Abnormal detection system based on outlier excavation

Abstract

An abnormal detection system based on outlier excavation comprises a data acquisition unit, a storage data base, a feature selection module, a data excavation module, a normal activity profile data base and a classifier. The data acquisition unit is used for acquiring network data. An output end of the data acquisition unit is connected with a signal input end of the storage data base. Two signal output ends of the storage data base are respectively connected with a corresponding signal input end of the feature selection module and a corresponding signal input end of the data excavation module. The other signal input end of the data excavation module is connected with the normal activity profile data base. Signal output ends of the feature selection module and the data excavation module are respectively connected with corresponding signal input ends of the classifier. A signal output end of the classifier is used for outputting of the abnormal detection system based on the outlier excavation and a detection state is displayed. According to the system, network data, namely, a high-dimensional, sparse and nonlinear dataset composed of a large amount of system logs and audit records is processed, false alarm rate is reduced and system detection performance is improved.

Description

Technical field [0001] The invention involves the field of detection in the mobile AD HOC network, especially the detection system of abnormal intrusion of the network. Specifically, it is an abnormal detection system based on group excavation. [0002] Background technique [0003] At present, the method and theoretical research work of intrusion testing has a history of more than 30 years.However, the research of the mobile (point -to -point) mode AD HOC network invasion detection system is still in a very primary stage: most of the commercial products use a hard -coding mechanism similar to anti -virus software in the implementation method, which is obviously not suitable for rapid changes in network attack behavior; Although the laboratory studies have proposed various new methods to detect new types of attack behavior, there is still a considerable distance from practicality.The most prominent common problem of the current research institutions and the industrial mobile AD H...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to propose an anomaly detection system based on outlier mining in view of the problems that the existing anomaly detection system is only applicable to data sets with low dimensions, poor real-time performance, high false alarm rate and weak ability to detect new types of attacks

Images