Network asset anomaly detection method

Abstract

The invention discloses a network asset anomaly detection method, which relates to the technical field of network security, and solves the technical problem that only a single anomaly is considered or an anomaly in the time sequence of behavior is not considered in the existing scheme, resulting in a high rate of false alarms; including : Acquisition of time-series characteristic data of network assets, data preprocessing, data structure, construction of anomaly detection model, anomaly detection and further mining of "normal" data; the present invention collects and utilizes two types of characteristic data in network traffic at the same time, so that anomaly detection The model can better learn two types of features, laying the foundation for subsequent improvement of the detection accuracy of the anomaly detection model; the present invention uses a deep learning network framework based on LSTM-AE, which can perform anomaly detection on multi-dimensional time series data in the network and obtain Higher accuracy rate; the present invention performs secondary anomaly detection on the reconstructed error matrix of the data detected as "normal" by the anomaly detection model, effectively improving the abnormal recall rate.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a method for detecting abnormality of network assets. Background technique [0002] As the scale of contemporary networks continues to expand, the number and types of devices in the network have also increased on a large scale. During daily operation, network devices will form their own network traffic behavior baseline. When the behavior of the device deviates from its own behavior baseline due to its own or external reasons, the device may be abnormal. Therefore, if anomalies in network equipment can be detected accurately and effectively, it will not only help to discover risky behaviors such as intrusion, but also help network managers troubleshoot equipment problems. [0003] The invention patent with the publication number CN111049839A discloses an anomaly detection method, device, storage medium and electronic equipment. After the corresponding data preprocessin...

AI Technical Summary

Problems solved by technology

[0007] The invention provides a network asset anomaly detection method, which is used to solve the technical problem of high false alarm rate caused by only considering a single anomaly or not considering the anomaly in the timing of the behavior in the existing solution. The invention proposes a time-based The network asset anomaly detection method based on the sequence algorithm comprehensively utilizes various types of data characteristics and time series characteristics to solve the above problems

Images