由于实现方式简单、攻击形式多样、威胁范围广、不易防御和区分,拒绝服务(DoS)攻击已经成为网络的最主要安全威胁之一。该文提出了一种ITCM-KNN算法,在此基础上建立了DoS检测框架。使用标准数据集KDD Cup 1999进行算法验证和分析实验。...由于实现方式简单、攻击形式多样、威胁范围广、不易防御和区分,拒绝服务(DoS)攻击已经成为网络的最主要安全威胁之一。该文提出了一种ITCM-KNN算法,在此基础上建立了DoS检测框架。使用标准数据集KDD Cup 1999进行算法验证和分析实验。采用基于信息增益算法选择了5个特征,在保证高检测效果的同时减少了特征的维数。该算法不需要对攻击进行学习和建模,使用少量的正常样本作为训练集,提高了检测性能。实验结果表明,改进的TCM-KNN算法检测率高于SVM等算法,达到99.99%。展开更多
By network security threat intelligence analysis based on a security knowledge graph(SKG), multi-source threat intelligence data can be analyzed in a fine-grained manner. This has received extensive attention. It is d...By network security threat intelligence analysis based on a security knowledge graph(SKG), multi-source threat intelligence data can be analyzed in a fine-grained manner. This has received extensive attention. It is difficult for traditional named entity recognition methods to identify mixed security entities in Chinese and English in the field of network security, and there are difficulties in accurately identifying network security entities because of insufficient features extracted. In this paper, we propose a novel FT-CNN-BiLSTM-CRF security entity recognition method based on a neural network CNN-BiLSTM-CRF model combined with a feature template(FT). The feature template is used to extract local context features, and a neural network model is used to automatically extract character features and text global features. Experimental results showed that our method can achieve an F-score of 86% on a large-scale network security dataset and outperforms other methods.展开更多
文摘由于实现方式简单、攻击形式多样、威胁范围广、不易防御和区分,拒绝服务(DoS)攻击已经成为网络的最主要安全威胁之一。该文提出了一种ITCM-KNN算法,在此基础上建立了DoS检测框架。使用标准数据集KDD Cup 1999进行算法验证和分析实验。采用基于信息增益算法选择了5个特征,在保证高检测效果的同时减少了特征的维数。该算法不需要对攻击进行学习和建模,使用少量的正常样本作为训练集,提高了检测性能。实验结果表明,改进的TCM-KNN算法检测率高于SVM等算法,达到99.99%。
基金the National Natural Science Foundation of China (No. 61802081)the Guizhou Provincial Natural Science Foundation, China (No. 20161052)+2 种基金the Guizhou Provincial Public Big Data Key Laboratory Open Project, China (No. 2017BDKFJJ024)the Guizhou University Doctoral Fund, China (No. 201526)the Major Scientific and Technological Special Project of Guizhou Province, China (No. 20183001).
文摘By network security threat intelligence analysis based on a security knowledge graph(SKG), multi-source threat intelligence data can be analyzed in a fine-grained manner. This has received extensive attention. It is difficult for traditional named entity recognition methods to identify mixed security entities in Chinese and English in the field of network security, and there are difficulties in accurately identifying network security entities because of insufficient features extracted. In this paper, we propose a novel FT-CNN-BiLSTM-CRF security entity recognition method based on a neural network CNN-BiLSTM-CRF model combined with a feature template(FT). The feature template is used to extract local context features, and a neural network model is used to automatically extract character features and text global features. Experimental results showed that our method can achieve an F-score of 86% on a large-scale network security dataset and outperforms other methods.
