Equipment clustering method, terminal equipment and storage medium

Abstract

The invention discloses a device clustering method, a terminal device and a storage medium, and the device clustering method comprises the steps: obtaining a connection relationship between devices, the devices forming network nodes of a GAT network; obtaining an adjacent matrix of each device according to the connection relationship among the devices; performing feature extraction on each device to obtain a feature matrix of each device; inputting the adjacent matrix and the feature matrix into a pre-trained graph attention auto-encoder GATE model to obtain a reconstructed node feature matrix; and inputting the reconstructed node feature matrix into a clustering algorithm to cluster each network node to obtain the category of each device. The invention provides an equipment clustering scheme which does not need to update the node features of the whole graph and re-calculate the whole graph under the condition that the equipment nodes are increased, so that a large amount of calculation space is saved.

Description

technical field [0001] The present application relates to the field of network security detection, and in particular, to a device clustering method, a terminal device and a storage medium. Background technique [0002] With the development of computer technology, global informatization has become a major trend of human development. However, due to the diversity of connection forms, uneven distribution of terminals, and the openness and interconnectivity of the computer network, the network is vulnerable to attacks by hackers and malware. As an important element in the Internet, network devices are generally considered to have a high degree of similarity between devices with similar communication behaviors by analyzing the communication relationship between devices. By clustering devices with similar communication behaviors, the devices can be classified according to their similarity, which is crucial for studying the relationship between devices and the abnormal behavior of...

AI Technical Summary

Problems solved by technology

However, in the process of implementing this application, the inventor found that when using the existing equipment clustering technology for equipment clustering, since the learned parameters are related to the graph structure, whenever there is an increase in equipment nodes, it is necessary to Updating the node characteristics of the whole graph requires a large amount of computing resources, making it difficult to complete the dynamically changing device clustering task

Images