Abnormal-user detection method based on session feature similarity fuzzy-clustering

Abstract

The invention relates to an abnormal-user detection method based on session feature similarity fuzzy-clustering. The method includes the following steps: step S1, establishing a sliding window for each session, and collecting webpage access information of users; step S2, carrying out data preprocessing on the collected webpage access information to generate user session information; step S3, usinga PageRank algorithm to calculate webpage weight information; step S4, using a SimHash algorithm to calculate similarity among the users on the basis of the obtained user session information and webpage weight information, and establishing a user similarity matrix; step S5, using a fuzzy clustering-based lambda-cut algorithm to cut the user similarity matrix, which is obtained by the sliding window of each session, to obtain suspect users; and step S6, detecting and locating abnormal users according to suspect-user information returned by the sliding windows of all the sessions. The method facilitates fast and accurate detection and locating of the abnormal users.

Description

technical field [0001] The invention relates to the technical field of web service anomaly detection, in particular to an abnormal user detection method based on session feature similarity fuzzy clustering. Background technique [0002] As the entrance of Internet information service, Web service has brought many conveniences to people, but at the same time, its security problem has become a huge threat to human beings in the information age. Various attacks from the Web have become one of the biggest challenges in the global domain. Anomaly detection for Web services has become a research hotspot. Generally speaking, anomalies are events that are inconsistent with normal behavior in actual applications, which may be determined by the potential characteristics of the event itself, or may be caused by system errors or measurement errors, or caused by improper behavior of the object of. The problem description for anomaly detection can be simplified as how to define anomali...

AI Technical Summary

Problems solved by technology

However, with the massive and time-sensitive web traffic, how to use big data technology to propose an effective web traffic analysis method, accurately describe user behavior, and find out effective features is also the main problem of flow mining methods.

[0004] At present, a lot of research has been done on anomaly detection. Generally speaking, the existing methods usually require a large amount of labeled information as the training set of the system, and it takes a lot of pre-work time to train the model, which requires experts to pre-judge Whether the original data is abnormal and marked, which is obviously not conducive to the transplantation and promotion of anomaly detection systems

Images