Abstract:

Due to software and hardware differentiation, the problem of false positives mistakenly identified as network attack behavior caused by inconsistent mimic decision results frequently occurs.Therefore, a mimic decision method based on deep learning was proposed.By constructing an unsupervised autoencoder-decoder deep learning model, the deep semantic features of diverse normal response data were explored from different executions and its statistical rules were analyzed and summarized.Additionally, the offline learning-online decision-making mechanism and the feedback optimization mechanism were designed to solve false positive problem, thereby accurately detecting network attacks and improving target system security resilience.Since statistical rules of normal response data was understood and mastered by deep learning model, the mimic decision results among different executions could remain consistent, indicating that the target system was in a secure state.However, once the target system was subjected to a network attacks, the response data outputted by the different executions was deviated from statistical distribution of deep learning model.Therefore, inconsistent mimic decision results were presented, indicating that the affected execution was under attack and the target system was exposed to potential security threats.The experiments show that the performance of the proposed method is significantly superior to the popular mimic decision methods, and the average prediction accuracy is improved by 14.89%, which is conducive to integrating the method into the mimic transformation of real application to enhance the system’s defensive capability.

Key words: mimic defense, active defense, mimic decision, deep learning, offline learning-online decision-making