A tensor model-based online network traffic anomaly detection method and system

Abstract

The invention discloses a tensor model-based online network traffic anomaly detection method and system. The method includes: modeling the collected data according to the three-dimensional tensor model; obtaining the current time data matrix through a fixed window; The matrix iteratively trains the data matrix at the current moment, decomposes the current tensor data into three factor matrices and updates them, so as to obtain the normal data in the current moment data; obtain the error tensor data according to the current moment data matrix and normal data, and pass non- The relaxation method performs anomaly detection to obtain abnormal data; when the absolute value of the difference between the normal data at the current moment and the normal data at the previous moment is less than the threshold of the number of abnormal data, the above iteration is stopped, and according to the position of the abnormal data in the error tensor data Output exception tensor data. Solve the problems in the existing technology that it is difficult to characterize multi-dimensional data and cannot detect online, and realize multi-dimensional representation and online detection.

Description

technical field [0001] The invention relates to the technical field of network detection, in particular to a tensor model-based online network traffic anomaly detection method and system. Background technique [0002] With the continuous expansion of network scale and continuous deepening of network applications, network attacks are becoming more and more harmful, threatening the normal operation of the network. In severe cases, large-scale network attacks (such as distributed denial of service attacks DDos (Distributed Dos) , large-scale worm Worms outbreak, etc.) will bring catastrophic consequences to the network. When a cyber attack occurs, it often results in unusual changes in network traffic that can spread across multiple links. [0003] According to the definition of anomaly by Hawkins et al.: Anomaly is observational data that is far away from other observational data and is suspected to be produced by a different mechanism, see reference [1]. Anomaly detection i...

AI Technical Summary

Problems solved by technology

[0028] The present invention provides an online network traffic anomaly detection method and system based on a tensor model, which is used to overcome the inability to identify, low precision, and difficulty in characterizing the nature of multi-mode data in the prior art, suitable for offline data analysis, and unable to support network operation and maintenance Real-time data detection and other defects in real-time data detection, realize the representation and accurate identification of multi-dimensional pattern data, support real-time data detection in network operation and maintenance, and reduce the complexity of calculation

Images