基于文本聚类的网络攻击检测方法

发布时间：2018-01-16 19:35

本文关键词：基于文本聚类的网络攻击检测方法　出处：《智能系统学报》2014年01期 　论文类型：期刊论文

【摘要】：针对Web服务应用的攻击是近年来网络上广泛传播的攻击方式,现有的攻击检测算法多采用监督学习的方法确定正常行为和攻击行为的分类边界;但由于监督检测模型在检测之前需要复杂的学习过程,往往会降低系统的实用效果。因此,根据现实中正常访问样本和攻击样本在数量和分布上的差异,提出了一种基于文本聚类的非监督检测算法。算法首先采用迭代聚类过程聚类样本,直至聚为一类;同时根据异常与正常样本的分布规律,在聚类过程中选择最优的最大类别作为正常样本类,将其余的作为异常样本类。最优方案的选择采用了使得分类误差最小的原则确定。实验表明,与多种经典检测方法相比,该方法省去了复杂的学习过程,增强了方法的适应性,具有较好的检测率和误报率。
[Abstract]:For the Web service application attacks are widely spread in recent years on the network attack classification boundary attack detection algorithm using existing supervised learning methods to determine the normal behavior and aggressive behavior; but because of supervision and inspection before the test model requires a complex learning process, often can reduce the practical effects of the system. Therefore, according to the in reality the normal access and attack sample differences in the number and distribution of samples, proposed an unsupervised detection algorithm based on text clustering algorithm. Firstly, using iterative clustering process until the clustering samples clustered into one category; at the same time according to the distribution of abnormal and normal samples, the largest category of best choice in the process of clustering as normal samples, the rest of the class. As abnormal samples, select the optimal scheme of the principle of minimum classification error is determined. Experimental results show that with the Compared with the canonical detection method, this method saves the complicated learning process, enhances the adaptability of the method, and has better detection rate and false alarm rate.

【作者单位】：南京理工大学计算机科学与技术学院;哈佛医学院Dana-Farber癌症研究所;
【基金】：国家自然科学基金资助项目(60705020) 江苏省自然科学基金资助项目(BK207594)
【分类号】：TP393.08
【正文快照】： 随着Web应用的不断普及,网络服务为越来越多的用户使用。由于许多网络应用服务开发者安全意识的缺失,致使网络服务程序中存在大量的安全漏洞,这使得Web服务器成为黑客攻击的主要目标之一。最新的CVE漏洞趋势报告[1]显示,跨站脚本攻击(XSS)、SQL注入(SQL-inject)和远程文件包含

【参考文献】