信息工程大学学报2026，Vol.27Issue(3)：316-322,7.DOI:10.3969/j.issn.1671-0673.2026.03.010
一种时序驱动的Web攻击行为同源分析方法
A Time Series Driven Homology Analysis Method for Web Attack Behaviors
摘要
Abstract
To address the problems that existing network attack homology analysis methods suffer from insufficient measurement of attack behavior similarity and low accuracy in multi-density samples and high-noise scenarios,a time series driven homology analysis method for Web attack behaviors is pro-posed.Firstly,3 categories of 20 Web attack alert features are extracted to construct attack series.Then,a similarity algorithm for attack series is proposed to calculate the similarity between sequences and construct a distance matrix.Finally,a clustering algorithm is designed based on the distance ma-trix to cluster attack sequences,thereby realizing attack homology analysis.Different from traditional methods relying only on statistical feature analysis,the proposed method incorporates the temporal cor-relation of attack behaviors into homology analysis and effectively improves the accuracy of Web attack homology analysis.Experimental results show that the key indicator ARI of the method reaches 94.9%in noisy environments,verifying that its homology analysis performance outperforms other methods.Meanwhile,the method can maintain stable performance within a wide range of parameters.关键词
高级持续性威胁/Web攻击/同源分析/动态时间规整/聚类Key words
advanced persistent threat/Web attack/homology analysis/dynamic time warping/clustering分类
信息技术与安全科学引用本文复制引用
高耀军,张震,王文博,王亚文..一种时序驱动的Web攻击行为同源分析方法[J].信息工程大学学报,2026,27(3):316-322,7.基金项目
国家科技重大专项(2025ZD1501300) （2025ZD1501300）
