Host operation instruction exception identification method and system

• Main Authors: YIN QIAN'AN, XU MING, LIU SHENG, TAO JINGLONG, WANG QIFAN, YU XIANZHE, LIANG SHUYUN, ZHOU XIAOYONG, MA YING, WEI GUOFU
• Format: Patent
• Language: Chinese; English
• Published: 12.05.2020
• Subjects: CALCULATING; COMPUTING; COUNTING; ELECTRIC DIGITAL DATA PROCESSING; PHYSICS

The invention provides a host operation instruction exception identification method and system. The method comprises the following steps: S1, extracting sample data; S2, carrying out data processing;obtaining a behavior sequence record and the use frequency of each host operation instruction; S3, screening non-common instructions to obtain a target operation instruction sequence; S4, training a compact prediction tree to obtain a target compact prediction tree; S5, carrying out compact prediction tree prediction to acquire a training data set with a label; S6, training an operation instruction vector by utilizing word2vec to form a pre-training vector; S7, establishing a classification and identification model by using Bi-LSTM; and S8, performing prediction by utilizing the classificationmodel. According to the method, user host operation instruction sequences are analyzed by adopting the compact prediction tree, and a behavior relationship between the instruction behavior sequencesis researched, so that whet