Intrusion behavior-oriented tracing data clustering method and device

Abstract

The invention discloses an intrusion behavior-oriented tracing data clustering method and device, and belongs to the technical field of computers, and the method comprises the steps: collecting tracing information of a system kernel, and carrying out the preprocessing to filter nodes irrelevant to an intrusion behavior and dependency relationships related to the nodes; converting the preprocessed tracing information into a tracing graph, and constructing an adjacent matrix and a node attribute matrix of the tracing graph; selecting a plurality of root nodes from the tracing graph as seed nodes of random walk, and enabling the seed nodes to walk randomly according to a walk policy to obtain a walk path of the tracing graph and a weight of a tracing edge, wherein the walk policy is that any node in the seed nodes walks from an adjacent matrix to an adjacent node at a probability p, and walks from a node attribute matrix to a node having the same attribute with the node attribute matrix at a probability (1-p); and performing clustering according to the walk path and the weight of the tracing edge. Different tracing events can be accurately distinguished, and more accurate data can be provided for subsequent detection and query.

Description

technical field [0001] The invention belongs to the field of computer technology, and more specifically relates to an intrusion-oriented traceability data clustering method and device. Background technique [0002] In the big battlefield of cyberspace, the two sides of the offensive and defensive game are essentially a confrontation of information acquisition capabilities. Only by obtaining more and more complete information can we formulate effective offensive and defensive strategies and gain an advantage in the game of cyberspace battlefield. The current host-based intrusion detection methods are mainly based on recording and analyzing Unix shell command data or system call information of intrusion behavior, such as the sequence and occurrence probability of system calls. However, these methods do not reveal detailed internal intrusion event information (such as system vulnerabilities and intrusion sources), and their detection accuracy is not high. Although unstructured...

AI Technical Summary

Problems solved by technology

[0004] In view of the above defects or improvement needs of the prior art, the present invention provides an intrusion behavior-oriented traceability data clustering method and device, aiming at solving the technical problem of difficulty in distinguishing different user behaviors

Images