CN116996286A - Network attack and security vulnerability management framework platform based on big data analysis - Google Patents
Network attack and security vulnerability management framework platform based on big data analysis Download PDFInfo
- Publication number
- CN116996286A CN116996286A CN202310950455.9A CN202310950455A CN116996286A CN 116996286 A CN116996286 A CN 116996286A CN 202310950455 A CN202310950455 A CN 202310950455A CN 116996286 A CN116996286 A CN 116996286A
- Authority
- CN
- China
- Prior art keywords
- data
- security
- network
- information
- neural network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000007405 data analysis Methods 0.000 title claims abstract description 18
- 238000001514 detection method Methods 0.000 claims abstract description 72
- 238000012360 testing method Methods 0.000 claims abstract description 21
- 230000002265 prevention Effects 0.000 claims abstract description 19
- 238000004891 communication Methods 0.000 claims abstract description 17
- 230000008439 repair process Effects 0.000 claims abstract description 14
- 238000000034 method Methods 0.000 claims description 58
- 238000013528 artificial neural network Methods 0.000 claims description 42
- 239000011159 matrix material Substances 0.000 claims description 41
- 238000004422 calculation algorithm Methods 0.000 claims description 38
- 210000002569 neuron Anatomy 0.000 claims description 32
- 230000002159 abnormal effect Effects 0.000 claims description 27
- 239000002245 particle Substances 0.000 claims description 25
- 230000008569 process Effects 0.000 claims description 24
- 238000013135 deep learning Methods 0.000 claims description 19
- 238000012545 processing Methods 0.000 claims description 16
- 238000004458 analytical method Methods 0.000 claims description 14
- 230000008520 organization Effects 0.000 claims description 14
- 238000012549 training Methods 0.000 claims description 13
- 238000012937 correction Methods 0.000 claims description 12
- 230000013016 learning Effects 0.000 claims description 12
- 238000010801 machine learning Methods 0.000 claims description 12
- 238000013527 convolutional neural network Methods 0.000 claims description 10
- 230000006399 behavior Effects 0.000 claims description 9
- 238000004364 calculation method Methods 0.000 claims description 9
- 238000012544 monitoring process Methods 0.000 claims description 9
- 238000005516 engineering process Methods 0.000 claims description 8
- 206010000117 Abnormal behaviour Diseases 0.000 claims description 7
- 238000007418 data mining Methods 0.000 claims description 7
- 230000035515 penetration Effects 0.000 claims description 7
- 230000000306 recurrent effect Effects 0.000 claims description 7
- 238000012706 support-vector machine Methods 0.000 claims description 7
- 230000001133 acceleration Effects 0.000 claims description 6
- 230000004913 activation Effects 0.000 claims description 6
- 238000013179 statistical model Methods 0.000 claims description 6
- 230000004888 barrier function Effects 0.000 claims description 4
- 238000012216 screening Methods 0.000 claims description 4
- 241000596871 Ixia Species 0.000 claims description 3
- 230000003213 activating effect Effects 0.000 claims description 3
- 230000006978 adaptation Effects 0.000 claims description 3
- 230000005540 biological transmission Effects 0.000 claims description 3
- 210000004556 brain Anatomy 0.000 claims description 3
- 125000004122 cyclic group Chemical group 0.000 claims description 3
- 230000000694 effects Effects 0.000 claims description 3
- 238000000605 extraction Methods 0.000 claims description 3
- 230000006870 function Effects 0.000 claims description 3
- 230000010365 information processing Effects 0.000 claims description 3
- 239000000203 mixture Substances 0.000 claims description 3
- 230000001537 neural effect Effects 0.000 claims description 3
- 238000003062 neural network model Methods 0.000 claims description 3
- 210000004205 output neuron Anatomy 0.000 claims description 3
- 230000008447 perception Effects 0.000 claims description 3
- 238000011176 pooling Methods 0.000 claims description 3
- 238000000513 principal component analysis Methods 0.000 claims description 3
- 230000009467 reduction Effects 0.000 claims description 3
- 230000004044 response Effects 0.000 claims description 3
- 239000000523 sample Substances 0.000 claims description 3
- 230000009326 social learning Effects 0.000 claims description 3
- 238000007619 statistical method Methods 0.000 claims description 3
- 238000012546 transfer Methods 0.000 claims description 3
- 238000005067 remediation Methods 0.000 claims 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 230000008676 import Effects 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000001681 protective effect Effects 0.000 description 1
- 238000004088 simulation Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses a network attack and security hole treatment framework platform based on big data analysis; the system comprises a network attack, security hole management and a big data query system, wherein the security hole management comprises a network security frame, firewall protection, data backup encryption, hole query detection, hole repair prevention and system security test, and the big data query system comprises a network communication module and a big database module.
Description
Technical Field
The invention belongs to the technical field of network security protection, and particularly relates to a network attack and security vulnerability management framework platform based on big data analysis.
Background
Cyber attacks refer to network criminals attempting to disable computers, steal data, or launch additional attacks using a corrupted computer system. In recent years, network attacks have become more and more complex, and thus, network attack prevention is indispensable to everyone and organization. Network crimes are based on the efficient exploitation of vulnerabilities. Security teams are disadvantageous in that they must protect all possible entry points, while attackers only need to find and exploit one vulnerability or vulnerability. This imbalance is beneficial to attackers, which means that even large organizations may have difficulty preventing network criminals from accessing their networks, so that when network security protection is performed, not only network attacks are blocked, but also vulnerabilities are repaired, but various network security protection problems still exist in the market.
The invention discloses a network attack detection method as disclosed in the authority bulletin No. CN101286979A, which realizes import and export of small and medium-sized networks, if the invention is applied to import and export of large-sized high-speed networks, the invention can be solidified on hardware in a hardware program mode or a plurality of computers are deployed for parallel processing, but the problems that the protection of network attack, the repair of loopholes, the detection processing according to a plurality of algorithms, the real-time updating of a large database and the like cannot be realized in the existing network security protection are not solved, and therefore, a network attack and security hole management framework platform based on big data analysis is provided.
Disclosure of Invention
The invention aims to provide a network attack and security hole management framework platform based on big data analysis so as to solve the problems in the background technology.
In order to achieve the above purpose, the present invention provides the following technical solutions: a network attack and security vulnerability management framework platform based on big data analysis comprises a network attack, security vulnerability management and big data query system: the network attack comprises abnormal access prevention, IP address search, data size analysis, deep learning detection, machine learning detection and intrusion detection data sets, wherein the abnormal access prevention is used for preventing abnormal access information and preventing abnormal information from carrying network attacks from entering, the IP address search is used for inquiring address information of the abnormal information, the data access is permanently prevented through the abnormal IP address, the data size analysis is used for acquiring data information of normal communication and carrying out size analysis processing on the data information of the normal communication, the deep learning detection is used for detecting threat by software, preventing unauthorized access or abuse and reporting attacks to a security administrator, the machine learning detection is used for detecting the abnormal attacks through a computer algorithm, and the intrusion detection data sets are used for evaluating and training the necessary conditions of an intrusion detection system based on abnormal behavior detection;
The security vulnerability management comprises a network security framework, a firewall protection, data backup encryption, vulnerability query detection, vulnerability repair prevention and system security test, wherein the network security framework is a set of standards, criteria and programs formulated by a network security professional organization and aims to help organize to know and manage the facing network security risks, the firewall protection is a technology for helping a computer network to construct a relatively isolated protection barrier between an inner network and an outer network by organically combining various software and hardware devices for security management and screening so as to protect user data and information security, the data backup encryption is used for realizing effective backup and encryption processing of data information of computer resources and improving the security of the computer resources, the vulnerability query detection is used for realizing the detection and query of the computer, implementing early queries of computer vulnerabilities, which typically seek common vulnerabilities or flaws by conducting a series of tests on systems and networks, including attempting to exploit known vulnerabilities, guessing default passwords or user accounts, or simply attempting to access restricted areas, the vulnerability repair prevention is used to effect repair of vulnerabilities obtained by detection of the vulnerability query, and the corrections include prioritizing vulnerabilities, determining appropriate follow-up steps, and generating correction tickets for IT team execution, and finally, correction tracking is an important tool to ensure that vulnerabilities or misconfigurations are properly resolved, the system security test is to discover and exploit vulnerabilities in computer systems through penetration test software, identify vulnerabilities in systems that may be exploited by actual attackers through simulated attacks, threat protection software enables organizations to track, monitoring, analyzing and prioritizing potential threats to better protect themselves by collecting data from various sources, including databases and security suggestions that have vulnerabilities;
The big data query system comprises a network communication module and a big database module, wherein the network communication module is used for realizing the system query of the big database and the query and acquisition of the type of the network attack, and the big database module is used for realizing the query and the download of various network attack modes and vulnerability management modes on the network.
Preferably, the deep learning detection is a deep neural network for feature extraction, perception and learning, the deep refers to the number of hidden layers in the neural network, the deep neural network comprises up to 150 hidden layers, the deep learning uses a plurality of continuous layers to perform operations, each layer is connected with each other, and each layer receives the output of the previous layer as input.
Preferably, the deep learning detection comprises a deep feedforward network, a recurrent neural network, a convolutional neural network and a self-encoder;
the deep feed forward network: the information can be transmitted from an input layer to an output layer in the feedforward neural network, and can only be transmitted unidirectionally but not reversely;
the recurrent neural network: also called a cyclic neural network, can effectively process sequence data, and unlike a deep feed forward network, the output of neurons directly acts on neurons of the layer at the next time stamp;
The convolutional neural network: the method comprises a convolution layer, a pooling layer and a full connection layer, and can effectively reduce the dimension of the image with large data volume to small data volume on the premise of keeping the picture characteristics;
the self-encoder: the non-supervision neural network model consists of an encoder and a decoder, and is mainly used for encoding an input value into an intermediate value and then decoding the intermediate value to reconstruct the input data so as to realize dimension reduction.
Preferably, the machine learning detection includes the following algorithm:
and (5) carrying out mathematical statistics: creating a statistical model by checking normal behavior and abnormal behavior of a user or a system, wherein the statistical model is used for identifying new attacks, and the common statistical methods comprise principal component analysis, chi-square distribution and Gaussian mixture distribution;
support vector machine: the support vector machine is an effective method for detecting intrusion events under the condition of limited data samples, and the aim of the vector machine is to distinguish two types of data by using one feature vector in the most proper way;
and (3) data mining: the data mining is a common method for analyzing the behavior of a user, and is characterized in that a large amount of information is extracted from the collected mass data, and key rules are extracted by analyzing the association relation between the user and the data;
Based on the rule set: analyzing attack flow in the network, extracting key rules, detecting intrusion behavior after reducing data dimension on the basis, reducing detection calculation to a certain extent, and improving detection efficiency;
artificial neural network: an artificial neural network is an intelligent information processing model that simulates the human brain to process, store and process information, the neural network obtains knowledge through learning, and stores the learned knowledge in the weights of the connection points, the model has learning and adaptation, and identifies unknown intrusions.
Preferably, the calculation formula of the convolutional neural network is as follows;
the input picture matrix and the following convolution kernel are square matrices, the size of the input matrix is w, the size of the convolution kernel is k, the step is s, the zero padding layer number is p, and the calculation formula of the size of the feature picture generated after convolution is:
the input formula is:
V＝cos v2(W,X,"valid")+b，
the output formula is:
the above input/output formula is for each convolution layer, each convolution layer has a different weight matrix W, and W, X, Y are in matrix form, for the last fully connected layer, set to the L-th layer, the output is in vector form Y L The desired output is d.
Preferably, the artificial neural network adopts an AI intelligent algorithm, and the neural network of the AI intelligent algorithm is determined by inputting neuron information and a corresponding weight matrix W T X t X is a vector and W is a weight matrix, with W converting X into another vector;
information transfer from hidden layer neuron at previous moment to neuron at current moment, and its value is S t-1 And corresponding weight matrix U T S t-1 ，S t-1 Is a vector, U is a weight matrix, and S is defined by U t-1 Converting to a further vector;
neuron h, mainly at the current moment t Integrating the inputs of the two parts, activating and generating the output of the hidden layer neuron at the current moment, wherein the integrating process is vector addition: w (W) T X t +U T S t-1 ；
After assuming that the activation function is f, the value of the neuron at the current moment is generated after activation: s is S t ＝f(W T X t +U T S t-1 )；
The information transmission is mainly to transmit the value of the hidden layer neuron at the current moment to the output neuron at the current moment:
O t ＝g(V T S t )；
the forward formula is as follows:
S t ＝f(W T X t +U T S t-1 ),O t ＝g(V T S t )＝g(V T f(W T X t +U T S t-1 ))；
in the whole neural network, three weight matrices are included together, wherein the first matrix is W, the dimension of the given matrix is (N, K), N represents the vector dimension of the neuron value of the hidden layer, K represents the vector dimension of the input neural unit, the second weight matrix is V, the dimension of the matrix is (L, N), wherein P represents the vector dimension of the neuron of the output layer, and the third is the weight matrix U, and the dimension of the matrix is (N, N).
Preferably, the intrusion detection data set includes the following:
the KDCup 99 data set is provided with marked training data and unmarked test data, and the data set has 3 characteristic attributes which are divided into basic characteristics, flow characteristics and content characteristics;
the NSL-KDD data set deletes repeated records in the KDCup 99, so that the data volume is reduced, the NSL-KDD contains basic records and data characteristics of the KDCup 99 data set, and the identified attack category is the same as the KDCup 99 data set;
training of the UNSW-NB15 data set is to simulate a real attack environment as far as possible according to the vulnerability information technology disclosed on the CVE website by utilizing an IXIA flow generator;
the CIC-IDS2017 data set uses a CICFlowMeter tool to extract more than 80 characteristic attributes from original data, and two methods for extracting the characteristics are respectively an online mode and an offline mode; the network flow is monitored in real time in an online mode, characteristics are generated, and after monitoring is finished, the characteristic attributes are stored locally in a CSV format; the offline mode is to submit a complete packet in pcap format to the ciclowmeter tool, which gets a CSV file containing the features.
Preferably, the network security framework includes the following:
The NIST network security framework is an iterative method that helps organizations develop consistency to identify, evaluate and manage network security risks, whose critical infrastructure to protect may be controlled by public or private sector organizations of varying scale, complexity and technical capabilities;
ISO/IEC27001/ISO27002 covers the requirements for designing, implementing, maintaining and continuously improving information security management systems, which are analyzed by organizations based on the following factors: assessing the risk faced by the organization to identify threats, the extent of susceptibility, the likelihood of occurrence, and potential impact; law and contractual obligations that an organization must fulfill; organizing information management internal processes, programs and business requirements for its business operations;
the CIS control framework adopts a crowdsourcing mode to identify the most common network threats and define security measures to prevent the threats, including enterprise asset inventory and control, data protection, e-mail Web browser and protection, security awareness and skill training, event response management and penetration testing;
HIPAA standardizes the way in which healthcare organizations process information, outlines three major aspects of information security compliance, including the adoption of rules and procedural management safeguards, and specifies how organizations will adhere to laws; providing physical security measures for physical access control to the protected data; technical support measures for protecting software and hardware systems for processing, storing and transmitting data;
The PCI-DSS handles more and more credit card data compromise events, and the organization of the framework has to meet six control objectives including establishing and maintaining secure networks and systems, protecting cardholder data, maintaining vulnerability management plans, implementing powerful access control measures, periodically monitoring and testing networks, maintaining information security policies.
Preferably, the data backup encryption adopts a hash algorithm;
the formula of the hash algorithm is as follows:
address＝H[key]；
the hash conflict resolution algorithm of the hash algorithm comprises a linear exploration method, a secondary exploration method and a double hash method;
the formula of the linear exploration method is as follows:
hi＝(h(key)+i)％m，0≤i≤m-1；
i.e. from address d, it first probes T [ d ], then T [ d+1], … in turn, until T [ m-1], and then loops back to T [0], T [1], …, until either a free address is probed or T [ d-1 ].
Preferably, when the large database module queries the network attack mode and the security hole treatment mode, a particle swarm algorithm is adopted to query and detect, and a large optimal method mode is searched for analysis and treatment;
the particle swarm algorithm utilizes the sharing of information by individuals in the swarm to enable the whole swarm to generate an unordered to ordered evolution process in the problem solving process, so that the solution of the problem is obtained;
The formula of the particle swarm algorithm is as follows:
the (d+1) th iteration,
wherein:
n is the number of the particles,
c 1 individual learning factors, also known as individual acceleration factors,
c 2 the social learning factor, also known as the social acceleration factor,
w is the inertial weight of the velocity,
at the d-th iteration, the speed of the i-th particle,
f (x) the position of the ith particle in the d-th iteration,
the fitness value at the position x,
by the d-th iteration, the best position for the i-th particle to pass,
pbest d until the d-th iteration, the best position for all particles to pass.
Compared with the prior art, the invention has the beneficial effects that:
when the method is used, the network attack can be effectively protected by detecting and preventing the network attack, and the network attack is detected in various forms through abnormal access prevention, IP address searching, data size analysis, deep learning detection, machine learning detection and intrusion detection data sets, so that the security degree can be improved, the network attack can be conveniently protected, the system loopholes are detected and repaired through security vulnerability management after the network attack is protected, the system protective security is improved through a security framework, the system framework is tested, the loopholes are detected in an attack simulation mode, the loopholes are repaired finally, the security is improved, the information of the network attack and the loopholes is obtained through a big data query system, and the network security is updated through big data information in real time.
Drawings
Fig. 1 is a schematic view of a frame platform structure according to the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Referring to fig. 1, the present invention provides a technical solution: a network attack and security vulnerability management framework platform based on big data analysis comprises a network attack, security vulnerability management and big data query system: the network attack comprises abnormal access prevention, IP address search, data size analysis, deep learning detection, machine learning detection and intrusion detection data sets, wherein the abnormal access prevention is used for preventing abnormal access information and preventing abnormal information from carrying network attacks from entering, the IP address search is used for inquiring address information of the abnormal information, the data access is permanently prevented through the abnormal IP address, the data size analysis is used for acquiring data information of normal communication and carrying out size analysis processing on the data information of the normal communication, the deep learning detection is used for detecting threat by software, preventing unauthorized access or abuse and reporting attacks to a security administrator, the machine learning detection is used for detecting the abnormal attacks through a computer algorithm, and the intrusion detection data sets are used for evaluating and training the necessary conditions of an intrusion detection system based on abnormal behavior detection;
The security vulnerability management comprises a network security framework, a firewall protection, data backup encryption, vulnerability query detection, vulnerability repair prevention and system security test, wherein the network security framework is a set of standards, criteria and programs formulated by a network security professional organization and aims to help organize to know and manage the facing network security risks, the firewall protection is a technology for helping a computer network to construct a relatively isolated protection barrier between an inner network and an outer network by organically combining various software and hardware devices for security management and screening so as to protect user data and information security, the data backup encryption is used for realizing effective backup and encryption processing of data information of computer resources and improving the security of the computer resources, the vulnerability query detection is used for realizing the detection and query of the computer, implementing early queries of computer vulnerabilities, which typically seek common vulnerabilities or flaws by conducting a series of tests on systems and networks, including attempting to exploit known vulnerabilities, guessing default passwords or user accounts, or simply attempting to access restricted areas, the vulnerability repair prevention is used to effect repair of vulnerabilities obtained by detection of the vulnerability query, and the corrections include prioritizing vulnerabilities, determining appropriate follow-up steps, and generating correction tickets for IT team execution, and finally, correction tracking is an important tool to ensure that vulnerabilities or misconfigurations are properly resolved, the system security test is to discover and exploit vulnerabilities in computer systems through penetration test software, identify vulnerabilities in systems that may be exploited by actual attackers through simulated attacks, threat protection software enables organizations to track, monitoring, analyzing and prioritizing potential threats to better protect themselves by collecting data from various sources, including databases and security suggestions that have vulnerabilities;
The big data query system comprises a network communication module and a big database module, wherein the network communication module is used for realizing the system query of the big database and the query and acquisition of the type of the network attack, and the big database module is used for realizing the query and the download of various network attack modes and vulnerability management modes on the network.
In order to realize deep learning protection for network attack, in this embodiment, preferably, the deep learning detection is a deep neural network for feature extraction, perception and learning, where the deep neural network refers to the number of hidden layers in the neural network, the deep neural network includes up to 150 hidden layers, the deep learning uses multiple continuous layers to perform operations, each layer is connected with each other, and each layer receives the output of the previous layer as input.
In order to realize detection processing of network attack through different algorithms, in this embodiment, preferably, the deep learning detection includes a deep feed-forward network, a recurrent neural network, a convolutional neural network and a self-encoder;
the deep feed forward network: the information can be transmitted from an input layer to an output layer in the feedforward neural network, and can only be transmitted unidirectionally but not reversely;
The recurrent neural network: also called a cyclic neural network, can effectively process sequence data, and unlike a deep feed forward network, the output of neurons directly acts on neurons of the layer at the next time stamp;
the convolutional neural network: the method comprises a convolution layer, a pooling layer and a full connection layer, and can effectively reduce the dimension of the image with large data volume to small data volume on the premise of keeping the picture characteristics;
the self-encoder: the non-supervision neural network model consists of an encoder and a decoder, and is mainly used for encoding an input value into an intermediate value and then decoding the intermediate value to reconstruct the input data so as to realize dimension reduction.
In order to realize the security protection of self-learning for the network attack, effectively identify the network attack and realize the prevention of the network attack, in this embodiment, preferably, the machine learning detection includes the following algorithm:
and (5) carrying out mathematical statistics: creating a statistical model by checking normal behavior and abnormal behavior of a user or a system, wherein the statistical model is used for identifying new attacks, and the common statistical methods comprise principal component analysis, chi-square distribution and Gaussian mixture distribution;
support vector machine: the support vector machine is an effective method for detecting intrusion events under the condition of limited data samples, and the aim of the vector machine is to distinguish two types of data by using one feature vector in the most proper way;
And (3) data mining: the data mining is a common method for analyzing the behavior of a user, and is characterized in that a large amount of information is extracted from the collected mass data, and key rules are extracted by analyzing the association relation between the user and the data;
based on the rule set: analyzing attack flow in the network, extracting key rules, detecting intrusion behavior after reducing data dimension on the basis, reducing detection calculation to a certain extent, and improving detection efficiency;
artificial neural network: an artificial neural network is an intelligent information processing model that simulates the human brain to process, store and process information, the neural network obtains knowledge through learning, and stores the learned knowledge in the weights of the connection points, the model has learning and adaptation, and identifies unknown intrusions.
In order to detect through image information and facilitate implementing security protection of different forms on the network system, in this embodiment, preferably, a calculation formula of the convolutional neural network is as follows;
the input picture matrix and the following convolution kernel are square matrices, the size of the input matrix is w, the size of the convolution kernel is k, the step is s, the zero padding layer number is p, and the calculation formula of the size of the feature picture generated after convolution is:
The input formula is:
V＝cos v2(W,X,"valid")+b，
the output formula is:
the above input/output formula is for each convolution layer, each convolution layer has a different weight matrix W, and W, X, Y are in matrix form, for the last fully connected layer, set to the L-th layer, the output is in vector form Y L The desired output is d.
In order to enable the network protection to realize self-learning and improve the protection level, in this embodiment, preferably, the artificial neural network adopts an AI intelligent algorithm, and the neural network of the AI intelligent algorithm inputs neuron information and corresponding weight matrix W to determine, W T X t X is a vector and W is a weight matrix, with W converting X into another vector;
information transfer from hidden layer neuron at previous moment to neuron at current moment, and its value is S t-1 And corresponding weight matrix U T S t-1 ，S t-1 Is a vector, U is a weight matrix, and S is defined by U t-1 Converting to a further vector;
mainly is thatNeuron h at the present moment t Integrating the inputs of the two parts, activating and generating the output of the hidden layer neuron at the current moment, wherein the integrating process is vector addition: w (W) T X t +U T S t-1 ；
After assuming that the activation function is f, the value of the neuron at the current moment is generated after activation: s is S t ＝f(W T X t +U T S t-1 )；
The information transmission is mainly to transmit the value of the hidden layer neuron at the current moment to the output neuron at the current moment:
O t ＝g(V T S t )；
the forward formula is as follows:
S t ＝f(W T X t +U T S t-1 ),O t ＝g(V T S t )＝g(V T f(W T X t +U T S t-1 ))；
in the whole neural network, three weight matrices are included together, wherein the first matrix is W, the dimension of the given matrix is (N, K), N represents the vector dimension of the neuron value of the hidden layer, K represents the vector dimension of the input neural unit, the second weight matrix is V, the dimension of the matrix is (L, N), wherein P represents the vector dimension of the neuron of the output layer, and the third is the weight matrix U, and the dimension of the matrix is (N, N).
In order to determine the intrusion detection data set, so as to facilitate the identification of the type of the network attack and the security protection, in this embodiment, preferably, the intrusion detection data set includes the following steps:
the KDCup 99 data set is provided with marked training data and unmarked test data, and the data set has 3 characteristic attributes which are divided into basic characteristics, flow characteristics and content characteristics;
the NSL-KDD data set deletes repeated records in the KDCup 99, so that the data volume is reduced, the NSL-KDD contains basic records and data characteristics of the KDCup 99 data set, and the identified attack category is the same as the KDCup 99 data set;
Training of the UNSW-NB15 data set is to simulate a real attack environment as far as possible according to the vulnerability information technology disclosed on the CVE website by utilizing an IXIA flow generator;
the CIC-IDS2017 data set uses a CICFlowMeter tool to extract more than 80 characteristic attributes from original data, and two methods for extracting the characteristics are respectively an online mode and an offline mode; the network flow is monitored in real time in an online mode, characteristics are generated, and after monitoring is finished, the characteristic attributes are stored locally in a CSV format; the offline mode is to submit a complete packet in pcap format to the ciclowmeter tool, which gets a CSV file containing the features.
In order to realize framework support for the security protection of the network and improve the security of the network, in this embodiment, preferably, the network security framework includes the following several types:
the NIST network security framework is an iterative method that helps organizations develop consistency to identify, evaluate and manage network security risks, whose critical infrastructure to protect may be controlled by public or private sector organizations of varying scale, complexity and technical capabilities;
ISO/IEC27001/ISO27002 covers the requirements for designing, implementing, maintaining and continuously improving information security management systems, which are analyzed by organizations based on the following factors: assessing the risk faced by the organization to identify threats, the extent of susceptibility, the likelihood of occurrence, and potential impact; law and contractual obligations that an organization must fulfill; organizing information management internal processes, programs and business requirements for its business operations;
The CIS control framework adopts a crowdsourcing mode to identify the most common network threats and define security measures to prevent the threats, including enterprise asset inventory and control, data protection, e-mail Web browser and protection, security awareness and skill training, event response management and penetration testing;
HIPAA standardizes the way in which healthcare organizations process information, outlines three major aspects of information security compliance, including the adoption of rules and procedural management safeguards, and specifies how organizations will adhere to laws; providing physical security measures for physical access control to the protected data; technical support measures for protecting software and hardware systems for processing, storing and transmitting data;
the PCI-DSS handles more and more credit card data compromise events, and the organization of the framework has to meet six control objectives including establishing and maintaining secure networks and systems, protecting cardholder data, maintaining vulnerability management plans, implementing powerful access control measures, periodically monitoring and testing networks, maintaining information security policies.
In order to realize the security protection of the network resources of the user and prevent intrusion attacks, in this embodiment, preferably, the data backup encryption adopts a hash algorithm;
The formula of the hash algorithm is as follows:
address＝H[key]；
the hash conflict resolution algorithm of the hash algorithm comprises a linear exploration method, a secondary exploration method and a double hash method;
the formula of the linear exploration method is as follows:
hi＝(h(key)+i)％m，0≤i≤m-1；
i.e. from address d, it first probes T [ d ], then T [ d+1], … in turn, until T [ m-1], and then loops back to T [0], T [1], …, until either a free address is probed or T [ d-1 ].
In order to realize inquiring the network attack mode and the protection method in the big data and inquiring the loopholes, and effectively realize symptomatic protection, in the embodiment, preferably, the big database module adopts a particle swarm algorithm to inquire and detect when inquiring the network attack mode and the security loophole treatment mode, and searches for the mode of the big optimal method for analysis processing;
the particle swarm algorithm utilizes the sharing of information by individuals in the swarm to enable the whole swarm to generate an unordered to ordered evolution process in the problem solving process, so that the solution of the problem is obtained;
the formula of the particle swarm algorithm is as follows:
the (d+1) th iteration,
wherein:
n is the number of the particles,
c 1 individual learning factors, also known as individual acceleration factors,
c 2 The social learning factor, also known as the social acceleration factor,
w is the inertial weight of the velocity,
at the d-th iteration, the speed of the i-th particle,
f (x) the position of the ith particle in the d-th iteration,
the fitness value at the position x,
by the d-th iteration, the best position for the i-th particle to pass,
pbest d until the d-th iteration, the best position for all particles to pass.
The working principle and the using flow of the invention are as follows: when the system is used, the network attack and security hole treatment framework platform stops the network attack, realizes the repair of the security hole treatment on the hole, and completes the protection on the security of the network;
namely, abnormal access information is prevented through abnormal access prevention in network attack, address information of abnormal information is queried through IP address searching, data access is permanently prevented through abnormal IP address, data size analysis is carried out on data information of normal communication, size analysis processing is carried out on the data information of normal communication, deep learning detection is used for detecting threat appearing in software, unauthorized access or abuse is prevented, attacks are reported to a security manager, the deep learning detection comprises a deep feed-forward network, a recurrent neural network, a convolutional neural network and a self-encoder, machine learning detection is used for detecting abnormal attacks through a computer algorithm, the machine learning detection comprises a mathematical statistics, a support vector machine, data mining, rule set and an artificial neural network, an intrusion detection data set is used for evaluating and training the necessary conditions of an intrusion detection system based on abnormal behavior detection, and the intrusion detection data set comprises a KDCup 99 data set, an NSL-KDD data set, a UNSW-NB15 data set and a CIC-IDS2017 data set;
After network attack is prevented, the vulnerability of the network is treated, the network security framework is a set of standard, rule and program formulated by network security professional institutions, and aims to help the organization to know and manage the facing network security risk, wherein the network security framework comprises NIST network security framework, ISO/IEC27001/ISO27002, CIS control framework, HIPAA and PCI-DSS, firewall protection is a technology for helping the computer network to construct a relatively isolated protection barrier between the internal network and the external network by organically combining various software and hardware equipment used for security management and screening so as to protect the security of user data and information, data backup encryption is used for realizing effective backup and encryption treatment of data information of computer resources, improving the security of the computer resources, and the encryption of the data adopts a hash algorithm for encryption treatment, vulnerability query detection is used to detect and query vulnerabilities of a computer, to implement advanced queries on vulnerabilities of the computer, vulnerability queries typically seek common vulnerabilities or defects by performing a series of tests on the system and network, including attempting to exploit known vulnerabilities, guessing default passwords or user accounts, or simply attempting to access restricted areas, vulnerability repair prevention repairs vulnerabilities obtained by vulnerability query detection, and corrections include determining priorities of vulnerabilities, determining appropriate follow-up steps, and generating correction tickets for IT team execution, and finally, correction tracking is an important tool to ensure that vulnerabilities or misconfigurations are properly resolved, system security tests are the discovery and exploitation of vulnerabilities in computer systems through penetration test software, identifying vulnerabilities in systems that may be exploited by actual attackers through simulated attacks, threat prevention software enables organizations to track, monitor, analyze, and prioritize potential threats to better protect themselves by collecting data from a variety of sources, including databases and security suggestions that are vulnerable;
The method comprises the steps of carrying out real-time query and update on the mode of network attack and the form of vulnerability and repairing the mode through big data, so that the network security is convenient to improve, the big data query system comprises a network communication module and a big database module, the network communication module is used for realizing the system query of the big database, realizing the query and acquisition of the type of the network attack, and the big database module is used for realizing the query and downloading of various network attack modes and vulnerability management modes on the network, and the particle swarm algorithm is adopted for the mode of the network attack of the big data and the form and repairing of the vulnerability, so that corresponding query can be effectively realized, and the subsequent use processing is convenient.
Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made therein without departing from the principles and spirit of the invention, the scope of which is defined in the appended claims and their equivalents.
Claims (10)
1. The network attack and security hole management framework platform based on big data analysis is characterized by comprising a network attack, security hole management and big data query system: the network attack comprises abnormal access prevention, IP address search, data size analysis, deep learning detection, machine learning detection and intrusion detection data sets, wherein the abnormal access prevention is used for preventing abnormal access information and preventing abnormal information from carrying network attacks from entering, the IP address search is used for inquiring address information of the abnormal information, the data access is permanently prevented through the abnormal IP address, the data size analysis is used for acquiring data information of normal communication and carrying out size analysis processing on the data information of the normal communication, the deep learning detection is used for detecting threat by software, preventing unauthorized access or abuse and reporting attacks to a security administrator, the machine learning detection is used for detecting the abnormal attacks through a computer algorithm, and the intrusion detection data sets are used for evaluating and training the necessary conditions of an intrusion detection system based on abnormal behavior detection;
The security vulnerability management comprises a network security framework, a firewall protection, data backup encryption, vulnerability query detection, vulnerability repair prevention and system security test, wherein the network security framework is a set of standards, criteria and programs formulated by a network security professional organization and aims to help organize to know and manage the facing network security risks, the firewall protection is a technology for helping a computer network to construct a relatively isolated protection barrier between an inner network and an outer network by organically combining various software and hardware devices for security management and screening so as to protect user data and information security, the data backup encryption is used for realizing effective backup and encryption processing of data information of computer resources and improving the security of the computer resources, the vulnerability query detection is used for realizing the detection and query of the computer, implementing early queries of computer vulnerabilities, which typically seek common vulnerabilities or flaws by conducting a series of tests on systems and networks, including attempting to exploit known vulnerabilities, guessing default passwords or user accounts, or simply attempting to access restricted areas, the vulnerability repair prevention is used to effect repair of vulnerabilities obtained by detection of the vulnerability query, and the corrections include prioritizing vulnerabilities, determining appropriate follow-up steps, and generating correction tickets for IT team execution, and finally, correction tracking is an important tool to ensure that vulnerabilities or misconfigurations are properly resolved, the system security test is to discover and exploit vulnerabilities in computer systems through penetration test software, identify vulnerabilities in systems that may be exploited by actual attackers through simulated attacks, threat protection software enables organizations to track, monitoring, analyzing and prioritizing potential threats to better protect themselves by collecting data from various sources, including databases and security suggestions that have vulnerabilities;
The big data query system comprises a network communication module and a big database module, wherein the network communication module is used for realizing the system query of the big database and the query and acquisition of the type of the network attack, and the big database module is used for realizing the query and the download of various network attack modes and vulnerability management modes on the network.
2. The cyber attack and security vulnerability management framework platform based on big data analysis of claim 1, wherein: the deep learning detection is a deep neural network used for feature extraction, perception and learning, the depth refers to the number of hidden layers in the neural network, the deep neural network comprises up to 150 hidden layers, the deep learning uses a plurality of continuous layers to execute operation, the layers are connected with each other, and each layer receives the output of the previous layer as input.
3. The cyber attack and security vulnerability management framework platform based on big data analysis of claim 2, wherein: the deep learning detection comprises a deep feedforward network, a recurrent neural network, a convolutional neural network and a self-encoder;
the deep feed forward network: the information can be transmitted from an input layer to an output layer in the feedforward neural network, and can only be transmitted unidirectionally but not reversely;
The recurrent neural network: also called a cyclic neural network, can effectively process sequence data, and unlike a deep feed forward network, the output of neurons directly acts on neurons of the layer at the next time stamp;
the convolutional neural network: the method comprises a convolution layer, a pooling layer and a full connection layer, and can effectively reduce the dimension of the image with large data volume to small data volume on the premise of keeping the picture characteristics;
the self-encoder: the non-supervision neural network model consists of an encoder and a decoder, and is mainly used for encoding an input value into an intermediate value and then decoding the intermediate value to reconstruct the input data so as to realize dimension reduction.
4. The cyber attack and security vulnerability management framework platform based on big data analysis of claim 1, wherein: the machine learning detection comprises the following algorithm:
and (5) carrying out mathematical statistics: creating a statistical model by checking normal behavior and abnormal behavior of a user or a system, wherein the statistical model is used for identifying new attacks, and the common statistical methods comprise principal component analysis, chi-square distribution and Gaussian mixture distribution;
support vector machine: the support vector machine is an effective method for detecting intrusion events under the condition of limited data samples, and the aim of the vector machine is to distinguish two types of data by using one feature vector in the most proper way;
And (3) data mining: the data mining is a common method for analyzing the behavior of a user, and is characterized in that a large amount of information is extracted from the collected mass data, and key rules are extracted by analyzing the association relation between the user and the data;
based on the rule set: analyzing attack flow in the network, extracting key rules, detecting intrusion behavior after reducing data dimension on the basis, reducing detection calculation to a certain extent, and improving detection efficiency;
artificial neural network: an artificial neural network is an intelligent information processing model that simulates the human brain to process, store and process information, the neural network obtains knowledge through learning, and stores the learned knowledge in the weights of the connection points, the model has learning and adaptation, and identifies unknown intrusions.
5. A cyber attack and security breach remediation framework platform based on big data analysis according to claim 3, wherein: the calculation formula of the convolutional neural network is as follows;
the input picture matrix and the following convolution kernel are square matrices, the size of the input matrix is w, the size of the convolution kernel is k, the step is s, the zero padding layer number is p, and the calculation formula of the size of the feature picture generated after convolution is:
The input formula is:
V＝cos v2(W,X,"valid")+b，
the output formula is:
the above input/output formula is for each convolution layer, each convolution layer has a different weight matrix W, and W, X, Y are in matrix form, for the last fully connected layer, set to the L-th layer, the output is in vector form Y L The desired output is d.
6. The cyber attack and security breach remediation framework platform based on big data analysis of claim 4, wherein: the artificial neural network adopts an AI intelligent algorithm, and the neural network of the AI intelligent algorithm inputs neuron information and corresponding weight matrix W to determine, W T X t X is a vector and W is a weight matrix, with W converting X into another vector;
information transfer from hidden layer neuron at previous moment to neuron at current moment, and its value is S t-1 And corresponding weight matrixU is determined by U T S t-1 ，S t-1 Is a vector, U is a weight matrix, and S is defined by U t-1 Converting to a further vector;
neuron h, mainly at the current moment t Integrating the inputs of the two parts, activating and generating the output of the hidden layer neuron at the current moment, wherein the integrating process is vector addition: w (W) T X t +U T S t-1 ；
After assuming that the activation function is f, the value of the neuron at the current moment is generated after activation: s is S t ＝f(W T X t +U T S t-1 )；
The information transmission is mainly to transmit the value of the hidden layer neuron at the current moment to the output neuron at the current moment:
O t ＝g(V T S t )；
the forward formula is as follows:
S t ＝f(W T X t +U T S t-1 )O t ＝g(V T S t )＝g(V T f(W T X t +U T S t-1 ))；
in the whole neural network, three weight matrices are included together, wherein the first matrix is W, the dimension of the given matrix is (N, K), N represents the vector dimension of the neuron value of the hidden layer, K represents the vector dimension of the input neural unit, the second weight matrix is V, the dimension of the matrix is (L, N), wherein P represents the vector dimension of the neuron of the output layer, and the third is the weight matrix U, and the dimension of the matrix is (N, N).
7. The cyber attack and security vulnerability management framework platform based on big data analysis of claim 1, wherein: the intrusion detection data set comprises the following:
the KDCup 99 data set is provided with marked training data and unmarked test data, and the data set has 3 characteristic attributes which are divided into basic characteristics, flow characteristics and content characteristics;
the NSL-KDD data set deletes repeated records in the KDCup 99, so that the data volume is reduced, the NSL-KDD contains basic records and data characteristics of the KDCup 99 data set, and the identified attack category is the same as the KDCup 99 data set;
Training of the UNSW-NB15 data set is to simulate a real attack environment as far as possible according to the vulnerability information technology disclosed on the CVE website by utilizing an IXIA flow generator;
the CIC-IDS2017 data set uses a CICFlowMeter tool to extract more than 80 characteristic attributes from original data, and two methods for extracting the characteristics are respectively an online mode and an offline mode; the network flow is monitored in real time in an online mode, characteristics are generated, and after monitoring is finished, the characteristic attributes are stored locally in a CSV format; the offline mode is to submit a complete packet in pcap format to the ciclowmeter tool, which gets a CSV file containing the features.
8. The cyber attack and security vulnerability management framework platform based on big data analysis of claim 1, wherein: the network security framework comprises the following components:
the NIST network security framework is an iterative method that helps organizations develop consistency to identify, evaluate and manage network security risks, whose critical infrastructure to protect may be controlled by public or private sector organizations of varying scale, complexity and technical capabilities;
ISO/IEC27001/ISO27002 covers the requirements for designing, implementing, maintaining and continuously improving information security management systems, which are analyzed by organizations based on the following factors: assessing the risk faced by the organization to identify threats, the extent of susceptibility, the likelihood of occurrence, and potential impact; law and contractual obligations that an organization must fulfill; organizing information management internal processes, programs and business requirements for its business operations;
The CIS control framework adopts a crowdsourcing mode to identify the most common network threats and define security measures to prevent the threats, including enterprise asset inventory and control, data protection, e-mail Web browser and protection, security awareness and skill training, event response management and penetration testing;
HIPAA standardizes the way in which healthcare organizations process information, outlines three major aspects of information security compliance, including the adoption of rules and procedural management safeguards, and specifies how organizations will adhere to laws; providing physical security measures for physical access control to the protected data; technical support measures for protecting software and hardware systems for processing, storing and transmitting data;
the PCI-DSS handles more and more credit card data compromise events, and the organization of the framework has to meet six control objectives including establishing and maintaining secure networks and systems, protecting cardholder data, maintaining vulnerability management plans, implementing powerful access control measures, periodically monitoring and testing networks, maintaining information security policies.
9. The cyber attack and security vulnerability management framework platform based on big data analysis of claim 1, wherein: the data backup encryption adopts a hash algorithm;
The formula of the hash algorithm is as follows:
address＝H[key]；
the hash conflict resolution algorithm of the hash algorithm comprises a linear exploration method, a secondary exploration method and a double hash method;
the formula of the linear exploration method is as follows:
hi＝(h(key)+i)％m，0≤i≤m-1；
i.e. from address d, it first probes T [ d ], then T [ d+1], … in turn, until T [ m-1], and then loops back to T [0], T [1], …, until either a free address is probed or T [ d-1 ].
10. The cyber attack and security vulnerability management framework platform based on big data analysis of claim 1, wherein: the large database module is used for inquiring and detecting a particle swarm algorithm when inquiring the network attack mode and the security hole treatment mode, and analyzing and processing the method by searching the most suitable method;
the particle swarm algorithm utilizes the sharing of information by individuals in the swarm to enable the whole swarm to generate an unordered to ordered evolution process in the problem solving process, so that the solution of the problem is obtained;
the formula of the particle swarm algorithm is as follows:
the (d+1) th iteration,
wherein:
n is the number of the particles,
c 1 individual learning factors, also known as individual acceleration factors,
c 2 The social learning factor, also known as the social acceleration factor,
w is the inertial weight of the velocity,
at the d-th iteration, the speed of the i-th particle,
f (x) the position of the ith particle in the d-th iteration,
the fitness value at the position x,
by the d-th iteration, the best position for the i-th particle to pass,
pbest d until the d-th iteration, the best position for all particles to pass.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310950455.9A CN116996286A (en) | 2023-07-31 | 2023-07-31 | Network attack and security vulnerability management framework platform based on big data analysis |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310950455.9A CN116996286A (en) | 2023-07-31 | 2023-07-31 | Network attack and security vulnerability management framework platform based on big data analysis |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116996286A true CN116996286A (en) | 2023-11-03 |
Family
ID=88522679
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310950455.9A Pending CN116996286A (en) | 2023-07-31 | 2023-07-31 | Network attack and security vulnerability management framework platform based on big data analysis |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116996286A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117240616A (en) * | 2023-11-13 | 2023-12-15 | 机械工业仪器仪表综合技术经济研究所 | Integrated risk analysis method for network physical production system under threat attack view angle |
| CN117592060A (en) * | 2024-01-18 | 2024-02-23 | 中诚华隆计算机技术有限公司 | Method and system for detecting security vulnerabilities of processor network |
| CN117590753A (en) * | 2024-01-17 | 2024-02-23 | 长春工业大学 | Unsupervised batch control method based on deep learning |
-
2023
- 2023-07-31 CN CN202310950455.9A patent/CN116996286A/en active Pending
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117240616A (en) * | 2023-11-13 | 2023-12-15 | 机械工业仪器仪表综合技术经济研究所 | Integrated risk analysis method for network physical production system under threat attack view angle |
| CN117240616B (en) * | 2023-11-13 | 2024-03-22 | 机械工业仪器仪表综合技术经济研究所 | Integrated risk analysis method for network physical production system under threat attack view angle |
| CN117590753A (en) * | 2024-01-17 | 2024-02-23 | 长春工业大学 | Unsupervised batch control method based on deep learning |
| CN117592060A (en) * | 2024-01-18 | 2024-02-23 | 中诚华隆计算机技术有限公司 | Method and system for detecting security vulnerabilities of processor network |
| CN117592060B (en) * | 2024-01-18 | 2024-04-12 | 中诚华隆计算机技术有限公司 | Method and system for detecting security vulnerabilities of processor network |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111859400B (en) | Risk assessment method, risk assessment device, computer system and medium | |
| CN116996286A (en) | Network attack and security vulnerability management framework platform based on big data analysis | |
| Singh et al. | An approach to understand the end user behavior through log analysis | |
| Li et al. | [Retracted] Intelligent Intrusion Detection Method of Industrial Internet of Things Based on CNN‐BiLSTM | |
| Muslihi et al. | Detecting SQL injection on web application using deep learning techniques: a systematic literature review | |
| Wu et al. | [Retracted] Research on Network Security Situational Awareness Based on Crawler Algorithm | |
| CN117454376A (en) | Industrial Internet data security detection response and tracing method and device | |
| Makarova | Determining the choice of attack methods approach | |
| Harbola et al. | Improved intrusion detection in DDoS applying feature selection using rank & score of attributes in KDD-99 data set | |
| Wen et al. | Detecting and predicting APT based on the study of cyber kill chain with hierarchical knowledge reasoning | |
| Lifandali et al. | Deep learning methods applied to intrusion detection: survey, taxonomy and challenges | |
| Xu | Design of intrusion detection system for intelligent mobile network teaching | |
| Al-Sanjary et al. | Challenges on digital cyber-security and network forensics: a survey | |
| Azeroual et al. | A framework for implementing an ml or dl model to improve intrusion detection systems (ids) in the ntma context, with an example on the dataset (cse-cic-ids2018) | |
| Song | Public cloud network intrusion and internet legal supervision based on abnormal feature detection | |
| Kayacik et al. | Using self-organizing maps to build an attack map for forensic analysis | |
| Ibrahim et al. | Securing E-Governance Services Based on Two Level Classification Algorithms. | |
| Abbass et al. | Evaluation of security risks using Apriori algorithm | |
| Vithalpura et al. | Analysis of fitness function in designing genetic algorithm based intrusion detection system | |
| Wagner et al. | Quantitative analysis of the mission impact for host-level cyber defensive mitigations. | |
| Kodati et al. | Ensemble Framework of Artificial immune system based on Network Intrusion Detection System for Network Security Sustainability | |
| Kumar et al. | Augmenting cybersecurity and fraud detection using artificial intelligence advancements | |
| Shao | Design and implementation of network security management system based on K-means algorithm | |
| Sahifa | Implementation of intrusion detection systems to detect phishing in the banking industry | |
| Chen | Using data mining technology to detect unknown network security threats in power system digital transformation |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |