【作者】 龚涛；

【导师】 邱德红；

【作者基本信息】 华中科技大学 ， 网络空间安全， 2023， 硕士

【摘要】 异常会话检测可以及时发现和处理非正常的用户行为,有效防止安全威胁和数据泄露,保护计算机系统的安全。现有的基于网络的异常会话检测居多通过流量分析实现,只分析会话的流量数据,而忽视了会话网络结构信息和会话路径属性信息。然而,会话的网络结构和路径属性可以为异常会话检测提供更全面的视角和更准确的判断依据,有助于发现更复杂和隐蔽的安全威胁,因此研究如何利用会话网络结构信息和会话路径属性信息进行异常会话检测具有重大意义。异构信息网络(Heterogeneous Information Network,HIN)可以综合表示会话的结构和属性信息。基于HIN表示学习提出了一种结合会话结构信息和会话路径属性信息的异常会话检测方法,将会话网络中异常会话检测问题转换为HIN上链接分类问题。然而,会话网络通常是一个复杂的HIN,对其进行有效的结构信息特征提取较为困难。此外,会话网络结构特征表示学习过程中存在有效负样本缺失和传统负采样方法样本质量差的问题。为了解决上述问题,提出采用生成对抗网络生成高质量负样本,基此构建了会话网络结构表示学习模型,该模型能够生成高质量负样本并对会话网络结构信息实现有效特征提取。在会话路径属性信息的特征提取过程中,考虑会话全部的高阶属性信息会带来很高的计算复杂度,这导致有效的属性特征提取较为困难。此外,属性之间可能存在影响检测准确性的深层交互关系,这些交互关系难以被捕捉到。为了解决上述问题,提出利用双向长短时记忆网络捕获属性之间的深层交互关系,并引入会话路径属性的概念大幅度降低了计算复杂度,基此构建了会话路径属性表示学习模型,有效提取了会话路径属性特征。最后利用会话网络结构信息和会话路径属性信息建立了异常会话检测模型,完成异常会话检测任务。综合利用会话网络结构信息和会话路径属性信息表示学习的结果,建立的异常会话检测模型能够实现更准确的异常会话检测。提出的模型在DARPA1999和UNSW-NB15数据集上进行实验,现结果表明,在DARPA1999上,模型相较于前沿的基于深度学习的异常会话检测模型,准确率提高了1.3%,F1值提高了1.4%。在UNSW-NB15上,准确率提高了2.1%,F1值提高了1.7%。这表明该模型能更为有效地检测异常会话。更多还原

【Abstract】 Abnormal session detection plays a crucial role in identifying and addressing abnormal user behaviors promptly,which effectively prevents security threats and data leakage,and safeguards computer systems.Most of the existing network-based abnormal session detection is implemented through traffic analysis,which only analyzes the session traffic data,but ignores the session network structure information and session path attribute information.However,the network structure and path attributes of sessions can provide a more comprehensive perspective and more accurate judgment basis for abnormal session detection,and help to discover more complex and covert security threats.Therefore,it is of great significance to study how to use the network structure information and path attribute information of sessions to detect abnormal sessions.Heterogeneous Information Network(HIN)can integrate the structure and attribute information of sessions.A method for detecting abnormal sessions by combining session structure information and session path attribute information is proposed based on HIN representation learning.This transforms the problem of abnormal session detection in the session network into a link classification problem on HIN.However,session networks are typically complex HINs and it is difficult to extract the features of structure information effectively.In addition,there are issues with effective negative sample lack and poor sample quality in traditional negative sampling methods during the structural feature representation learning process of the session network.To solve these problems,Generative Adversarial Network(GAN)is proposed to generate high-quality negative samples.Based on this,a session network structure representation learning model is constructed,which can generate high-quality negative samples and realize effective feature extraction of session network structure information.In the process of feature extraction of session path attribute information,considering all higher-order attribute information of session can result in high computational complexity,which makes it difficult to extract effective attribute feature.In addition,there may be deep interactions between attributes that affect detection accuracy,and these interactions are difficult to capture.In order to solve the above problems,Bidirectional Long Short-Term Memory(Bi-LSTM)is proposed to capture the deep interaction between attributes,and the concept of session path attribute is introduced to greatly reduce the computational complexity.Based on this,a session path attribute representation learning model is constructed to effectively extract the session path attribute features.Finally,the abnormal session detection model is established by using the network structure information and session path attribute information to complete the abnormal session detection task.By comprehensively utilizing the results of session network structural information and session path attribute information representation learning,the established abnormal session detection model can achieve more accurate detection of abnormal sessions.The proposed model was tested on DARPA1999 and UNSW-NB15 data sets,and the results show that compared with the cutting-edge abnormal session detection model based on deep learning,the accuracy of the model on DARPA1999 is increased by 1.3%,and the F1 value is increased by 1.4%.On UNSW-NB15,the accuracy improved by 2.1% and the F1 value by 1.7%.This shows that this model can detect abnormal sessions more effectively.更多还原