Data clustering method for abnormal detection system, and wireless communication network terminal

Abstract

The invention belongs to the technical field of wireless communication networks, and discloses a data clustering method for an abnormal detection system, and a wireless communication network terminal.The method comprises the steps of uniformly calculating the similarity between classification attributes and numerical attributes; randomly selecting k clustering centers, distributing each point tothe nearest cluster according to similarity measurement, and updating the clustering center after each point is distributed; recalculating the distance between each point and each clustering center until no point is changed; calculating two entropy indexes; measuring the importance degree of each attribute according to the two entropy indexes, and calculating and updating the weight of each attribute; and recalculating the distance between each point and the clustering center according to the similarity measurement after the weight is updated, and allocating each point to the cluster closest to the point. The method has the advantages of high accuracy, low overhead and the like, can be used for data clustering in an anomaly detection system, realizes mixed data clustering containing classification attributes and numerical attributes, and considers the importance degree of each attribute.

Description

technical field [0001] The invention belongs to the technical field of wireless communication networks, and in particular relates to a data clustering method used in an anomaly detection system and a wireless communication network terminal. Background technique [0002] At present, the closest prior art: Anomaly Detection assumes that the activities of abnormal persons are abnormal to those of normal subjects. According to this concept, the "activity profile" of the subject's normal activities is established, and the current activity status of the subject is compared with the "activity profile". When the statistical law is violated, the activity may be considered as "abnormal" behavior. Anomaly detection can discover abnormal behaviors in the network and detect attacks in time, thereby protecting network security. Data clustering is a data mining method widely used in anomaly detection, which can divide data into different classes according to the characteristics of the dat...

AI Technical Summary

Problems solved by technology

[0005] (1) Most of the existing clustering methods are pure data clustering, which cannot handle data containing categorical and numerical attributes

[0006] (2) Most of the existing clustering methods do not consider the meaning of a single attribute, resulting in insufficient clustering effect

[0007] (3) Methods that can handle mixed data and consider individual attributes often consume a lot of computing resources or introduce new parameters

[0008] Difficulty in solving the above technical problems: (1) The bottleneck of processing mixed data lies in the unified measurement of the similarity between categorical attributes and numerical attributes

Images