Abstract: In order to solve the problem that there is no reliable source of access control list in network space，A hybrid access control model based on IP feature analysis is proposed. The model inclues two layers. In the first layer, by analyzing a large number of stream-based time characteristics, spatial characteristics and speed characteristics, statistics and codomain compression methods are used to dig out the correlation information differences between malicious IP streams and benign IP streams, to form a feature space based on IP characteristics. The second layer adopts the characteristics extracted from the first layer and combines unsupervised learning and supervised learning to form a access control hybrid model. Then, the access control list was generated by the access control hybrid model . This method has been tested and verified on the unsw-15 public dataset, CICIDS2017 public dataset and the data set manually collected by the author's laboratory. Experimental results show that the accuracy of this method is 100%, and the number of IP available for access control list is larger than other algorithms.

Key words: IP-based feature, access control hybrid model, access control list, hybrid model, codomain compression methods

摘要： 针对网络空间中缺乏可靠来源的访问控制列表的问题，提出了基于IP特征分析的访问控制混合模型．模型共分为2层：1）通过分析大量基于流的时间特征、空间特征和速度特征，利用统计学与值域压缩方法，挖掘恶意IP的流之间和良性IP的流之间的关联信息差异，形成基于IP特征的特征空间；2）采用1）中提取的特征，结合无监督学习和有监督学习，形成访问控制混合模型,然后通过访问控制混合模型，生成访问控制列表．提出的方法在UNSW-15公开数据集、CICIDS2017公开数据集以及作者实验室人工收集的数据集上进行了测试和验证．实验结果表明，提出的方法的精确率为100%，采用提出的方法获得的可用于访问控制列表的IP数目要多于其他人的算法．

关键词: 基于IP的特征, 访问控制混合模型, 混合模型, 访问控制列表, 值域压缩