基于改进递归残差网络的伪装入侵行为识别

Camouflage intrusion behavior identification based on improved recursive residual network

为解决由于存在不平衡数据导致伪装入侵识别不精准的问题,提出基于改进递归残差网络的伪装入侵行为识别方法研究。对数据入侵行为的伪装特征进行分析;构建改进递归残差网络结构,使用Softmax分类器处理不均衡数据。通过引入损失函数,避免数据在训练时过度拟合。采用peer-to-peer的伪装入侵检测技术,计算入侵行为特征间隔,获取入侵行为伪装特征归属度,实现伪装入侵行为识别。由实验结果可知,在畸形报文、可选段、扫描窥探攻击形式下,与数据分别存在最大为10、0、0 bit的误差,由此可证明应用所研究方法识别结果更精准。

In order to solve the problem of inaccurate camouflage intrusion identification due to the existence of unbalanced data,a camouflage intrusion behavior identification method based on improved recursive residual network is proposed.The camouflage characteristics of data intrusion are analyzed.An improved recursive residual network structure is constructed,and Softmax classifier is used to process unbalanced data.The loss function is introduced to avoid data over-fitting during training.The peer-topeer camouflage intrusion detection technology is used to calculate the characteristic interval of the intrusion behavior,obtain the attribution degree of the camouflage characteristics of the intrusion behavior,and realize the identification of the camouflage intrusion behavior.It can be seen from the experimental results that in the form of malformed messages,selectable segments,and scanning snooping attacks,there is a maximum error of 10 bit,0 bit,and 0 bit with the data,which can prove that the recognition results of the research method are more accurate.