Node abnormity detection method and device based on graph algorithm and storage device

Abstract

The invention discloses a node abnormity detection method and device based on a graph algorithm and a storage device, and the method comprises the steps: obtaining the attribute features of each nodeof a network cluster in a predetermined time period, building the connection of edges through the similarity of the attribute features, and connecting the nodes to form an undirected graph; calculating the attribute features by using a feature relationship operator to obtain feature vectors of the attribute edges; calculating different metrics of each node to obtain a group of feature vectors of each node; utilizing a predetermined training algorithm to train the feature vectors of the nodes to obtain a group of feature representations of the nodes; and calculating a reconstruction error by using a predetermined self-encoding model to obtain an abnormal offset value of one group of feature vectors of each node, and judging whether each node is abnormal according to the abnormal offset value. Through the mode, the nodes with abnormal behaviors can be rapidly and efficiently detected.

Description

technical field [0001] The present application relates to the technical field of network communication, in particular to a graph algorithm-based node anomaly detection method, device and storage device. Background technique [0002] In an open network cluster, some malicious nodes may perform port scanning, sniffing, attacking, illegal requests, or masquerading requests on other nodes in the cluster, resulting in overall cluster performance degradation, large-scale data leakage, large-scale failures, and system failure. use risk. In the long-term research, the inventors of the present application found that in an open cluster, the access environment of nodes is complex, and the behavior of nodes is dynamic and uncontrollable, and it is difficult to detect effectively and timely Unknown pattern of unusual behavior. Contents of the invention [0003] The technical problem mainly solved by this application is to provide a node abnormality detection method, device and storag...

AI Technical Summary

Problems solved by technology

[0002] In an open network cluster, some malicious nodes may perform port scanning, sniffing, attacking, illegal requests, or masquerading requests on other nodes in the cluster, resulting in overall cluster performance degradation, large-scale data leakage, large-scale failures, and system failure. risk of using

In the long-term research, the inventors of the present application found that in an open cluster, the access environment of nodes is complex, and the dynamic behavior of nodes is changeable and uncontrollable, so it is difficult to detect effectively and timely unknown pattern of abnormal behavior

Images