无线电工程

随着网络攻击活动日益猖獗，网络基础设施与重要信息系统面临着严峻的安全挑战。传统的网络威胁检测方法往往只能检测已知的安全威胁，无法检测出未知、复杂的网络威胁行为，同时还存在检测速度慢、资源消耗大等问题。为此，基于知识图谱与图数据库Neo4j,设计并实现了可动态识别并学习新型攻击的网络威胁行为分析系统。利用知识图谱对网络威胁行为进行描述，采用自学习方式来动态更新威胁知识图谱，以应对复杂化的网络攻击，提高对网络威胁行为的检测效率与准确率。基于Flume+Kafka+Storm的平台架构，对网络威胁行为数据进行处理，提升了知识图谱各节点之间的遍历搜索速度，加快了网络威胁行为识别效率。系统解决了传统入侵检测方法难以检测未知、复杂的网络威胁行为的问题，并提升了网络威胁行为检测速度，具有较强的实用性和可扩展性。

With the increasingly rampant cyberattacks, network infrastructure and important information systems are facing severe security challenges.The traditional network threat detection system can only detect known security threats, and cannot detect unknown and complicated security threats.Low detection speed, and large resource consumption also affect the performance of the system.Therefore, based on the knowledge graph and graph database—Neo4 j, a network threat behavior detection system is designed and implemented, which can dynamically identify and learn new types of attacks.In this system, the knowledge graph and Neo4 j are used to describe network threat behaviors, and self-learning method is adopted to dynamically update the threat knowledge graph, so as to cope with complicated network attacks and improve the efficiency and accuracy of network intrusion detection.The platform architecture based on Flume + Kafka + Storm is used to process network threat behaviors, which improves the traversal search speed among nodes of the knowledge graph and speeds up the network threat identification.The system solves the problem that it's difficult for the traditional intrusion detection methods to detect unknown and complicated network threats, and improves the speed of network threat detection, with strong practicability and scalability.