CN103532949B - 基于动态反馈的自适应木马通信行为检测方法 - Google Patents
基于动态反馈的自适应木马通信行为检测方法 Download PDFInfo
- Publication number
- CN103532949B CN103532949B CN201310476460.7A CN201310476460A CN103532949B CN 103532949 B CN103532949 B CN 103532949B CN 201310476460 A CN201310476460 A CN 201310476460A CN 103532949 B CN103532949 B CN 103532949B
- Authority
- CN
- China
- Prior art keywords
- warning message
- time
- detection
- address
- dynamical feedback
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 68
- 238000004891 communication Methods 0.000 title claims abstract description 39
- 230000006978 adaptation Effects 0.000 title claims abstract description 14
- 238000000034 method Methods 0.000 claims abstract description 33
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 19
- ZXQYGBMAQZUVMI-GCMPRSNUSA-N gamma-cyhalothrin Chemical compound CC1(C)[C@@H](\C=C(/Cl)C(F)(F)F)[C@H]1C(=O)O[C@H](C#N)C1=CC=CC(OC=2C=CC=CC=2)=C1 ZXQYGBMAQZUVMI-GCMPRSNUSA-N 0.000 claims abstract description 17
- 230000008569 process Effects 0.000 claims abstract description 15
- 238000012706 support-vector machine Methods 0.000 claims abstract description 8
- 238000010276 construction Methods 0.000 claims abstract description 7
- 230000006399 behavior Effects 0.000 claims description 45
- 238000012549 training Methods 0.000 claims description 18
- 230000006870 function Effects 0.000 claims description 17
- 206010000117 Abnormal behaviour Diseases 0.000 claims description 4
- 230000005540 biological transmission Effects 0.000 claims description 3
- 230000002123 temporal effect Effects 0.000 claims description 3
- 239000004744 fabric Substances 0.000 claims 1
- 239000000523 sample Substances 0.000 abstract description 28
- 238000004458 analytical method Methods 0.000 abstract description 10
- 230000003044 adaptive effect Effects 0.000 abstract description 6
- 230000003542 behavioural effect Effects 0.000 description 6
- 238000012937 correction Methods 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 5
- 230000000694 effects Effects 0.000 description 4
- 238000011897 real-time detection Methods 0.000 description 4
- 230000008859 change Effects 0.000 description 3
- 241000283086 Equidae Species 0.000 description 2
- 238000009795 derivation Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000010801 machine learning Methods 0.000 description 2
- 238000006116 polymerization reaction Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 238000012098 association analyses Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000012512 characterization method Methods 0.000 description 1
- 230000001186 cumulative effect Effects 0.000 description 1
- 238000007418 data mining Methods 0.000 description 1
- 238000003066 decision tree Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000004880 explosion Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 239000012530 fluid Substances 0.000 description 1
- 230000004927 fusion Effects 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000006386 memory function Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000002035 prolonged effect Effects 0.000 description 1
- 230000009467 reduction Effects 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 230000003252 repetitive effect Effects 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 238000007619 statistical method Methods 0.000 description 1
- 238000005211 surface analysis Methods 0.000 description 1
- 238000004454 trace mineral analysis Methods 0.000 description 1
- 238000010200 validation analysis Methods 0.000 description 1
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Claims (5)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201310476460.7A CN103532949B (zh) | 2013-10-14 | 2013-10-14 | 基于动态反馈的自适应木马通信行为检测方法 |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201310476460.7A CN103532949B (zh) | 2013-10-14 | 2013-10-14 | 基于动态反馈的自适应木马通信行为检测方法 |
Publications (2)
Publication Number | Publication Date |
---|---|
CN103532949A CN103532949A (zh) | 2014-01-22 |
CN103532949B true CN103532949B (zh) | 2017-06-09 |
Family
ID=49934628
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201310476460.7A Active CN103532949B (zh) | 2013-10-14 | 2013-10-14 | 基于动态反馈的自适应木马通信行为检测方法 |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN103532949B (zh) |
Families Citing this family (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN104468507B (zh) * | 2014-10-28 | 2018-01-30 | 刘胜利 | 基于无控制端流量分析的木马检测方法 |
CN104283897B (zh) * | 2014-10-29 | 2017-12-08 | 刘胜利 | 基于多数据流聚类分析的木马通信特征快速提取方法 |
CN105656944A (zh) * | 2016-03-19 | 2016-06-08 | 浙江大学 | 一种基于网络数据流的木马探测方法 |
CN106126385B (zh) * | 2016-06-14 | 2018-09-07 | 电子科技大学 | 一种基于同步数据流压缩的设备异常实时检测方法 |
CN106778904B (zh) * | 2017-01-10 | 2019-10-18 | 上海鲲云信息科技有限公司 | 一种数据异常检测方法、系统及具有该系统的服务器 |
CN107645493B (zh) * | 2017-08-20 | 2020-03-06 | 杭州安恒信息技术股份有限公司 | 一种ip组相似度计算方法 |
CN107659570B (zh) * | 2017-09-29 | 2020-09-15 | 杭州安恒信息技术股份有限公司 | 基于机器学习与动静态分析的Webshell检测方法及系统 |
CN107959583A (zh) * | 2017-10-26 | 2018-04-24 | 卡斯柯信号有限公司 | 一种集中监测报警信息的管理系统 |
CN108173884B (zh) * | 2018-03-20 | 2021-05-04 | 国家计算机网络与信息安全管理中心 | 基于网络攻击伴随行为的DDoS攻击群体分析方法 |
CN110381015A (zh) * | 2019-06-03 | 2019-10-25 | 西安电子科技大学 | 一种基于入侵检测系统报警信息的聚类分析方法 |
CN110798484B (zh) * | 2019-11-13 | 2021-10-01 | 珠海市鸿瑞信息技术股份有限公司 | 工控协议特征攻击过滤分析系统 |
CN111475804B (zh) * | 2020-03-05 | 2023-10-24 | 杭州未名信科科技有限公司 | 一种告警预测方法及系统 |
CN112671768A (zh) * | 2020-12-24 | 2021-04-16 | 四川虹微技术有限公司 | 一种异常流量检测方法、装置、电子设备及存储介质 |
CN114726589A (zh) * | 2022-03-17 | 2022-07-08 | 南京科技职业学院 | 一种报警数据融合方法 |
CN115002073B (zh) * | 2022-06-23 | 2023-06-23 | 中国互联网络信息中心 | 一种基于改进raft的数据更新方法及系统 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101605074A (zh) * | 2009-07-06 | 2009-12-16 | 中国人民解放军信息技术安全研究中心 | 基于网络通讯行为特征监测木马的方法与系统 |
CN101854275A (zh) * | 2010-05-25 | 2010-10-06 | 军工思波信息科技产业有限公司 | 一种通过分析网络行为检测木马程序的方法及装置 |
CN102594825A (zh) * | 2012-02-22 | 2012-07-18 | 北京百度网讯科技有限公司 | 一种内网木马的检测方法和装置 |
CN103179105A (zh) * | 2012-10-25 | 2013-06-26 | 四川省电力公司信息通信公司 | 一种基于网络流量中行为特征的智能木马检测装置及其方法 |
-
2013
- 2013-10-14 CN CN201310476460.7A patent/CN103532949B/zh active Active
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101605074A (zh) * | 2009-07-06 | 2009-12-16 | 中国人民解放军信息技术安全研究中心 | 基于网络通讯行为特征监测木马的方法与系统 |
CN101854275A (zh) * | 2010-05-25 | 2010-10-06 | 军工思波信息科技产业有限公司 | 一种通过分析网络行为检测木马程序的方法及装置 |
CN102594825A (zh) * | 2012-02-22 | 2012-07-18 | 北京百度网讯科技有限公司 | 一种内网木马的检测方法和装置 |
CN103179105A (zh) * | 2012-10-25 | 2013-06-26 | 四川省电力公司信息通信公司 | 一种基于网络流量中行为特征的智能木马检测装置及其方法 |
Also Published As
Publication number | Publication date |
---|---|
CN103532949A (zh) | 2014-01-22 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN103532949B (zh) | 基于动态反馈的自适应木马通信行为检测方法 | |
Maglaras et al. | Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems | |
Usama et al. | Unsupervised machine learning for networking: Techniques, applications and research challenges | |
Wang et al. | Machine learning in network anomaly detection: A survey | |
Cheng et al. | MS-LSTM: A multi-scale LSTM model for BGP anomaly detection | |
Cordero et al. | Analyzing flow-based anomaly intrusion detection using replicator neural networks | |
US20160308725A1 (en) | Integrated Community And Role Discovery In Enterprise Networks | |
US12003522B2 (en) | Method and system for adaptive network intrusion detection | |
Bodström et al. | State of the art literature review on network anomaly detection with deep learning | |
CN104052639A (zh) | 基于支持向量机的实时多应用网络流量识别方法 | |
Franc et al. | Learning detector of malicious network traffic from weak labels | |
Tian et al. | A digital evidence fusion method in network forensics systems with Dempster-shafer theory | |
Juvonen et al. | An efficient network log anomaly detection system using random projection dimensionality reduction | |
Atli | Anomaly-based intrusion detection by modeling probability distributions of flow characteristics | |
Scaranti et al. | Unsupervised online anomaly detection in Software Defined Network environments | |
El-Kadhi et al. | A Mobile Agents and Artificial Neural Networks for Intrusion Detection. | |
KR20190028880A (ko) | 봇넷 탐지 시스템을 학습하기 위한 학습 데이터를 생성하는 방법 및 그 장치 | |
Li | Detection of ddos attacks based on dense neural networks, autoencoders and pearson correlation coefficient | |
Pandey | Design and performance analysis of various feature selection methods for anomaly‐based techniques in intrusion detection system | |
Palomo et al. | A New GHSOM Model applied to network security | |
Zhang et al. | Fltracer: Accurate poisoning attack provenance in federated learning | |
CN112235242A (zh) | 一种c&c信道检测方法及系统 | |
Corchado et al. | Detecting compounded anomalous SNMP situations using cooperative unsupervised pattern recognition | |
Mukkavilli et al. | Mining concept drifting network traffic in cloud computing environments | |
Priya et al. | Intelligent outlier detection with optimal deep reinforcement learning model for intrusion detection |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant | ||
TR01 | Transfer of patent right |
Effective date of registration: 20181219 Address after: 610000 Chengdu High-tech Zone, Sichuan Province, 2 buildings and 3 floors, No. 4, Xinhang Road Patentee after: Sichuan Yuxin'an Electronic Technology Co., Ltd. Address before: 450002 Unit 302, Building No. 7, 19, Jinxue Street, Jinshui District, Zhengzhou City, Henan Province Patentee before: Liu Shengli |
|
TR01 | Transfer of patent right | ||
TR01 | Transfer of patent right |
Effective date of registration: 20200716 Address after: Room 302, unit 1, building 19, No.7, Jianxue street, Jinshui District, Zhengzhou City, Henan Province Patentee after: Liu Shengli Address before: 610000 Chengdu High-tech Zone, Sichuan Province, 2 buildings and 3 floors, No. 4, Xinhang Road Patentee before: Sichuan Yuxin'an Electronic Technology Co.,Ltd. |
|
TR01 | Transfer of patent right | ||
TR01 | Transfer of patent right |
Effective date of registration: 20210111 Address after: 450000 Science Avenue 62, Zhengzhou High-tech Zone, Henan Province Patentee after: Information Engineering University of the Chinese People's Liberation Army Strategic Support Force Address before: Unit 302, unit 1, building 19, No.7 Jianxue street, Jinshui District, Zhengzhou City, Henan Province, 450000 Patentee before: Liu Shengli |
|
TR01 | Transfer of patent right |