Abnormal flow alarm log detection method and device, equipment and medium

Abstract

The invention discloses an abnormal flow alarm log detection method and device, equipment and a medium, and the method comprises the steps: respectively generating a first flow alarm log and a secondflow alarm log corresponding to an original flow package according to a first preset alarm rule and a second preset alarm rule, wherein the precision of the first preset alarm rule is higher than thatof the second preset alarm rule; labeling the first flow alarm log, and labeling the second flow alarm log according to the label in the first flow alarm log; taking the second flow alarm log with the label as sample data, and training a preset flow alarm log classification model by utilizing the sample data; and utilizing the trained flow alarm log classification model to classify the obtained to-be-detected flow alarm logs so as to determine whether the to-be-detected flow alarm logs are abnormal flow alarm logs or not. Therefore, the detection accuracy can be improved, the false alarm rateis reduced, and the traffic threat detection capability is enhanced.

Description

technical field [0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment, and medium for detecting abnormal flow alarm logs. Background technique [0002] Traffic alarm data refers to the data extracted by the network traffic analysis system with certain rules after capturing and detecting network access traffic data. In the cloud Internet era, hackers and other attackers usually use vulnerability attacks and other threats to attack corporate websites and business systems at the traffic level. Therefore, the traffic alarm log corresponding to the traffic can be detected accordingly, so as to determine whether there is an abnormal alarm, so as to manage the enterprise website or business system. In the process of detecting traffic alarm logs, a machine learning method can be used to train a model to detect traffic alarm logs, so as to manage the network or system according to the detection results. In the p...

AI Technical Summary

Problems solved by technology

In the process of machine learning, a large amount of sample data of traffic alarm logs is required for training. In the sample preparation stage, the sample size may be insufficient. If the sample size is too small, overfitting may easily occur, resulting in low detection accuracy. There are many false positives

Images