Network traffic abnormality rapid detection method based on multilayer partial sensitive hash table

Abstract

The invention discloses a network traffic abnormality rapid detection method based on a multilayer partial sensitive hash table. Through utilization of the multilayer partial sensitive hash table, OD pair vectors are buffered and rearranged, so the similar OD pair vectors are mapped to the same hash barrels. On the basis of the multilayer partial sensitive hash table, an adaptive subspace search method and a partial sensitive hash table updating method are designed, so the time complexity of a low-rank matrix approximate process in network traffic abnormality detection is greatly reduced, the integrated time complexity of the abnormality detection is reduced, and the traffic abnormality rapid detection is realized.

Description

technical field [0001] The invention relates to the fields of computer technology and network technology, in particular to an application where abnormal network traffic occurs and the location of the abnormality needs to be quickly located, and specifically relates to a method for quickly detecting abnormal network traffic based on a multi-layer locally sensitive hash table. Background technique [0002] In recent years, with the continuous development of computer technology and the continuous deepening of network applications, the network not only plays an important role in various fields such as industry, banking, scientific research and education, but also has already entered thousands of households, making the network play an important role in people's daily work and life. play an increasingly important role. With the continuous expansion of network scale and the rapid development of computer technology and network technology, the possibility of various security and perf...

AI Technical Summary

Problems solved by technology

However, DRMF also has many shortcomings when used in actual network anomaly detection: ① DRMF uses singular value decomposition (singular value decomposition, SVD) when solving the low-rank components of noisy traffic data, and the time cost of SVD is very high; ② DRMF in In the process of accurately obtaining low-rank components and abnormal components, it is necessary to repeatedly perform SVD

Images