Network data exception detection method and system based on high-order association mining

Abstract

The invention discloses a network data exception detection method and system based on high-order association mining, and the method comprises the steps: 1, generating a discrete forest according to anobtained network data set, and calculating a discrete value of network data in the network data set; 2, generating a clustering center point according to a clustering algorithm and the abnormal network data, and calculating a similarity value between the network data and the clustering center point; 3, calculating the weight of the network data in the network data set according to the discrete value and the similarity value; 4, calculating a label matrix of unmarked network data in the network data set according to the weight of the network data and the hypergraph model; And step 5, determining the security type of the unlabeled network data according to the label matrix. Through the technical scheme provided by the invention, effective identification of a large amount of unmarked networkdata in an industrial network environment is realized, and the identification accuracy of the unmarked network data and the utilization rate of the marked network data are improved.

Description

technical field [0001] This application relates to the technical field of industrial network data detection, in particular, to a network data anomaly detection method based on high-order association mining and a network data anomaly detection system based on high-order association mining. Background technique [0002] With the rapid development of network technology, network attack incidents also occur frequently. In the face of increasing network data, how to efficiently and quickly detect abnormal data in network data and mark normal data and abnormal data has become more and more important. important. Due to the characteristics of industrial networks, there is a large amount of unlabeled network data in industrial networks, which is not conducive to the safe operation of industrial networks. Due to the many types of protocols that network data in industrial networks follow, in order to efficiently detect potential threats to network data, weigh the relationship between d...

AI Technical Summary

Problems solved by technology

[0003] In the existing technology, there are mainly three detection methods for abnormal network data: supervised learning detection, semi-supervised learning detection and unsupervised learning detection. First, because supervised learning detection requires sufficient labeled network data for training, and In the industrial environment, the marked network data with labels is less, resulting in lower accuracy of supervised learning detection; secondly, although the unsupervised learning method does not require labeled data, it cannot make full use of the marked network data, not only the amount of data calculation is relatively large Large, resulting in high system hardware performance requirements, and also caused a waste of marked network data; finally, although the semi-supervised learning method can use both marked network data and unmarked network data, it must have all types of abnormal network data Unmarked abnormal network data cannot be detected, resulting in poor overall recognition performance of abnormal network data detection

Images