面向社会安全事件的分布式神经网络攻击行为分类方法

大数据时代下，社会安全事件呈现出数据多样化、数据量快速递增等特点，社会安全事件的事态与特性分析决策面临巨大的挑战。高效、准确识别社会安全事件中的攻击行为的类型，并为社会安全事件处置决策提供帮助，已经成为国家与网络空间安全领域的关键性问题。针对社会安全事件攻击行为分类，提出一种基于Spark平台的分布式神经网络分类算法（DNNC）。DNNC算法通过提取攻击行为类型的相关属性作为神经网络的输入数据，建立了各属性与攻击类型之间的函数关系并生成分布式神经网络分类模型。实验结果表明，所提出DNNC算法在全球恐怖主义数据库所提供的数据集上，虽然在部分攻击类型上准确率有所下降，但平均准确率比决策树算法提升15.90个百分点，比集成决策树算法提升8.60个百分点。

Distributed neural network for classification of attack behavior to social security events

In the era of big data, the social security data becomes more diverse and its amount increases rapidly, which challenges the analysis and decision of social security events significantly. How to accurately categorize the attack behavior in a short time and support the analysis and decision making of social security events becomes an urgent problem needed to be solved in the field of national and cyberspace security. Aiming at the behavior of aggression in social security events, a new Distributed Neural Network Classification (DNNC) algorithm was proposed based on the Spark platform. The DNNC algorithm was used to analyze the related features of the attack behavior categories, and the features were used as the input of the neural network. Then the function relationship between the individual features and attack categories were established, and a neural network classification model was generated to classify the attack categories of social security events. Experimental results on the data provided by the global terrorism database show that the proposed algorithm can improve the average accuracy by 15.90 percentage points compared with the decision tree classification, and by 8.60 percentage points compared with the ensemble decision tree classification, only decreases the accuracy on part attack type.