基于深度特征和Seq2Seq模型的网络态势预测方法

针对目前大多数的网络态势预测方法不能挖掘数据中的深度信息且需要手动提取与构造特征的问题，提出了深度特征网络态势预测方法DFS-Seq2Seq。首先将网络流、日志和系统事件等产生的数据进行清洗处理，使用深度特征融合算法自动合成深度关系特征，然后采用自动编码器对合成的特征进行提取，最后使用长短期记忆网络（LSTM）构建Seq2Seq模型对数据进行预测。通过设计缜密的实验在公开数据集Kent2016上对所提方法进行验证，结果显示在深度为2时与支持向量机（SVM）、贝叶斯、随机森林（RF）和LSTM这四种分类模型相比，其召回率分别提升了7.4%、11.5%、6.5%、3.0%。实验结果表明DFS-Seq2Seq可以在实际应用中有效地识别网络身份验证中的危险事件，对网络态势作出有效的预测。

Network situation prediction method based on deep feature and Seq2Seq model

In view of the problem that most existing network situation prediction methods are unable to mine the deep information in the data and need to manually extract and construct features, a deep feature network situation prediction method named DFS-Seq2Seq (Deep Feature Synthesis-Sequence to Sequence) was proposed. First, the data produced by network streams, logs and system events were cleaned, and the deep feature synthesis algorithm was used to automatically synthesize the deep relation features. Then the synthesized features were extracted by the AutoEncoder (AE). Finally, the data was estimated by using the Seq2Seq (Sequence to Sequence) model constructed by Long Short-Term Memory (LSTM). Through a well-designed experiment, the proposed method was verified on the public dataset Kent2016. Experimental results show that when the depth is 2, compared with four classification models including Support Vector Machine (SVM), Bayes, Random Forest (RF) and LSTM, the proposed method has the recall rate increased by 7.4%, 11.5%, 6.5% and 3.0%, respectively. It is verified that DFS-Seq2Seq can effectively identify dangerous events in network authentication and effectively predict network situation in practice.