基于关联规则特征提取的网络行为被害性识别集成优化模型  

An integrated optimization model of network behavior victimization identification based on association rule feature extraction

作　　者：周胜利[1] 阮琳琦 徐睿 张熙康 赵泉喆 连远博 Zhou Shengli;RUAN Linqi;XU Rui;ZHANG Xikang;ZHAO Quanzhe;LIAN Yuanbo(Zhejiang Police College,Hangzhou 310053,China;School of Cyberspace Security,Hangzhou Dianzi University,Hangzhou 310018,China;Taizhou Taxation Bureau,Taizhou 318001,China)

机构地区：[1]浙江警察学院,浙江杭州310053 [2]杭州电子科技大学网络空间安全学院,浙江杭州310018 [3]台州市税务局,浙江台州318001

出　　处：《电信科学》2023年第9期129-140,共12页Telecommunications Science

基　　金：国家社会科学基金资助项目(No.23BGL272);浙江省自然科学基金公益研究计划项目(No.LGF20G030001);公安部科技计划项目(No.2022LL16)。

摘　　要：网络行为被害风险识别对电信网络诈骗反制预警具有重要意义。针对被害人网络行为特征规则挖掘不足、行为序列间关系难以确定等问题,提出一种基于关联规则特征提取的网络行为被害性识别集成优化模型。模型首先抓取用户访问网站时产生的交互式流量数据包,提取网络流量中的隐性和显性行为特征,再利用频繁模式增长算法挖掘特征间关联规则并重构特征序列,最后结合粒子群优化的随机森林算法,建立基于网络流量分析的电信网络诈骗被害性分析模型。实验表明,相比于普通二分类模型,所提模型具有更好的精确率和召回率,能够有效提升被害性的识别准确率。The identification of the risk of network behavior victimization was of great significance for the prevention and warning of telecom network fraud.Insufficient mining of network behavior features and difficulty in determining relationships,an integrated optimization model for network behavior victimization identification based on association rule feature extraction was proposed.The interactive traffic data packets generated when users accessed websites were captured by the model,and the implicit and explicit behavior features in network traffic were extracted.Then,the association rules between features were mined,and the feature sequences were reconstructed using the FP-Growth algorithm.Finally,an analysis model of telecom network fraud victimization based on network traffic analysis was established,combined with the stochastic forest algorithm of particle swarm optimization.The experiments show that compared with general binary classification models,the proposed model has better precision and recall rates and can effectively improve the accuracy of network fraud victimization identification.

关 键 词：网络流量分析 关联规则 网络行为 电信网络诈骗 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]