信息安全研究 ›› 2025, Vol. 11 ›› Issue (4): 343-.

• 学术论文 • 上一篇    下一篇

基于行为聚类的LSTMNN模型恶意行为检测方法

付安棋李剑   

  1. (北京邮电大学网络空间安全学院北京100876)
  • 出版日期:2025-04-30 发布日期:2025-05-01
  • 通讯作者: 李剑 博士,教授,博士生导师.主要研究方向为量子安全通信、人工智能、区块链技术. lijian@bupt.edu.cn
  • 作者简介:付安棋 硕士研究生.主要研究方向为网络空间安全、区块链技术. fuuanq@bupt.edu.cn 李剑 博士,教授,博士生导师.主要研究方向为量子安全通信、人工智能、区块链技术. lijian@bupt.edu.cn

Malicious Behavior Detection Method Based on Behavior Clustering LSTMNN#br#

Fu Anqi and Li Jian   

  1. Fu Anqi and Li Jian
    (School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876)
  • Online:2025-04-30 Published:2025-05-01

摘要: 随着社会的发展,人们对于公共场所的安全性要求进一步提高,进行恶意行为检测能实时监测和识别潜在的安全危害.针对恶意行为形式和背景呈现多样化,同时不同恶意行为出现的频次差别巨大导致的恶意行为检测困难问题,采用Kmeans聚类方法划分子数据集,对不同形式的恶意行为进行区分,同时用DTW(dynamic time warping)时间规整方法解决恶意行为时间序列长短不一致的问题,为解决图像识别问题中恶意行为帧集数据量过大使得模型计算精度不高,采用Attention机制关注特殊信息点,以确保模型训练的精度.该方法应用于UBIFights的恶意行为数据集,结果显示,经过加权平均计算的聚类划分后的子数据集最终分类准确率达到95.03%.该模型有效识别恶意行为视频,提高了安全性.

关键词: 恶意行为检测, 聚类方法, LSTM分类, 注意力机制, DTW算法

Abstract: With the progress and development of society, the safety requirements for public places have further increased. Malicious behavior detection can monitor and identify potential safety hazards in real time. To solve this problem, the Kmeans clustering method is used to divide the molecular data set and distinguish different forms of malicious behavior. To solve this problem, the Kmeans clustering method is used to divide the subdatasets to distinguish different forms of malicious behaviors. The DTW time warping method solves the problem of inconsistent lengths of malicious behavior time series. In order to solve the problem of image recognition, the excessive amount of data in the malicious behavior frame set makes the model calculation accuracy low, and the Attention mechanism is used to focus on special information points to ensure the accuracy of model training. This method was applied to the malicious behavior data set of UBIFights. The results showed that the final classification accuracy of the subdataset after clustering division by weighted average calculation reached 95.03%. This model effectively identifies malicious behavior videos and improves safety.

Key words: malicious behavior detection, clustering methods, LSTM classification, attention mechanism, dynamic time warping

中图分类号: