ISSN 1000-1239 CN 11-1777/TP

计算机研究与发展 ›› 2018, Vol. 55 ›› Issue (6): 1117-1142.doi: 10.7544/issn1000-1239.2018.20170649

• 信息安全 •    下一篇

深度学习应用于网络空间安全的现状、趋势与展望

张玉清1,2,董颖1,柳彩云1,雷柯楠1,2,孙鸿宇1,2   

  1. 1(中国科学院大学国家计算机网络入侵防范中心 北京 101408); 2(西安电子科技大学网络与信息安全学院 西安 710071) (zhangyq@nipc.org.cn)
  • 出版日期: 2018-06-01
  • 基金资助: 
    国家重点研发计划项目(2016YFB0800703);国家自然科学基金项目(61572460,61272481);信息安全国家重点实验室的开放课题(2017-ZD-01);国家发改委信息安全专项项目((2012)1424)

Situation, Trends and Prospects of Deep Learning Applied to Cyberspace Security

Zhang Yuqing1,2, Dong Ying1, Liu Caiyun1, Lei Kenan1,2, Sun Hongyu1,2   

  1. 1(National Computer Network Intrusion Protection Center, University of Chinese Academy of Sciences, Beijing 101408); 2(School of Cyber Engineering, Xidian University, Xi’an 710071)
  • Online: 2018-06-01

摘要: 近年来,深度学习应用于网络空间安全的研究逐渐受到国内外学者的关注,从分类算法、特征提取和学习效果等方面分析了深度学习应用于网络空间安全领域的研究现状与进展.目前,深度学习主要应用于恶意软件检测和入侵检测两大方面,指出了这些应用存在的问题:特征选择问题,需从原始数据中提取更全面的特征;自适应性问题,可通过early-exit策略对模型进行实时更新;可解释性问题,可使用影响函数得到特征与分类标签之间的相关性.其次,归纳总结了深度学习发展面临的十大问题与机遇,在此基础上,首次归纳了深度学习应用于网络空间安全所面临的十大问题与机遇,并将十大问题与机遇归为3类:1)算法脆弱性问题,包括深度学习模型易受对抗攻击和隐私窃取攻击;2)序列化模型相关问题,包括程序语法分析、程序代码生成和序列建模长期依赖问题;3)算法性能问题,即可解释性和可追溯性问题、自适应性和自学习性问题、存在误报以及数据集不均衡的问题.对十大问题与机遇中主要问题及其解决方案进行了分析,指出对于分类的应用易受对抗攻击,最有效的防御方案是对抗训练;基于协作性深度学习进行分类的安全应用易受隐私窃取攻击,防御的研究方向是教师学生模型.最后,指出了深度学习应用于网络空间安全未来的研究发展趋势.

关键词: 深度学习, 网络空间安全, 攻击与防御, 应用安全, 网络安全

Abstract: Recently, research on deep learning applied to cyberspace security has caused increasing academic concern, and this survey analyzes the current research situation and trends of deep learning applied to cyberspace security in terms of classification algorithms, feature extraction and learning performance. Currently deep learning is mainly applied to malware detection and intrusion detection, and this survey reveals the existing problems of these applications: feature selection, which could be achieved by extracting features from raw data; self-adaptability, achieved by early-exit strategy to update the model in real time; interpretability, achieved by influence functions to obtain the correspondence between features and classification labels. Then, top 10 obstacles and opportunities in deep learning research are summarized. Based on this, top 10 obstacles and opportunities of deep learning applied to cyberspace security are at first proposed, which falls into three categories. The first category is intrinsic vulnerabilities of deep learning to adversarial attacks and privacy-theft attacks. The second category is sequence-model related problems, including program syntax analysis, program code generation and long-term dependences in sequence modeling. The third category is learning performance problems, including poor interpretability and traceability, poor self-adaptability and self-learning ability, false positives and data unbalance. Main obstacles and their opportunities among the top 10 are analyzed, and we also point out that applications using classification models are vulnerable to adversarial attacks and the most effective solution is adversarial training; collaborative deep learning applications are vulnerable to privacy-theft attacks, and prospective defense is teacher-student model. Finally, future research trends of deep learning applied to cyberspace security are introduced.

Key words: deep learning, cyberspace security, attacks and defenses, application security, network security

中图分类号: