At present,the severe network security situation has put forward high requirements for network security defense technology.In order to automate botnet threat warning,this paper researches the types and characteristics...At present,the severe network security situation has put forward high requirements for network security defense technology.In order to automate botnet threat warning,this paper researches the types and characteristics of Botnet.Botnet has special characteristics in attributes such as packets,attack time interval,and packet size.In this paper,the attack data is annotated by means of string recognition and expert screening.The attack features are extracted from the labeled attack data,and then use K-means for cluster analysis.The clustering results show that the same attack data has its unique characteristics,and the automatic identification of network attacks is realized based on these characteristics.At the same time,based on the collection and attribute extraction of Botnet attack data,this paper uses RF,GBM,XGBOOST and other machine learning models to test the warning results,and automatically analyzes the attack by importing attack data.In the early warning analysis results,the accuracy rates of different models are obtained.Through the descriptive values of the three accuracy rates of Accuracy,Precision,and F1_Score,the early warning effect of each model can be comprehensively displayed.Among the five algorithms used in this paper,three have an accuracy rate of over 90%.The three models with the highest accuracy are used in the early warning model.The research shows that cyberattacks can be accurately predicted.When this technology is applied to the protection system,accurate early warning can be given before a network attack is launched.展开更多
基金The research of this paper is supported by the project of Jiangsu Provincial Department of Education(20KJB413002)the science and technology research project of Jiangsu Provincial Public Security Department(2020KX007Z)+2 种基金the Jiangsu Police Institute high level talent introduction research start-up fund”(JSPIGKZ,JSPI20GKZL404)the 2021 doctor of entrepreneurship and innovation in Jiangsu Province(JSSCBS20210599)the Undergraduate Innovation and Entrepreneurship Training Program of Jiangsu Police College(No.202110329053Y)。
文摘At present,the severe network security situation has put forward high requirements for network security defense technology.In order to automate botnet threat warning,this paper researches the types and characteristics of Botnet.Botnet has special characteristics in attributes such as packets,attack time interval,and packet size.In this paper,the attack data is annotated by means of string recognition and expert screening.The attack features are extracted from the labeled attack data,and then use K-means for cluster analysis.The clustering results show that the same attack data has its unique characteristics,and the automatic identification of network attacks is realized based on these characteristics.At the same time,based on the collection and attribute extraction of Botnet attack data,this paper uses RF,GBM,XGBOOST and other machine learning models to test the warning results,and automatically analyzes the attack by importing attack data.In the early warning analysis results,the accuracy rates of different models are obtained.Through the descriptive values of the three accuracy rates of Accuracy,Precision,and F1_Score,the early warning effect of each model can be comprehensively displayed.Among the five algorithms used in this paper,three have an accuracy rate of over 90%.The three models with the highest accuracy are used in the early warning model.The research shows that cyberattacks can be accurately predicted.When this technology is applied to the protection system,accurate early warning can be given before a network attack is launched.
