Exception aggregation method and system based on attribute weight and rule driving

Abstract

The invention provides an exception aggregation method and system based on attribute weight and rule driving. The method comprises the following steps: performing format unification on a plurality of original exception data so as to construct an abnormal information decision table, and according to the same value relation of exception condition attributes and decision attributes; for exceptions of a plurality of exception types, calculating knowledge granularity and rough conditional entropy of a condition attribute set of the exceptions; for each exception type, calculating an attribute weight of each condition attribute for each exception type; when judging that a current exception meets a preset aggregation condition, aggregating the current exception into an existing aggregation exception matched with the current exception; if the current exception does not meet the preset aggregation condition, adding the current exception as a new aggregation exception into the existing aggregation exception. According to the method, the attribute similarity is obtained by calculating the attribute weight, and exception aggregation is performed according to the preset aggregation rule, so that the exception number can be effectively reduced, and the problem of low analysis efficiency caused by a large number of exceptions is solved.

Description

technical field [0001] The present invention relates to the technical field of data identification, in particular to an abnormal aggregation method and system driven by attribute weights and rules. Background technique [0002] With the development of network technology, when a network attack occurs, the system will generate a large number of abnormalities. In terms of system traffic, there will be exceptions related to traffic analysis. In terms of system applications, there will be exceptions in application logs. In terms of the operation of the system itself, exceptions in system audit logs will be generated. Therefore, the identification of abnormal data is a necessary means to maintain network security. [0003] In the process of detecting anomalies, the existing network anomaly detection and aggregation methods generate a huge amount of anomaly data, which is difficult to analyze one by one. When the network encounters an attack, a large number of abnormalities and a...

AI Technical Summary

Problems solved by technology

However, aggregation methods based on attribute similarity pay more attention to the similarity of anomalies, ignoring the temporal relationship between anomalies

However, the aggregation method based on timing and network features needs to manually define a large number of aggregation rules, and the aggregation effect on the exception itself is very limited.

Images