基于大数据关联规则的网络恶意行为识别检测  

Network Malicious Behavior Identification and Detection Based on Big Data Association Rules

作　　者：谢奇爱[1] 李正茂[1] XIE Qi-ai;LI Zheng-mao(School of Artificial Intelligence and Big Data,Hefei University,Hefei 230601,China)

机构地区：[1]合肥学院人工智能与大数据学院,合肥230601

出　　处：《合肥学院学报（综合版）》2021年第2期85-91,共7页Journal of Hefei University：Comprehensive ED

基　　金：省级大学生创新创业训练计划项目(201911059227,S202011059009);安徽省质量工程项目(2017mooc318,2018jyxm1105)资助。

摘　　要：为提升数据挖掘技术与网络恶意行为识别准确率,研究基于大数据关联规则的网络恶意行为识别检测方法。模糊化处理网络中存在的大数据,构建模糊数据库,分类聚集模糊数据库中的模糊数据,离散化处理模糊数据的连续属性,确定模糊数据频繁关联规则,通过基于模糊关联规则的数据挖掘方法获得整理后的网络数据;以此为基础,分析用户恶意访问流量特征,加权处理用户访问流量特征与用户信息熵特征,建立多特征融合的网络恶意行为识别模型,完成网络恶意行为识别检测。经实验验证,该方法识别检测网络恶意行为时准确率较高,在93%以上,漏检测率较低,低于8%,在数据挖掘时具有较低的时间消耗与空间消耗,支持度较高。In order to improve the accuracy of data mining technology and network malicious behavior identification,the network malicious behavior identification and detection method based on big data association rules is studied.Fuzzy processing of big data in the network,the construction of fuzzy database,classification and aggregation of fuzzy data in fuzzy database,discrete processing of continuous attributes of fuzzy data,determine the frequent association rules of fuzzy data,through the data mining method based on fuzzy association rules to get the sorted network data;on this basis,analysis of user malicious access traffic characteristics,weighted The characteristics of user access traffic and user information entropy are processed,and the network malicious behavior recognition model based on multi feature fusion is established to complete the network malicious behavior recognition and detection.The experimental results show that the accuracy of this method is higher than 93%,and the miss detection rate is lower than 8%.It has low time and space consumption and high support in data mining.

关 键 词：大数据 模糊 关联规则 网络 恶意行为 信息熵 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]