Dynamic Anti-Mapping Network Security Using Hidden Markov Models and LSTM Networks Against Illegal Scanning

Abstract

This paper deeply explores an innovative network anti-mapping security access technology to cope with the increasingly frequent illegal network scanning behaviors, aiming to build a more robust network security protection system. First, we analyze the threats of illegal scanning to network infrastructure, including but not limited to information leakage, service interruption, and the risk of being a springboard for subsequent attacks. Subsequently, a comprehensive security strategy is proposed, combining dynamic IP address allocation, port obfuscation, traffic camouflage, and behavior analysis to improve the system's concealment and anti-detection capabilities.This paper introduces the collaborative working mode of intelligent firewall and intrusion prevention system (IPS), using hidden Markov model (HMM) and long short-term memory network (LSTM) to identify and block malicious scanning behaviors, and optimize access control list (ACL) to achieve efficient release of legitimate traffic and accurate interception of illegal scanning traffic. Experimental results show that the proposed network anti-mapping security access technology has achieved significant results in improving network security. Specifically, we conducted experimental verification on the UNSW-NB15 dataset, which covers a variety of attack types and is very suitable for evaluating illegal network scanning defense mechanisms. Experimental results show that the accuracy of the Bi-LSTM+Attention model on this dataset reaches 98%, and the false alarm rate is reduced by 30% compared with the traditional LSTM model. In the pilot network area, this technology can effectively identify and intercept illegal scanning behaviors while maintaining low false alarm and missed alarm rates. By comparing with existing methods (such as honeypots, traffic obfuscation, etc.), we found that the Bi-LSTM+Attention model showed significant advantages in multiple key performance indicators. Although the model has high computing resource requirements and implementation complexity, its significant effect in improving detection accuracy and reducing false alarm rates makes it a technical solution worthy of promotion. In addition, we also discussed the trade-offs observed during the implementation, such as computational overhead and complexity, and proposed directions for future optimization.