A Behavior-Based Approach for Cyberattack Grouping in Anonymous Web Attacks

Existing cyberattack grouping methods suffer from low accuracy due to neglecting temporal features, susceptibility to noise interference in clustering, and poor adaptability to multi-density attack samples. To address these issues, this paper proposes a behavior-based approach for cyberattack grouping in anonymous web attacks. Unlike traditional statistics-driven feature extraction methods, the proposed method employs a time-series-driven feature extraction algorithm that incorporates the temporal correlation of attack behaviors into the cyberattack grouping framework, thereby effectively improving the accuracy of cyberattack grouping for anonymous web attacks. First, multi-dimensional attack features encompassing spatiotemporal, web fingerprint, and attack behavior characteristics are extracted and integrated into attack feature time sequences. Second, a FastDTW-based attack sequence similarity algorithm is introduced to evaluate the similarity between different sequences. Finally, an OPTICS-based attack sequence clustering algorithm is employed to perform sequence clustering and separate attack data from noise. Experimental results show that, under high-noise conditions, the proposed method achieves an Adjusted Rand Index (ARI) of 97.64% and a noise identification accuracy of 98.6%, outperforming state-of-the-art approaches.