Abnormity monitoring classification model construction method, anomaly monitoring method and device

Abstract

The invention relates to an anomaly monitoring classification model construction method, an anomaly monitoring method and an anomaly monitoring device. The anomaly monitoring classification model construction method comprises the steps of obtaining known traffic data of various terminals, and constructing a training set based on the obtained known traffic data; preprocessing the training set to obtain a first sample set; performing sample screening and feature optimization on the first sample set to obtain a second sample set; the second sample set is clustered, K clusters are obtained, labels of all the clusters are corrected based on real labels, and K is a positive integer; and the mass center of each cluster is obtained, each cluster is used as a class, the Euclidean distance between the mass center of each cluster and the data to be detected is used as a classification standard, and an anomaly monitoring classification model is constructed. By adopting the method, the anomaly monitoring classification model capable of accurately classifying and realizing anomaly monitoring can be constructed, and anomaly detection of the traffic data is realized through the model.

Description

technical field [0001] The present application relates to the technical field of abnormal data monitoring, in particular to a method for constructing an abnormal monitoring classification model, an abnormal monitoring method and a device. Background technique [0002] The rapid development of network technology and communication equipment has made the network environment almost cover people's lives. In order to deal with endless network attacks and ensure the normal operation of the organization team, identifying terminal abnormalities is particularly important for internal network management in specific fields. [0003] Anomaly monitoring is currently the most widely used and most effective network security active defense method. It can be well coupled with static defenses such as logs and firewalls to form an effective network security protection method. Among them, machine learning is the first choice for anomaly detection. Most of the existing anomaly detection methods a...

AI Technical Summary

Problems solved by technology

However, this detection method requires manual labeling and training of a large number of known types of traffic samples, which not only requires extremely high data requirements, but also poses a great challenge to the consumption of human resources.

Images