger and stronger. However, while the popularization of the Internet has brought convenience to people's lives, the problem of network security has become increasingly serious. Among all ki...

AI Technical Summary

Problems solved by technology

The present invention can not only identify known abnormal traffic, but also solve the problem that new unknown network attacks cannot be identified based on statistical rules and binary classification methods

Images