一种时序驱动的Web攻击行为同源分析方法OA

To address the problems that existing network attack homology analysis methods suffer from insufficient measurement of attack behavior similarity and low accuracy in multi-density samples and high-noise scenarios,a time series driven homology analysis method for Web attack behaviors is pro-posed.Firstly,3 categories of 20 Web attack alert features are extracted to construct attack series.Then,a similarity algorithm for attack series is proposed to calculate the similarity between sequences and construct a distance matrix.Finally,a clustering algorithm is designed based on the distance ma-trix to cluster attack sequences,thereby realizing attack homology analysis.Different from traditional methods relying only on statistical feature analysis,the proposed method incorporates the temporal cor-relation of attack behaviors into homology analysis and effectively improves the accuracy of Web attack homology analysis.Experimental results show that the key indicator ARI of the method reaches 94.9%in noisy environments,verifying that its homology analysis performance outperforms other methods.Meanwhile,the method can maintain stable performance within a wide range of parameters.