Anomaly detection method and device based on user peer-to-peer group

Abstract

The invention provides an anomaly detection method and device based on a user peer-to-peer group, and the method comprises the steps: carrying out the clustering of a preset number of times of a userset comprising a target user according to a preset clustering algorithm, obtaining a preset number of clustering clusters to which the target user belongs, wherein each clustering corresponds to one clustering cluster; according to a preset number of clustering clusters to which the target user belongs, obtaining a peer-to-peer group probability of the target user and any user in the preset numberof clustering clusters, and constructing a probability clustering cluster based on the peer-to-peer group probability; selecting a preset threshold number of behavior characteristics from a preset behavior characteristic pool, and for each selected behavior characteristic, based on the probability clustering cluster and the selected behavior characteristic, constructing an isolated forest tree containing the target user; and detecting whether the target user is an abnormal user or not according to the obtained isolated forest tree and a preset anomaly detection algorithm. The anomaly detection precision can be effectively improved.

Description

technical field [0001] The present invention relates to the technical field of information detection, in particular to a user peer-to-peer group-based anomaly detection method and device. Background technique [0002] The rapid development of computer communication technology brings great convenience to users' work and life, but at the same time, the losses caused to users due to network security or network anomalies are also increasing. Among them, users' illegal network behavior is an important factor affecting network security or network anomalies. Therefore, monitoring user network behaviors, discovering user abnormal network behaviors and dealing with them in a timely manner is particularly important for ensuring the normal operation of the network. [0003] At present, for network security inside enterprises, it is generally based on statistical and analytical methods, by constructing a user network behavior model, and inputting the monitored user network behavior beha...

AI Technical Summary

Problems solved by technology

However, in practical applications, for example, whether a user belongs to a certain peer group is only a probability event. Therefore, the accuracy of abnormal user detection is not high according to the above abnormal detection method.

Images