基于集成模型的网络行为数据流敏感目标跟踪和检测技术研究

Increasing threats from cyber attacks have prompted various defenses to emerge. The current identification and detection of malicious behaviors in network flows is mainly based on the transient detection of the information content layer. It does not comprehensively track the network environment data and historical behavior data of sensitive target users. To this end, it is proposed to start from the suspicious / malicious target tracking and detection requirements of multi-dimensional network behavior data flow, and conduct research in the user dimension, content dimension, and multiple decision dimension: 1. User dimension: To propose a user sensitive / malicious network behavior portrait model. It can realize long-distance multi-dimensional spatial tracking analysis of user suspicious behavior categories on the data stream. By collecting network behavior data of network users, a category portrait model is constructed that correlates malicious behaviors and attacks. 2. Content dimension: Although the traditional integrated learning model can improve the accuracy and stability of discrimination, its application to multi-source data streams will reduce the accuracy and speed of discrimination. To this end, the subject considers building a high-performance joint detection model for multi-dimensional multi-source network behavioral data streams in the integrated model foundation. 3. Multiple decision dimension: A multiple decision model based on artificial intelligence optimization theory is proposed to realize intelligent and accurate tracking and detection of user sensitive / malicious attack behaviors. The above research results will effectively promote the development of suspicious target recognition tracking and sensitive detection technology in cyberspace.

日益增长的网络攻击威胁促使各种防御应运而生，当前网络流恶意行为识别与检测主要基于信息内容层的暂态检测，未综合全面跟踪敏感目标用户所在的网络环境数据和历史行为数据。为此，拟从多维网络行为数据流可疑/恶意目标跟踪和检测需求出发，在用户维、内容维和多元决策维开展研究：1.用户维：拟提出用户敏感/恶意网络行为画像模型，该模型可在数据流上对用户可疑行为类别实现远距离多维空间跟踪分析。通过收集网络用户的网络行为数据，构造关联恶意行为和攻击的类别画像模型。2.内容维：尽管传统集成学习模型能够提高判别的精度和稳定性，但是应用到多源数据流上会使判别的精度和速度下降。为此，课题在集成模型基础中考虑对多维多源网络行为数据流构建高性能联合检测模型。3.多元决策维：拟提出基于人工智能优化理论的多元决策模型，实现用户敏感/恶意攻击行为的智能精准跟踪检测发现。上述研究成果将有效推进网络空间可疑目标识别跟踪和敏感检测技术的发展。

日益增长的网络安全威胁促使各种防御应运而生，当前网络流敏感行为识别与检测主要基 于文本关键词分析，未全面考虑文本所在的网络上下文环境，如文本所在内容语义、用户行为 类别和多通道距离。为此，从行为数据流目标跟踪和敏感检测出发，在用户维、内容维和多通道多元调度维开展研究：1.用户维：提出了目标可疑行为类别预测模型，该模型在多种场景数据流上对用户类别实现多模态目标跟踪识别。通过收集网络用户的行为数据，构造关联用户行为和敏感类别的预测模型。2.内容维：尽管传统集成学习模型能够提高判别的精度和稳定性，但是应用到数据流上会使判别的速度下降。为此，在混合集成多模型环境中考虑对多分类器构建索引来提高检测效率。3.多元调度维：拟提出基于人工智能优化理论的自适应检测单元排序模型。实现流检测自适应优化。课题围绕基于集成模型的流数据开展检测学习，研究成果将有效推进网络空间复杂场景下多模态远距离目标识别跟踪和敏感信息检测技术的发展。