Research On Network Attack Event Classification Based On Representation Learning

Complex,large-scale and distributed network attack behaviors lead to the challenge of large amount of basic data,dynamic change of feature and continuous update of state in the field of network security.Attack event warning information composed of text has high dimensional characteristics,which aggravates the difficulty of feature extraction and event classification.Traditional feature extraction and classification methods cannot process the above data efficiently.Therefore,it is necessary to study automatic and efficient attack event feature extraction and classification methods in order to deal with the challenges brought by the data characteristics of scale,dynamism and high dimension.Representation learning,as a set of methods to transform data into a form that can be recognized and processed by computers,has been widely used in relevant tasks in the field of network security.Based on representation learning,this thesis studies the method of automatic attack event label alignment and feature extraction to support its efficient classification.Firstly,the attack event tags from different sources are unified to provide a consistent classification system for the classification of network attack events.Then the characteristics of network attack events are embedded into the vector space by representation learning.Finally,the neural network classification model is trained by vectorized network attack events so as to realize the automatic classification of network attack events.Based on the above analysis,this thesis mainly completed the following three aspects of work:(1)Representation learning is adopted to solve the problem that the expression forms of attack event label data from different sources are not uniform,including the automatic label alignment algorithm based on syntax rules and the automatic label alignment model based on semantic features.And the effectiveness of the algorithm in different scenarios is verified by multi-classification F1 value and visualization effect.(2)Automated feature extraction and classification of attack events based on representation learning is used to solve the problem of difficult feature extraction and classification of network attack events.Firstly,the vectored attack events are obtained by representation learning,and then the vectored attack events are used to train the neural network classification model.Finally,a variety of neural network classification algorithms are fused by voting,which improves the event classification accuracy by 2%.(3)The network attack event classification system based on representation learning is designed and implemented.It integrates the research algorithm into the corresponding modules and uses a good user interface to complete the task of classification.Its input is the unlabeled network attack event and output is the tag classification corresponding to the event.Compared with the traditional feature engineering method,the network attack event feature extraction based on representation learning can find the potential features of the data,which is helpful to improve the efficiency of attack event classification,so as to provide timely and accurate basic data for the subsequent network security assessment and prediction tasks.