MH-LSTM anomaly detection method based on session feature similarity

An anomaly detection and similarity technology, applied in electrical components, transmission systems, etc., can solve problems such as weak model accuracy, difficulty in depicting data distribution outlines, and decreased detection capabilities, achieving high detection and recall rates

Inactive Publication Date: 2019-11-08
FUJIAN NORMAL UNIV
View PDF4 Cites 5 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0003] Generally speaking, the current research on anomaly detection at home and abroad mainly includes the following three aspects: (1) Anomaly detection algorithms based on statistical analysis, when faced with large data sets with complex data distribution, due to the difficulty in delineating the outline of the data distribution, Its detection ability is obviously reduced, and the setting of the detection threshold has always been a major factor affecting the detection performance; (2)

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • MH-LSTM anomaly detection method based on session feature similarity
  • MH-LSTM anomaly detection method based on session feature similarity
  • MH-LSTM anomaly detection method based on session feature similarity

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0033] The MH-LSTM anomaly detection method of the present invention mainly involves two related technologies. (1) Use the Min-Hash algorithm to extract the features in the session sequence data. (2) Construct LSTM network for abnormal data detection and location.

[0034] (1) Feature extraction in Web session sequence data: Min-Hash algorithm is a simple implementation of the concept of Min-wise Independent Permutation proposed by Broder, and it is a locality-sensitive hashing (Locality-Sensitive Hashing, LSH) kind. The original role of LSH is to efficiently deal with the nearest neighbor problem of massive data and high-dimensional data. LSH maps two data with high similarity to the same hash value with a high probability through a special hash function, and maps two data with low similarity to the same hash value with a very low probability.

[0035] The specific description of Min-Hash is, given a random hash function h(x), the Min-Hash function is defined as m h (υ)=a...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention discloses an MH-LSTM anomaly detection method based on session feature similarity. The method comprises the steps: setting a sliding window to collect Web access data of a user, and carrying out the processing of the Web access data through Min-Hash, and extracting sequence features; training a detection model by using a time sequence classification algorithm of LSTM; and finally, detecting and positioning abnormal users in the captured Web session stream data by using the trained detection model. The method not only can effectively adapt to challenges in a streaming data environment, but also can maintain a high detection rate and a high recall rate.

Description

technical field [0001] The invention relates to the field of anomaly detection of WEB stream data, in particular to an MH-LSTM anomaly detection method based on session feature similarity. Background technique [0002] Along with people's increasing dependence on Web applications, while Web services bring convenience to people, their security issues have become a common threat to all human beings. How to resist various attacks on the Web has become one of the biggest challenges in the global field. Generally speaking, the initial symptoms of security problems are abnormal information, and abnormal information can be found as early as possible through abnormal detection to help stop losses in time. How to detect and locate anomalies in a timely manner from Web streaming data is a current research hotspot. [0003] Generally speaking, the current anomaly detection research at home and abroad mainly includes the following three aspects: (1) Anomaly detection algorithms based o...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
IPC IPC(8): H04L29/06H04L29/08
CPCH04L63/1425H04L63/1441H04L67/02
Inventor 肖如良邹利琼蔡声镇苏家威杜欣
Owner FUJIAN NORMAL UNIV
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap