IP group similarity calculation method

Abstract

The invention relates to an IP group similarity calculation method which includes the steps of taking any IP, and obtaining the high-dimensional feature vectors of self field attribute, the regional information attribute, the alarm time attribute and the alarm type attribute of the IP, obtaining the combined feature vector of the current IP through weighted combination, further obtaining the combined feature vectors of IPs to be grouped, clustering to obtain an IP group, and measuring the similarity of each IP group through the root-mean-square error (RMSE). According to the method, the multi-dimensional attributes of an IP are considered, and a field, a regional characteristic and a behavior mode of the IP are combined, so that the similarity of the IP group is more persuasive, and the precision is higher.

Description

technical field [0001] The present invention relates to the technical field of digital computing equipment or data processing equipment or data processing methods that are especially suitable for specific functions, and in particular to a network security field, IP group similarity calculation based on high-dimensional mapping and weighted K-Means clustering method. Background technique [0002] IP is the abbreviation of Internet Protocol (Internet Protocol). In the Internet, it is a set of rules that enable all computer networks connected to the Internet to communicate with each other. It stipulates the rules that computers should follow when communicating on the Internet. Computer systems produced by any manufacturer can be interconnected on the Internet as long as they comply with the IP protocol. [0003] By calculating the similarity between IPs, the analysis perspective can be shifted from a single IP to the entire IP group, which facilitates IP behavior analysis and ...

AI Technical Summary

Problems solved by technology

[0004] In the prior art, the IP similarity calculation method is directly based on the 4 field information of the IP (generally expressed as A.B.C.D) itself, using clustering methods such as DBSCAN, K-Medoids, etc. to perform clustering, and then calculate the IP group similarity, These clustering methods only consider a single IP field information, and do not use other attributes and behavioral characteristics of IP, so the clustering effect is not satisfactory