信息网络安全

信息网络安全 ›› 2017, Vol. 17 ›› Issue (11): 32-36.doi: 10.3969/j.issn.1671-1122.2017.11.005

• • 上一篇    下一篇

基于卷积神经网络的网络攻击检测方法研究

夏玉明1, 胡绍勇2, 朱少民1(), 刘丽丽3   

  1. 1. 同济大学软件学院,上海 200092
    2. 上海观安信息技术股份有限公司,上海 200013
    3. 61660部队,北京 100089
  • 收稿日期:2017-09-08 出版日期:2017-11-20 发布日期:2020-05-12
  • 作者简介:

    作者简介： 夏玉明（1980—）,男,安徽,高级工程师,硕士,主要研究方向为网络安全、软件工程;胡绍勇（1976—）,男,浙江,本科,主要研究方向为计算机应用;朱少民（1964—）,安徽,教授,博士,主要研究方向为软件工程、软件测试;刘丽丽（1977—）,女,山东,工程师,硕士,主要研究方向为网络安全。

  • 基金资助:
    国家自然科学基金[61772371]

Research on the Method of Network Attack Detection Based on Convolution Neural Network

Yuming XIA1, Shaoyong HU2, Shaomin ZHU1(), Lili LIU3   

  1. 1. Software Engineering School, Tongji University, Shanghai 200092, China
    2. Shanghai Information & Data Security Solutions Co., Ltd, Shanghai 200013, China;
    3. 61660 Troops of PLA, Beijing 100089, China
  • Received:2017-09-08 Online:2017-11-20 Published:2020-05-12

RichHTML

13

PDF (PC)

945

摘要：

现有的网络攻击检测方法有静态检测和动态检测,但两者都存在一些不足,都过多地依赖于规则,存在误报率高的问题。针对传统的网络攻击检测的不足,文章将卷积神经网络技术引入网络攻击检测领域。文章首先介绍了卷积神经网络的基本原理;接着将提取的日志特征映射到一组灰度图中进行异常检测,将网络攻击特征映射成灰度图。通过Kafka每十分钟读取大数据平台中的各项应用日志,按天将日志存入本地服务器,将相应的特征生成最新特征库并映射到灰度图,通过卷积运算可以降低噪声数据使得原始信号特征增强,从而使所学特征能更好地描述数据中的详细信息,提高分类的能力。

关键词: 网络安全, 网络攻击检测, 卷积神经网络

Abstract:

The existing network attack detection methods including static and dynamic types, and there are some shortcomings, such as too dependent on the rules, much false positives. In view of the traditional network attack detection, this paper introduces the convolution neural network technology into the field of network attack detection. In this paper, the basic principle of convolution neural network is explained in the related content of convolution neural network. In the subsequent chapters, this paper creatively maps the extracted log features to a set of gray scale images for anomaly detection, and creatively maps the network attack characteristics into a sheet of gray scale. This paper reads the application log in the large data platform every 10 minutes by Kafka, generates the latest signature library and maps it to the gray scale according to the corresponding characteristics of the local server, and can reduce the noise data by convolution operation. The original signal features are enhanced so that the features can better describe the details of the data and improve the ability to classify.

Key words: network security, network attack detection, convolution neural network

中图分类号: