基于机器学习技术的内网威胁行为发现方法的研究

An Approach of Intranet Threat Detection Based on Machine Learning

针对当前企业内网缺乏相关的安全检测手段,导致内网的各类威胁事件很难被及时发现和阻止,给企业造成不必要损失的实际情况,提出了利用机器学习技术实现内网威胁检测的解决方案,通过对孤立森林及其几类衍生机器算法基于该方案的异常检测的准确性测试比较,总结实现了一套高效准确的基于机器学习技术的内网异常检测方法。

This article addresses the situation that the current intranet lacks relevant security detection methods,which makes it difficult to detect and prevent various threats in the intranet and cause unnecessary losses to the enterprise.This article proposes the solution of using machine learning technology to achieve intranet threat detection.Through the comparison of the accuracy of anomaly detection test among isolation forest and several types of derivative machine algorithms,it summarizes and implements a set of efficient and accurate intranet anomaly detection method based on machine learning technology.