A host variable anomaly detection method and system

Abstract

The present invention provides a method and system for detecting the anomaly of variables of a host. The method comprises: calculating, by means of an association rule algorithm, a first association rule set between a plurality of variables of a host to be detected according to a data window of a first preset length of time; sliding the data window backward according to a second preset period, and calculating, by means of the association rule algorithm, a second association rule set between the variables in the data window sliding backward according to the preset period; comparing each rule in the second association rule set with each rule in the first association rule set respectively, and calculating the similarity of the first association rule set and the second association rule set; and comparing the similarity with the minimal similarity of a rule set, and determining whether an anomaly occurs in the variables of the host to be detected.

Description

technical field [0001] The present invention relates to data anomaly detection technology, in particular to a host variable anomaly detection method and system. Background technique [0002] Association rule mining refers to finding all the rules whose support degree is greater than or equal to min-sup and confidence degree is greater than or equal to min-conf, and min-sup and min-conf are the corresponding support and confidence thresholds. [0003] Since association rule mining can discover interesting relationships between different attributes in massive data, its application range is relatively wide. Some literatures proposed a fuzzy weighted association rule mining method, combining fuzzy sets, Apriori data mining algorithm and time series analysis to mine alarm association rules. And it is applied in large-scale industrial production, which effectively suppresses the flood of industrial alarms. There are literatures that use the idea of ​​association rules and Markov...

AI Technical Summary

Problems solved by technology

[0005] 1. The accuracy rate is low, and the missed detection rate is high

[0006] 2. It only supports the detection of a single variable, and cannot detect multiple variables

[0007] 3. It is done by setting the threshold value, and the threshold value is an empirical value, and they are all static, which is less scientific

Images