Anomaly detection device and method for security information interaction

Abstract

The invention provides an anomaly detection device and method for security information interaction. The method includes the following steps of completing preprocessing operation on the basis of security information interaction records in a database to build a classifier model and conditional probability table and a group table for sequence alignment, analyzing security information interaction data, and judging the types of security information interaction related to the security information interaction data on the basis of the classifier model and conditional probability table and the group table for sequence alignment. The anomaly detection device and method for security information interaction have high security, the low false alarm rate and the low missing report rate.

Description

technical field [0001] The present invention relates to an anomaly detection device and method, and more particularly, to an anomaly detection device and method for security information interaction. Background technique [0002] At present, with the increasingly wide application of the network and the increasing variety of business types in different fields, the anomaly detection device and method used for security information interaction (that is, information interaction with high security requirements, such as financial transactions) become more and more complex. more and more important. [0003] Usually, abnormal security information interaction includes the following two types: (1) does not meet the requirements of the security information interaction system on the flow and format of security information interaction; (2) meets the requirements of the security information interaction system on normal security However, the security information interaction itself has certa...

AI Technical Summary

Problems solved by technology

[0005] However, the existing detection devices and methods for the second abnormality have the following problems: (1) For the first detection method, its limitation is that the data distribution in reality often does not conform to any known ideal In addition, most of the tests are for a single attribute, which is not ideal for anomaly detection in multidimensional data; (2) for the second detection method, it mainly uses sequence anomaly technology, that is, imitating human Thinking mode, find elements different from most data from a set of continuous sequences, but its false positive rate and false negative rate are high; (3) For the third detection method, it can only detect global abnormalities Data is not suitable for data sets with multiple densities, so local anomalies cannot be detected well; (4) For the fourth detection method, its false positive rate and false negative rate are also high

It can be seen from the above that the existing detection devices and methods for the second type of anomaly have high false alarm rate and false negative rate due to inappropriate feature selection or insufficient detection range, which affects the performance and performance of the security information interaction system. safety

Images