检测高级持久威胁的前性方法:使用混合优化技术
Indra Kumari1,2, Minho Lee1,2
1Department of Machine Learning Data Research, Korea Institute of Science and Technology Information (KISTI), Daejeon, 34141, Republic of Korea.
Heliyon
|November 29, 2023
概括
本研究介绍了混合HHOSSA,结合了哈里斯优化 (HHO) 和子搜索算法 (SSA),以增强高级持久威胁 (APT) 检测. 该方法优化了功能选择和数据平衡,以改善AI驱动的网络安全.
科学领域:
- 网络安全和人工智能
- 机器学习优化技术 机器学习优化技术
背景情况:
- 先进的持久性威胁 (APT) 对当前的AI检测模型构成复杂的挑战.
- 复杂的网络威胁需要新的方法来有效缓解.
研究的目的:
- 引入一个混合优化算法 (HHOSSA) 来增强APT检测.
- 优化功能选择和数据平衡,以提高AI分类器在网络安全中的性能.
主要方法:
- 通过整合哈里斯优化 (HHO) 和子搜索算法 (SSA) 开发了混合型HHOSSA.
- 在DAPT 2020数据集上应用HHOSSA进行属性选择和数据平衡 (HHOSSA-SMOTE).
- 优化的LightGBM和加权平均Bi-LSTM分类器使用HHOSSA进行超参数调整.
主要成果:
- 通过十倍的交叉验证,获得了94.468%的准确性,94.650%的灵敏性和95.230%的特异性.
- HHOSSA混合分类器显示了高的曲线下的面积 (AUC) 为97.032%.
- 在检测横向运动和数据外方面观察到显著的改进.
结论:
- HHOSSA-混合方法显著提高了APT攻击检测的准确性和有效性.
- 优化功能选择和数据平衡对于强大的基于AI的网络安全解决方案至关重要.
- 拟议的方法在打击复杂的网络威胁方面提供了有希望的进步.
相关概念视频
01:15Insensitive Nuclei Enhanced by Polarization Transfer (INEPT)
332
Insensitive Nuclei Enhanced by Polarization Transfer (INEPT) is an advanced Nuclear Magnetic Resonance (NMR) technique specifically designed to detect and enhance the signals of low-abundance nuclei, such as carbon-13 and nitrogen-15, in small molecules. The fundamental principle behind INEPT is the transfer of polarization from a more abundant and highly polarizable nucleus, typically hydrogen-1, to the low-abundance nucleus of interest. This process effectively boosts the NMR signal of the...
332
02:29Hybrid Zones
17.0K
Hybrid zones are narrow regions where two closely related species interact, mate, and produce hybrids. Relative to either parent species, hybrids may possess distinct phenotypic or genetic differences that impact their survival and reproductive success. The genetic variances introduced by hybridization influence species diversity and speciation processes within the hybrid zone.
17.0K