Traffic anomaly detection method, model training method and device

Abstract

The invention provides a traffic abnormality detection method. The method comprises the steps of obtaining a target time sequence comprising N elements; according to the target time sequence, obtaining target parameters of the target time sequence, wherein the target parameters comprise a periodic factor and / or jitter density, the periodic factor represents one type of waveform change which is presented in the target time sequence and surrounds the long-term trend, and the jitter density represents the deviation of the actual value and the target value of the target time sequence in the target time; determining a first type to which the target time sequence belongs from a plurality of types according to the target parameter, each type in the plurality of types corresponding to a parameter set, and the target parameter belonging to the parameter set corresponding to the first type; and according to the first type of judgment model corresponding to the first type, the abnormal condition of the target time sequence is detected, and each type in the multiple types corresponds to one type of judgment model. According to the technical scheme, the accuracy of flow abnormity detection can be improved.

Description

technical field [0001] The present application relates to the field of machine learning, and more specifically, relates to a traffic anomaly detection method, model training method and device. Background technique [0002] In the field of machine learning, anomaly detection refers to the detection of models, data or events that do not conform to predictions. Usually anomaly detection is learned by professionals on historical data, and then finds outliers. Data sources include applications, processes, operating systems, devices, or networks. With the increase in the complexity of computing systems, humans are no longer competent for the current difficulty of anomaly detection. [0003] In the prior art, an algorithm based on statistics and data distribution is used to detect anomalies in network traffic data. The premise is that the traffic data obeys a normal distribution in a short period of time. However, the distribution of network traffic data does not obey the normal d...

AI Technical Summary

Problems solved by technology

Data sources include applications, processes, operating systems, devices, or networks. With the increase in the complexity of computing systems, manual labor is no longer capable of the current anomaly detection difficulty.

[0003] In the prior art, an algorithm based on statistics and data distribution is used to detect anomalies in network traffic data. The premise is that the traffic data obeys a normal distribution in a short period of time. However, the distribution of network traffic data does not obey the normal distribution in a short period of time. Normal distribution, therefore, the algorithm based on statistics and data distribution is not very accurate in anomaly detection of network traffic data

Images