Anomaly detection method, device and equipment

Abstract

The present application provides an anomaly detection method, device and device. The method includes: acquiring a target training data set, where the target training data set includes a plurality of training data; inputting the target training data set into a first machine learning model, so that the first The machine learning model determines the score value corresponding to each data feature based on multiple training data; sorts all data features based on the score value corresponding to each data feature, and selects M data features with high score values ​​based on the ranking result, based on the M data features The data feature determines the first target feature vector; the first target feature vector is input to the second machine learning model, and the second machine learning model is trained by the first target feature vector to obtain the trained second machine learning model; The trained second machine learning model detects whether the network data is abnormal data. Through the technical solution of the present application, the accuracy of detecting whether abnormal data exists is improved, and a better abnormality detection effect is obtained.

Description

technical field [0001] The present application relates to the field of communication technologies, and in particular, to an abnormality detection method, device, and device. Background technique [0002] With the continuous development of network technology and the gradual increase of bearer services, the network has become an indispensable part of people's life and work. At the same time, there are more and more attacks in the network, and various network attacks are becoming more and more rampant, such as port scanning attacks, worm virus attacks, DDoS (Distributed Denial of Service) attacks, ransomware attacks, etc. These attacks cause network performance degradation, interfere with normal network behavior, and even cause network interruption or paralysis. Therefore, it is necessary to detect abnormal traffic in the network (that is, the traffic generated by the attack behavior) in time, and control the abnormal traffic. [0003] To detect abnormal traffic in the networ...

AI Technical Summary

Problems solved by technology

However, the excessive flow value does not necessarily mean that there must be abnormal flow. It may just be that the network is busy. Therefore, judging whether there is abnormal flow only based on whether the flow value is greater than the flow threshold has a relatively large error and the detection result is inaccurate.

Images