基于命令的黑客画像构建与攻击者识别方法  

Command-based hacker portrait construction and attacker identification method

作　　者：徐雅斌[1,2] 王振超 庄唯[3] XU Yabin;WANG Zhenchao;ZHUANG Wei(Computer School,Beijing Information Science&Technology University,Beijing 100101,China;Big Data Security Technology Research Institute,Beijing Information Science&Technology University,Beijing 100101,China;Suzhou Public Security Bureau Network Security Detachment,Suzhou 215000,China)

机构地区：[1]北京信息科技大学计算机学院,北京市100101 [2]北京信息科技大学大数据安全技术研究所,北京市100101 [3]苏州市公安局网络安全保卫支队,苏州市215000

出　　处：《北京信息科技大学学报（自然科学版）》2023年第2期61-68,共8页Journal of Beijing Information Science and Technology University

基　　金：国家自然科学基金资助项目(61672101);网络文化与数字传播北京市重点实验室开放课题(ICCD XN004);信息网络安全公安部重点实验室开放课题(C18601)。

摘　　要：为了快速、准确地识别出网络黑客的身份,设计了一种基于命令的黑客画像构建与识别方法。首先,构建融合注意力机制的双向长短期记忆神经网络模型来识别黑客的攻击类型;然后,提取黑客的攻击类型标签、统计特征标签与行为特征标签构成黑客画像;最后,提出了基于二次匹配的黑客识别算法,识别黑客的身份。实验结果表明,提出的黑客识别方法与现有文献中的方法相比,在准确率、精度等方面均有提升,并且识别效率与稳定性也优于与画像库中所有画像逐一比配的方法。In order to quickly and accurately identify network hackers,a method of constructing and recognizing hacker portrait based on command was designed.Firstly,a bi-directional long and short-term memory neural network model incorporating attention mechanisms was constructed to identify the type of hacker′s attack.Then,the hacker′s attack type label,statistical feature label and behavior feature label were extracted to form the hacker′s portrait.Finally,a hacker identification algorithm based on quadratic matching was proposed to identify the hacker.The experimental results show that compared with the methods in the literature,the hacker recognition method proposed has improved the accuracy,precision and other aspects,and the identification efficiency and stability are also better than the method of matching all the portraits in the portrait library one by one.

关 键 词：网络黑客 黑客画像 双向长短期记忆神经网络 注意力机制 

分 类 号：TN915.08[电子电信—通信与信息系统]