Knowledge Graph Based Large Scale Network Security Threat Detection Techniques

Abstract

This paper constructs a detection technique for large-scale network security threats based on a knowledge graph, extracts the attack features of network security threats using feature template FT, and combines the CNN layer, BiLSTM layer and CRF layer to establish FT-CNN-BiLSTM-CRF large-scale network security threat detection technique. Network security threat performance evaluation experiments and multi-step attack experiments have verified the detection capability of this paper's method. The recall rate of the method built in this paper in detecting malicious data is about 62.39%, the average F1-Score for normal and malicious traffic detection is 0.7482, and the anomaly score for normal traffic detection is almost 0. The detection performance of this paper's method for multi-step network attacks is superior to that of other methods, and it is capable of detecting malicious attacks quickly. Experiments have proved that the method constructed in this paper can meet the requirements of detection capability and efficiency in large-scale network security threats and has high feasibility and application value.

Keywords

• knowledge graph
• network security threat
• multi-step attack
• anomaly score distribution
• ft-cnnbilstm-crf
• 05c82