| With the emergence of various network technologies and the development of network applications,network threats have become more complex and diverse.While threat detection technology has continuously improved with the emergence of new attacks,it has been challenged by new technologies.As a result,proposing an effective threat detection technology to identify unknown attacks has become a critical task for network security.Currently,most existing insider threat detection technologies rely on machine learning methods.However,these methods require complex feature engineering,and often disregard the timing sequence and multidimensionality of user behavior.Intrusion detection is a proven technique for detecting external threats,but existing algorithms require a significant number of labeled samples for model training,and often need to retrain the model when new types of attacks emerge.To address these issues,this thesis applies user and entity behavior analysis techniques to detect threat,and conducts an in-depth study of the detection algorithms for internal and external threats.The specific research contents are as follows.(1)An insider threat detection model based on LSTM-Attention user behavior analysis is proposed.This method comprehensively takes into account user behavior,role behavior,and psychological data.It describes user behavior through multi-dimensional daily activities and also considers the time sequence of user behavior.Firstly,the LSTM-Attention algorithm is employed to model both user and role behaviors.Secondly,the MLP algorithm is utilized to make a comprehensive decision on user behavior,role behavior,and user psychological score,enabling the detection of insider threats.Evaluated on the CERT dataset,the algorithm achieves a 96.4% AUC score,which is superior to existing Insider threat detection algorithms.This not only addresses the drawback of being unable to perform insider threat detection when a new user appears but also improves the AUC score of the algorithm.(2)A network intrusion detection algorithm based on IG-FCBF-TL traffic behavior analysis is proposed.The proposed algorithm initially preprocesses the data and performs IG-FCBF feature engineering.Subsequently,three CNN models,namely VGG16,Inception,and Xception,are selected as basic learning models.The Tree-Structured Parzen Estimator(TPE)algorithm is then employed to optimize the hyperparameters on the datasets.Finally,the ensemble method of confidence averaging is utilized to integrate the three optimized CNN models,achieving higher accuracy in network intrusion detection.It achieved over 99% accuracy on both CICIDS2017 and NSL-KDD datasets,which also proves that the model has good generalization ability.This method addresses the issues of insufficient network traffic data and the high cost associated with collecting samples in the field of intrusion detection.(3)The host intrusion detection algorithm based on Tfidf Vectorizer and Siamese LSTM network entity behavior analysis is proposed.Firstly,the algorithm utilizes Tfidf Vectorizer to vectorize the system call sequence.It then applies the few-shot learning algorithm of the Siamese LSTM network based on similarity to analyze the behavior of the host and achieve the purpose of host intrusion detection.Through evaluation of the ADFA-LD dataset,its detection accuracy for various attack types using a small number of training samples exceeded 96%.This approach can not only identify unknown attacks but also resolves the issue of existing host intrusion detection algorithms relying on a large number of high-quality labeled samples for model training. |
