基于改进递归残差网络的伪装入侵行为识别  

Camouflage intrusion behavior identification based on improved recursive residual network

作　　者：刘晓捷 LIU Xiaojie(State Grid Shanxi Electric Power Company,Taiyuan 030021,China)

机构地区：[1]国网山西省电力公司,山西太原030021

出　　处：《电子设计工程》2024年第13期55-59,共5页Electronic Design Engineering

基　　金：国网山西省电力公司科研项目(SX2202345)。

摘　　要：为解决由于存在不平衡数据导致伪装入侵识别不精准的问题,提出基于改进递归残差网络的伪装入侵行为识别方法研究。对数据入侵行为的伪装特征进行分析;构建改进递归残差网络结构,使用Softmax分类器处理不均衡数据。通过引入损失函数,避免数据在训练时过度拟合。采用peer-to-peer的伪装入侵检测技术,计算入侵行为特征间隔,获取入侵行为伪装特征归属度,实现伪装入侵行为识别。由实验结果可知,在畸形报文、可选段、扫描窥探攻击形式下,与数据分别存在最大为10、0、0 bit的误差,由此可证明应用所研究方法识别结果更精准。In order to solve the problem of inaccurate camouflage intrusion identification due to the existence of unbalanced data,a camouflage intrusion behavior identification method based on improved recursive residual network is proposed.The camouflage characteristics of data intrusion are analyzed.An improved recursive residual network structure is constructed,and Softmax classifier is used to process unbalanced data.The loss function is introduced to avoid data over-fitting during training.The peer-topeer camouflage intrusion detection technology is used to calculate the characteristic interval of the intrusion behavior,obtain the attribution degree of the camouflage characteristics of the intrusion behavior,and realize the identification of the camouflage intrusion behavior.It can be seen from the experimental results that in the form of malformed messages,selectable segments,and scanning snooping attacks,there is a maximum error of 10 bit,0 bit,and 0 bit with the data,which can prove that the recognition results of the research method are more accurate.

关 键 词：改进递归残差网络 伪装入侵 行为识别 PEER-TO-PEER 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]