Abnormal flow detection system and method

Abstract

The invention provides an abnormal flow detection system and method, and the system comprises a flow feature analysis and selection module which screens flow features according to the flow features ofa ubiquitous power IOT, and carries out the dimension reduction of the flow features through a KPCA algorithm; a flow reference model construction module which is used for extracting flow characteristics after dimension reduction, constructing a restricted Boltzmann machine model based on an RBM model and an SOM clustering algorithm and training to complete construction of a reference model; a flow benchmark model training module which is used for carrying out anomaly degree division on the trained benchmark model according to a comparison divergence degree algorithm, and dividing the benchmark model into a normal benchmark model and an abnormal benchmark model; and an abnormal flow detection module which is used for extracting and calculating flow characteristics to be detected, and carrying out abnormal flow detection according to the similarity between the output of the reference model and the original input characteristic data. According to the invention, the automatic category labeling of the traffic data can be completed, and the network traffic anomaly detection accuracy is relatively high.

Description

technical field [0001] The invention relates to the technical field of network intrusion detection, in particular to a system and method for detecting abnormal traffic. In particular, it relates to an abnormal traffic detection system based on a restricted Boltzmann machine model and a SOM clustering algorithm. Background technique [0002] Network traffic anomaly detection is an important technical protection method for the ubiquitous power Internet of Things system, and its main implementation method is to use the network traffic anomaly detection technology based on the benchmark model. Specifically, different types of benchmark models are established according to the characteristics of historical traffic, and whether abnormalities occur are judged by matching real-time traffic with each benchmark model. With its excellent generalization and robustness, the machine learning model has gradually become the preferred solution of the benchmark model. However, the machine le...

AI Technical Summary

Problems solved by technology

Considering the huge data volume of network traffic in the ubiquitous power Internet of Things system, using the original traffic features for classification and recognition will increase the calculation loss on the one hand, and on the other hand will introduce unnecessary redundant features and reduce the detection accuracy

However, the complexity of traffic data makes it difficult for commonly used linear dimensionality reduction methods such as PCA to divide the data well.

Images