基于机器学习的恶意命令检测方法  

Machine Learning-based Malicious Command Detection

作　　者：左自清 施勇[1] 薛质[1] ZUO Zi-qing;SHI Yong;XUE Zhi(Shanghai Jiaotong University,Shanghai 200240,China)

机构地区：[1]上海交通大学,上海200240

出　　处：《通信技术》2020年第11期2775-2779,共5页Communications Technology

基　　金：国家重点研发计划项目“网络空间安全”重点专项(2017YFB0803200)。

摘　　要：目前,基于用户输入频率的恶意命令检测准确率偏低,而基于用户行为模式或时序性关联的方法则普遍建立在组块包含了恶意行为全部信息的前提上,这一前提很难在真实环境下满足。针对上述问题,首先提出一种基于用户输入频率的机器学习方法,在SEA数据集上取得了很好的效果。进一步设计了一种基于不完全恶意用户命令信息的识别方法,实验表明该方法同样具有较好的检测能力。At present,the detection accuracy of malicious commands based on user input frequency is usually low,while methods based on user behavior patterns or temporal associations are generally based on the premise that the block contains all the malicious behavior information,which is difficult to meet in a real environment.In response to the above problems,a machine learning method based on user input frequency is first proposed,which achieves good results on the SEA data set,and then a recognition method based on incomplete malicious user command information is further designed.Experiments indicate that this method also has better detection capabilities.

关 键 词：恶意命令检测 机器学习 命令序列 内部伪装攻击 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]