【摘要】 数据分类在网络安全防护与监测预警中发挥着重要作用。随着网络系统规模的扩大、网络速度的提高以及网络安全事件的增多,安全数据的数量急剧增加,极大影响了数据分类的准确性,从而给入侵检测、安全评估、攻击意图识别等安全应用带来极大挑战。文章提出一种结合SMOTE-SVM算法和XGBoost算法的数据分类模型。首先,针对数据不平衡的情况,采用过采样和下采样相结合的方法,设计一种基于SMOTE-SVM算法的数据特征平衡方法,提高了训练数据分布的合理性和训练精度。然后,针对多源异构的安全数据的多样性特点,采用独热编码技术实现数据的规范化。最后,基于XGBoost算法对数据集进行特征提取和分类。实验结果表明,该方法在数据分类查准率、召回率和综合有效性方面具有明显优势,能有效提高网络安全大数据的分析能力,对网络安全态势感知具有重要的应用意义。更多还原

【Abstract】 Data classification plays an important role in cyberspace security situational awareness applications. However, with the expansion of network system scale, the increase of network speed, and the increase of network security incidents, the number of security data increases dramatically, which greatly affects the accuracy of data classification, thus bringing great challenges to security applications such as intrusion detection, security assessment and attack intention recognition. This paper proposes a data classification model integrating SMOTE-SVM algorithm and XGBoost algorithm. Firstly, in view of the data imbalance situation, by combining with up-sampling and down-sampling, a data feature balance method based on SMOTE-SVM algorithm is designed to improve the rationality of training data distribution and training accuracy. Then, in view of the diversity of multisource heterogeneous security data, single-hot coding technology is used to standardize the data. Finally, based on XGBoost algorithm, feature extraction and classification of data sets are carried out. Experimental results show that the proposed method has obvious advantages in data classification accuracy, recall rate and comprehensive effectiveness. It can effectively improve the analysis ability of large data of network security, and has important application significance for network security situational awareness.更多还原