基于神经网络和遗传算法的网络安全事件分析方法

Network Security Events Analyze Method Based on Neural Networks and Genetic Algorithm

传统网络安全事件分析方法较多依赖人工干预,针对该问题提出了一种具备更高自适应能力和自动化程度的网络安全事件分析方法,利用神经网络模型对多种异构事件源产生的数据进行分析,按照不同攻击场景自动分类,基于分类结果提取规则项,利用遗传算法自动生成针对不同攻击场景的关联规则.实验结果表明,该方法可自动完成事件分类和关联规则生成,是对传统方法的有效增强和改进.

The traditional network security events analysis methods depend more on human interventions. To address this problem, an automatic and self-adaptive method is presented. The neural network models are used to classify amounts of security events according to various attack scenarios, which can reduce much human intervention. The rule items are extracted from the classification results. And the correlation rules are generated automatically from these items using genetic algorithm. Experiments demonstrate that the method can classify the network security events and generate association rules automatically, so that the degree of automation can be improved. It is an effective enhancement and improvement to the traditional methods.