关键词: 伪装用户入侵检测, 深度神经网络, 卷积神经网络, 长短期记忆人工神经网络

Abstract: The intrusion detection of internal malicious users, as an active security protection technology, has been a hot research topic in recent years. Existing methods are unable to accurately model the users?? behavior. This paper proposes a novel CCNN-LSTM method which combines the convolution neural network (CNN) and long short-term memory (LSTM) neural network for camouflage intrusion detection. The basic idea is to use convolution neural network to capture the local correlation in users?? activity data, and use long short-term memory neural network to deal with sequential relationship and long-range dependency. The proposed method can automatically learn the representation of data without artificial extraction of complex features, and can also scale to large volume of high dimensional data. The experimental results show that the proposed method has higher detection rate and lower detection cost than a number of baselines.

Key words: intrusion detection of malicious users, depth neural network, convolution neural network, long and short-term memory artificial neural network