CN110445776A - A kind of unknown attack Feature Selection Model construction method based on machine learning - Google Patents

Abstract

The invention discloses a kind of unknown attack Feature Selection Model construction method based on machine learning, this method calculates feature according to algorithm, robustness and interpretation with higher, through overtesting, the detection success rate that the unknown attack feature obtained by this method is used to detect this kind of feature is higher than artificial detection method and common attack signature automatically extracts technology, can detect to most attacks；Meanwhile feature extraction speed, the exploitativeness of the easy expenditure of feature and method itself have all reached a higher level, have effectively raised the feasibility of method.

Description

A method for building unknown attack feature extraction model based on machine learning

technical field

The invention relates to the technical field of machine learning, and the specific field is a method for constructing an unknown attack feature extraction model based on machine learning.

Background technique

With the increasing scale of the network, the number of network attacks also increases. How to ensure the normal and stable operation of the network system has become the most important topic of network security. Attack detection based on attack characteristics has become the most common detection method. The attack signature is a summary description of the attack behavior. Usually, the attack signature should be the unique characteristics in the traffic data generated by the attack. An attack behavior can be intuitively discovered and determined through the signature, and will not It has a great impact on daily production and life. For an unknown attack behavior, we need to analyze and extract its characteristics, so as to provide early warning and defense against this type of attack. The process of attack feature extraction is very cumbersome and complicated. Using penetration experts to extract attack features is slow and highly subjective, making it impossible to determine the validity of the extracted features. Therefore, an efficient attack feature automatic extraction technology is needed.

The existing automatic attack feature extraction technology is divided into network-based attack feature extraction technology and host-based attack feature extraction technology. The network-based attack feature extraction technology uses the attack information on the network to extract the attack features in the attack information through algorithms; while the host-based attack feature extraction technology obtains relevant attack information from the attacked host by making certain changes to the system environment. information and analyze the characteristics. The accuracy of the two types of methods, the speed of feature extraction, the ease of use of features and the method itself have different degrees of advantages and disadvantages.

Contents of the invention

The purpose of the present invention is to provide a machine learning-based unknown attack feature extraction model building method to solve the problems raised in the above-mentioned background technology.

In order to achieve the above object, the present invention provides the following technical solution: a method for constructing an unknown attack feature extraction model based on machine learning, the method for constructing an unknown attack feature extraction model based on machine learning includes the following steps:

Step 1: Collect relevant data of unknown attacks to be detected and relevant comparative security data;

Step 2: Perform feature pre-extraction on the data to form feature data;

Step 3: Convert the character data that may exist in the feature data into a digital form, and output it in a digital matrix;

Step 4: Initialize the size and content of the parameter matrix in machine learning;

Step 5: Input the attack data into the model and multiply it with the parameter matrix to obtain the predicted value;

Step 6: Calculate the deviation between the predicted value and the actual value to obtain the error value;

Step 7: Determine whether the error value satisfies the condition, if not, update the parameters in the parameter matrix according to the error value, return to step 5, and proceed to the next step if it is satisfied;

Step 8: Complete the training output matrix parameters, and output unknown attack features according to the absolute value of the parameters.

Preferably, relevant features in the attack data are pre-extracted and data type converted, so as to facilitate the training of the machine learning model.

Preferably, a machine learning model is used to train the characteristic parameters with the converted attack data.

Preferably, after the training is completed, the weights of different features are obtained according to the feature parameters, and then unknown attack features are extracted.

Compared with the prior art, the beneficial effects of the present invention are: a method for constructing an unknown attack feature extraction model based on machine learning, the method calculates features according to an algorithm, and has higher robustness (computer software is in the event of an input error, a disk, etc.) In the case of failure, network overload or intentional attack, whether it can not crash or crash is the robustness and interpretability of the software. After experiments, the unknown attack characteristics obtained by this method are used to detect the characteristics of this kind of characteristics. The detection success rate is higher than the manual detection method and the common automatic attack feature extraction technology, and can detect most of the attack behaviors; at the same time, the feature extraction speed, feature ease of use and implementability of the method itself have reached a high level. level, effectively improving the feasibility of the method.

Description of drawings

FIG. 1 is a flow chart of unknown attack feature extraction in the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Please refer to Fig. 1, the present invention provides a kind of technical solution: a kind of unknown attack feature extraction model construction method based on machine learning, described unknown attack feature extraction model construction method based on machine learning comprises the following steps:

Step 1: Collect relevant data of unknown attacks to be detected and relevant comparative security data;

Step 2: Perform feature pre-extraction on the data to form feature data;

Step 3: Convert the character data that may exist in the feature data into a digital form, and output it in a digital matrix;

Step 4: Initialize the size and content of the parameter matrix in machine learning;

Step 5: Input the attack data into the model and multiply it with the parameter matrix to obtain the predicted value;

Step 6: Calculate the deviation between the predicted value and the actual value to obtain the error value;

Step 7: Determine whether the error value satisfies the condition, if not, update the parameters in the parameter matrix according to the error value, return to step 5, and proceed to the next step if it is satisfied;

Step 8: Complete the training output matrix parameters, and output unknown attack features according to the absolute value of the parameters.

When collecting attack data, for an attack with unknown characteristics, we should first collect relevant attack data, including attack data that can be captured on the network, such as attack traffic packets, and attack data on the target host, such as attack left Files, related log files, etc. In addition, relevant security data should be collected for comparison in the later experimental training process.

When pre-extracting data features, we extract the relevant features of the collected data, such as the length of the message in the traffic packet, the time of the message, the relevant sensitive characters in the message, and the time of the log in the target host , relevant sensitive information in logs, etc., the more types of features extracted here, the higher the accuracy of attack behavior feature extraction will be.

During data conversion, there may be characters in the extracted feature data. Here we label the characters and mark different characters with numbers in turn, so that different numbers can be used to replace different characters, so that the machine learning model can be used later. train.

In the process of initializing the parameter matrix, assuming that the number of parameters extracted during the previous data feature extraction is m (m means several), and a total of n attack records have been extracted (n means several), then here we set the parameter matrix The size is initialized to m*1, and each parameter in the matrix is initially set to 1.

Calculate the prediction result. For each attack record matrix 1*m, we multiply it with the parameter matrix to get a number. If the number is greater than 0.5, we consider the record to be an attack; if the number is less than or equal to 0.5 , we consider this record to be a safe behavior. In this way, n pieces of attack records can obtain n prediction results.

After calculating the prediction results, we calculate the error. We compare the n prediction results with their actual results (the attack behavior is recorded as 1, and the security behavior is recorded as 0), and the difference α between them is calculated, which is the error.

Judging the error, if the error a is greater than the preset value, we update the parameters according to the error: b _i → b _i -kα _i , where it represents the i-th parameter, k represents the learning rate, and then return to the fifth step to calculate the prediction again As a result, if the error α is less than a preset value or the number of parameter updates is greater than a threshold, the training is terminated.

Finally, remember the parameter analysis, and take out the trained parameters for analysis. A large absolute value of the parameter indicates that the feature corresponding to the parameter plays a greater role, and a small absolute value of the parameter indicates that the feature corresponding to the parameter has a small role. From this, it can be concluded that the The relevant feature weights in the unknown attack, so as to finally extract the unknown attack feature, and obtain the specific method of the present invention through the above analysis.

Specifically, pre-extraction and data type conversion are performed on relevant features in the attack data to facilitate the training of machine learning models.

Specifically, feature parameters are trained using machine learning models with transformed attack data.

Specifically, after the training is completed, the weights of different features are obtained according to the feature parameters, and then unknown attack features are extracted.

Although the embodiments of the present invention have been shown and described, those skilled in the art can understand that various changes, modifications and substitutions can be made to these embodiments without departing from the principle and spirit of the present invention. and modifications, the scope of the invention is defined by the appended claims and their equivalents.

Claims (4)

1. a kind of unknown attack Feature Selection Model construction method based on machine learning, it is characterised in that: described to be based on machine The unknown attack Feature Selection Model construction method of study includes the following steps:

Step 1: the related data and relevant comparative's secure data of unknown attack to be detected are collected；

Step 2: feature preextraction is carried out to data, forms characteristic；

Step 3: character data that may be present in characteristic is converted into digital form, is exported in a manner of character matrix；

Step 4: the initialization of size and content is carried out to the parameter matrix in machine learning；

Step 5: data input model will be attacked, is multiplied with parameter matrix and obtains predicted value；

Step 6: the deviation of predicted value and actual value is calculated, obtains error amount；

Step 7: whether error in judgement value meets condition, if not satisfied, being carried out more according to error amount to the parameter in parameter matrix After new, step 5 is returned to, carries out next step if meeting；

Step 8: completing training output matrix parameter, exports unknown attack feature according to parameter absolute value.

2. a kind of unknown attack Feature Selection Model construction method based on machine learning according to claim 1, special Sign is: preextraction and data type conversion is carried out to the correlated characteristic in attack data, in order to the instruction of machine learning model Practice.

3. a kind of unknown attack Feature Selection Model construction method based on machine learning according to claim 1, special Sign is: being trained by the attack data after conversion to characteristic parameter using machine learning model.

4. a kind of unknown attack Feature Selection Model construction method based on machine learning according to claim 1, special Sign is: after completing training, the weight of different characteristic is obtained according to characteristic parameter, and then extract unknown attack feature.