Access traffic anomaly detection method and device based on LOF and isolated forest

Abstract

The invention discloses an access traffic anomaly detection method and device based on LOF and isolated forest, and the method comprises the steps: traffic preprocessing: preprocessing access traffic data to obtain a traffic data set, the preprocessing comprising traffic extraction, traffic cleaning and traffic normalization; machine learning model training: taking the traffic data set as model input to carry out machine learning training, respectively using a local outlier factor (LOF) detection algorithm and an isolated forest algorithm to carry out multiple iteration training, and obtaining two groups of trained anomaly detection models, namely N anomaly detection models, and storing the anomaly detection models; and performing combined intelligent analysis: performing target flow detection by using the two groups of anomaly detection models trained in the step 2, and performing result screening by using a bagging Bagging algorithm. According to the method, a local outlier factor LOF detection algorithm is combined with an isolated forest to perform conjoint analysis, anomaly detection is performed on the collected access traffic category, whether the traffic is abnormal or not is judged, and the security of the system is ensured.

Description

technical field [0001] The invention relates to the technical field of traffic anomaly detection, in particular to a method and equipment for detecting traffic anomalies based on LOF and isolated forest. Background technique [0002] The Internet plays an important role in various fields of social life, but it also faces security risks brought about by its own openness and complexity. Hackers can use Trojan horses, botnets and other technologies to manipulate tens of thousands or even millions of compromised computers, release malicious codes, send spam, and implement distributed denial of service attacks to carry out attacks and intrusions. Anomaly detection of access traffic is of great significance to timely discovering network anomalies and ensuring normal network operation. At present, the main traffic anomaly detection technologies include anomaly detection technology based on information theory, anomaly detection technology based on statistics, anomaly detection tech...

AI Technical Summary

Problems solved by technology

Clustering-based anomaly detection technology is mainly used for clustering, not for anomaly detection. It needs to label abnormal data on the basis of clustering, and it is computationally intensive and computationally complex. In normal samples Not applicable when categorical data is sparse

[0007] For access traffic anomaly detection, access traffic is often unlabeled data, and manual labeling is time-consuming and labor-intensive, so it is not suitable for supervised classification detection methods, and access traffic data is usually seriously unbalanced, and the data distribution is relatively random. It is difficult to form regular traffic analysis rules and statistical distributions, so anomaly detection methods based on information theory and statistical distributions are also difficult to apply

In access traffic anomaly detection, the abnormal data is usually a small sample data, and the normal sample data accounts for the majority, which is more suitable for the scenario of anomaly detection technology based on clustering algorithm, but it is necessary to consider the detection algorithm with low computational complexity

In addition, due to unsupervised detection, it is easy to misjudgment based on only one anomaly detection method, and multiple detection algorithms are required for joint analysis

Images