摘要
为能够准确、快速识别网络攻击者,提出一种基于黑客画像的网络攻击者识别方法。构建将稀疏自编码器和贝叶斯神经网络相结合的SAE-BNN模型,检测不同攻击类型的恶意流量;针对不同的恶意流量,通过提取黑客属性特征、流量特征、时间特征和相似性特征,与事先建立的黑客画像库中的黑客画像进行匹配。如果与某个黑客画像完全匹配,则由此确定该黑客的身份。当不能与黑客画像库中的任何黑客画像进行匹配时,将该黑客的特征作为标签,构建新的黑客画像,并更新画像库。实验结果表明,提出的异常流量识别方法在精度、召回率、F1值和准确率上均有提升。基于黑客画像的黑客识别算法与常规方法相比,极大提高了识别效率。
To identify hacker users accurately and quickly,a network attacker identification method based on hacker portrait was proposed.A SAE-BNN model combining sparse auto-encoder(SAE)and Bayesian neural network(BNN)was constructed to detect malicious traffic of different attack types.For different malicious traffic,the hacker attributes,traffic characteristics,time characteristics and similarity characteristics were extracted to match the hacker portraits in the hacker portrait database established in advance.If there was an exact match to a hacker’s profile,the hacker was identified.Experimental results show that the abnormal traffic identification method proposed improves the accuracy,recall,F1 value and accuracy.Compared with the conventional methods,the hacker recognition algorithm based on hacker portrait greatly improves the recognition efficiency.
作者
徐雅斌
王振超
庄唯
XU Ya-bin;WANG Zhen-chao;ZHUANG Wei(School of Computer,Beijing Information Science and Technology University,Beijing 100101,China;Network Security Detachment,Suzhou Public Security Bureau,Suzhou 215000,China;Big Data Security Technology Research Institute,Beijing Information Science and Technology University,Beijing 100101,China)
出处
《计算机工程与设计》
北大核心
2024年第6期1624-1630,共7页
Computer Engineering and Design
基金
国家自然科学基金项目(61672101)。
关键词
稀疏自编码器
贝叶斯神经网络
网络黑客
黑客画像
黑客特征
黑客匹配
恶意流量
sparse auto-encoder
Bayesian neural networks
network hackers
hacker portrait
hacker feature
hacker match
malicious traffic
作者简介
徐雅斌(1962),男,辽省锦州人,硕士,教授,CCF高级会员,研究方向为数据安全与隐私保护;通讯作者:王振超(1998),男,北京人,硕士,研究方向为数据安全与隐私保护;庄唯(1972),男,江苏苏州人,硕士,研究方向为数据安全与隐私保护。E-mail:1602891149@qq.com。
