基于邻域粗糙集的极限学习机恶意DoH流量预警

Malicious DoH traffic warning of extreme learning machine based on neighborhood rough sets

在对网络安全发起攻击的恶意DoH流量数据中,存在属性特征影响恶意DoH流量攻击目标达成,使用基于邻域粗糙集的极限学习机决策分析方法建立恶意DoH流量预警模型,可为恶意DoH流量预警提供决策支持。首先运用邻域粗糙集属性约简算法对高维DoH流量特征进行降维,并得到约简后的属性重要度,然后利用极限学习机算法测试评估约简后的属性特征对数据样本的分类正确率。应用实例表明,在保证样本类别比例与原数据集一致的前提下,约简后的属性特征对样本数据具有足够高的分类准确率,验证了文中所提基于邻域粗糙集的极限学习机决策分析方法能有效地简化恶意DoH流量安全评价的复杂度。

In the malicious DNS over HTTPS(DoH)traffic data that threat the network security,attribute features can be used to interfere the attack.The extreme learning machine method based on neighborhood rough sets is adopted to establish a malicious DoH traffic early warning model.This model can provide decision support for malicious DoH traffic early warning.First,the neighborhood rough set attribute reduction algorithm is used to reduce the dimension of high⁃dimensional DoH traffic features,and the attribute significance after reduction is obtained.Second,the extreme learning machine algorithm is used to test and evaluate the classification accuracy of the reduced attribute features against the data samples.The experiment shows that on the premise of the consistency between the sample category proportion and the original data set,the reduced attribute features have high enough classification accuracy for the sample data.This demonstrates that the extreme learning machine decision analysis method based on neighborhood rough sets can effectively simplify the complexity of the security evaluation for malicious DoH traffic.