Real-Time Detection of Network Exploration Behavior: A Method Based on Feature Extraction and Half-Space Trees Algorithm

In the context of an increasingly severe network security landscape, attackers often employ novel techniques and social engineering attacks to bypass network boundaries, and collect internal network information for lateral attacks after successful penetration. To timely identify and expel attackers, this paper introduces a stream-based detection method for analyzing online traffic. This method employs a custom-designed streaming algorithm and Half-Space Trees for anomaly detection. Experimental tests on the LanL dataset demonstrate that this method can effectively discover day-to-day variations in attack postures and potential attackers, thus proving its effectiveness.