Clustering algorithm optimization method, device and equipment for network abnormal behavior detection

Abstract

The invention discloses a clustering algorithm optimization method, device and equipment for network abnormal behavior detection. The method comprises the following steps: selecting a preset number of data points from a data set and taking the data points as initial central data points; according to each central data point, clustering processing is carried out on other data points to obtain a corresponding number of clusters, and the data points in the data set are used for representing user behaviors; respectively determining the dispersion degree of other data points in each cluster relative to the central data point of the cluster, and taking the data point corresponding to the minimum dispersion degree as a new central data point of the cluster; and carrying out clustering processing on other data points again based on the new central data point, and determining the dispersion degree again according to the new cluster until the obtained data point with the minimum corresponding dispersion degree is the same as the current central data point, and taking the data point as the optimal central data point of the cluster. Therefore, the influence of noise on clustering can be effectively reduced.

Description

technical field [0001] This document relates to the field of computer technology, in particular to a clustering algorithm optimization method, device and equipment for network abnormal behavior detection. Background technique [0002] With the rapid development of emerging network technologies in the Internet era, big data, cloud computing, etc. The means of network attack bring huge challenges to enterprise network security. In network attack methods, compared with external network infiltration and other behaviors, attacks initiated by the enterprise network are more concealed and cause more serious harm. How to detect abnormal user behaviors in the enterprise network more accurately through algorithms can effectively Avoiding losses is an urgent problem to be solved in the current era. [0003] Clustering algorithm is a typical data mining algorithm. Because it can quickly classify a large amount of data, it can analyze whether user behavior sample data is normal behavio...

AI Technical Summary

Problems solved by technology

[0004] There are currently many optimal clustering algorithms based on K-means, some of which determine the clustering k value in advance to optimize the final clustering effect, and some optimization directions reduce the impact of noise points on the clustering results, etc., but all lack systematic solutions Ability of Clustering Algorithms to Address Accuracy Issues in Network Anomaly Behavior Detection

Images