Network abnormity detection method

Abstract

The invention provides a network abnormity detection method. The method comprises the following steps: 1, determining attribute of clustered MIB (Management Information Base) data according to a to-be-detected network to generate an attribute vector X; 2, sampling the MIB data in a predetermined time; 3, executing clustering analysis treatment on the acquired MIB data; IV, executing outlier detection on a clustering analysis treatment result, wherein the cluster of which the number of members in the clustering analysis treatment result is smaller than a specified threshold value is judged to be an isolated event in the step IV, and occurrence of network abnormity in the time corresponding to the isolated event is judged.

Description

technical field [0001] The present invention relates to the field of network communication, more specifically, the present invention relates to a network anomaly detection method based on clustering and outlier detection, in which the management information database generated by routers is used to find network anomalies, which can be widely used in network faults discovery and intrusion detection etc. . Background technique [0002] In 1980, James P.Anderson classified network threats and elaborated the concept of network anomaly detection for the first time. From 1984 to 1985, Denning et al. of George London University developed the first real-time intrusion detection system model IDES (Intrusion Detection Expert System). One of the most influential systems in detection. MIDAS (Multics Intrusion Detection and Alerting System) developed in 1990 is a real-time anomaly detection system provided to the network host of the National Security Computing Center. Although it is ma...

AI Technical Summary

Problems solved by technology

[0004] However, for the above methods, the model of the first method is relatively simple and cannot detect more abnormal behavior types; for the second method, since the confidence interval needs to be artificially set through experience, more failures and experience are required To generate a credible confidence interval; the third method has a complex model, and the results will vary greatly with different parameters; the fourth method is suitable for the case where the variable is a continuous parameter, and it cannot be used for the case where the sampling is a discrete value. Get valid results; the result of the fifth method depends on the size of the time window setting

Images