An operating system terminal detection algorithm based on an anomaly detection model
By using an operating system terminal detection algorithm based on an anomaly detection model, secure information allocation and multiple detection are achieved, solving the problems of slow detection speed and high error rate in existing technologies, and improving the accuracy and efficiency of detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- GUANGZHOU ELECTRIC POWER COMM NETWORK LTD
- Filing Date
- 2023-03-23
- Publication Date
- 2026-05-19
AI Technical Summary
Existing operating system terminal detection algorithms cannot effectively distinguish and compare anomalies, resulting in large information processing volume, slow detection speed, and susceptibility to errors.
An operating system terminal detection algorithm based on an anomaly detection model is adopted. After initial screening by a security information detection system, digital information and image information are processed separately. Multiple detection mechanisms, such as anomaly detection one and anomaly detection two, comparison 1 and comparison 2, are used to ensure information security and detection accuracy.
It improves the rigor and accuracy of operating system terminal detection, reduces detection errors, and enhances information processing efficiency and detection precision.
Smart Images
Figure CN116578982B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of operating system terminal detection technology, and more specifically, to an operating system terminal detection algorithm based on an anomaly detection model. Background Technology
[0002] A terminal is generally defined as follows: 1. One of the electrical input or output points of a circuit or component. 2. A location or position where data can be input to or output from a system. 3. A device through which a user communicates with a computer. Extended information: A terminal, also called a terminal device, is a device located at the outermost edge of a computer network, mainly used for user information input and processing result output. In early computer systems, due to the high cost of computer mainframes, a single mainframe typically had multiple terminals. These terminals themselves did not possess computing capabilities; they only handled information input and output, while computation and processing were performed by the mainframe. A terminal, specifically a computer display terminal, is an input / output device of a computer system. Computer display terminals arose with the centralized processing model of the mainframe era and have continuously evolved with the development of computing technology.
[0003] Chinese Patent No. CN113536066A provides a method, apparatus, and computer device for determining a data anomaly detection algorithm. The method includes: acquiring data to be detected; extracting features from the data to be detected using a preset feature extraction tool to obtain fingerprint information of the data to be detected; performing feature matching between the fingerprint information of the data to be detected and fingerprint information in a preset algorithm selection model; and determining the anomaly detection algorithm for the data to be detected based on the anomaly detection algorithm corresponding to the fingerprint information most similar to the fingerprint information of the data to be detected. This invention, by extracting features from the data to be detected and performing feature matching with fingerprint information of multiple data in a pre-set preset algorithm selection model, determines the anomaly detection algorithm for the data to be detected based on the anomaly detection algorithm corresponding to the fingerprint information with the highest matching degree. This allows for real-time selection of the most suitable anomaly detection algorithm for the data to be detected based on changes in data features, exhibiting strong scene adaptability and good versatility.
[0004] Existing operating system terminal detection algorithms cannot distinguish and compare information for anomaly detection, resulting in a large amount of information to process and slow detection. At the same time, hybrid detection and the anomaly detection of the operating system terminal itself have significant vulnerabilities and are prone to errors. Summary of the Invention
[0005] In view of the shortcomings of the existing technology, the purpose of this invention is to provide an operating system terminal detection algorithm based on an anomaly detection model that can quickly process information and perform multiple anomaly detections.
[0006] To achieve the above objectives, the present invention provides the following technical solution: an operating system terminal detection algorithm based on an anomaly detection model, comprising an operating system terminal and an anomaly detection model, wherein the operating system terminal includes the anomaly detection model, and the detection algorithm steps of the operating system terminal are as follows:
[0007] S1. Detection: The security information detection system within the operating system terminal detects the information entering the operating system terminal to check for viruses. If no viruses are found, the content proceeds directly to the next step.
[0008] S2. Allocation: Separate the digital information from the image information, and then the digital information and the image information are respectively entered into the anomaly detection 1 and comparison 1 in the operating system terminal, and then proceed to the next step of processing;
[0009] S3. Comparison of digital information anomaly handling and image information anomaly handling.
[0010] S31: Digital information enters anomaly detection step 1 for anomaly detection.
[0011] S311. If the digital information does not show any abnormality in the anomaly detection result, the digital information will be processed normally.
[0012] S312. If the digital information is found to be abnormal in the anomaly detection one, the digital information will be entered into the anomaly detection model and re-detected by the anomaly detection two in the anomaly detection model;
[0013] S313. Anomaly Detection II: Anomaly Detection II includes Anomaly Detection I, statistical testing methods, depth-based methods, bias-based methods, distance-based methods, density-based methods, and deep learning methods. These methods are used cyclically for detection. If no problems are found, the digital information is processed normally.
[0014] S32: Image information is entered into Comparison 1 for anomaly detection.
[0015] S321. Compare the image information in Comparison 1. If there is no abnormality, proceed to Comparison 2 to compare the image information. If there is no abnormality, process the image information normally. If an abnormality occurs in Comparison 1 and Comparison 2, proceed to Abnormal Comparison M.
[0016] S322. In the anomaly comparison M, the image information is compared M times. If there is no anomaly, the image information is moved to normal information processing.
[0017] As a preferred solution, in S1, if the content carries a virus, the information is directly defined as abnormal information and then removed from the operating system terminal for detection. In S313, if one of them shows an abnormality, the abnormal digital information is moved into the information abnormality and then removed from the operating system terminal. In S322, if one of them shows a comparison abnormality, the picture information will enter the abnormal information and then be removed from the operating system terminal.
[0018] As a preferred solution, in S313, when the second anomaly detection performs a cyclic detection on digital information, if N < 7, the digital information is cyclically detected within the second anomaly detection. Each time it is checked, N + 1 is performed. If N ≥ 7, the second anomaly detection ends.
[0019] As a preferred solution, in S322, when the anomaly comparison M performs a cyclic detection on picture information, if M < a, where a ≥ 3, the digital information is cyclically detected within the anomaly comparison M. Each time it is checked, M + 1 is performed. If M ≥ a, the anomaly comparison M ends.
[0020] As a preferred solution, in S313, the statistical test method: The basic assumption based on using this kind of method is that normal data follows a specific distribution form and accounts for a large proportion, while the position of abnormal points has a relatively large deviation compared to normal points.
[0021] As a preferred solution, in S313, the depth-based method: The depth-based method is to locate abnormal points from the edge of the point space. According to different degrees of requirements, the number of layers and the number of abnormal points are determined. The dense black dots in the circle represent data points one by one. The assumption is that the points with relatively concentrated distribution and high density in the center of the point space are normal points, while abnormal points are located in the outer layer, that is, where the distribution is relatively sparse.
[0022] As a preferred solution, in S313, the deviation-based method: This is a relatively simple statistical method, originally designed for one-dimensional anomaly detection. Given a data set, each point is detected. If the value of a point itself has too large a deviation from the index of the entire set, then this point is an abnormal point. The meaning of this index is the difference in variance reduction when a certain point is removed from the set. We determine which points are abnormal by setting a threshold and comparing it with these deviation values.
[0023] As a preferred solution, in S313, the distance-based method: The distance-based method is to calculate the distance between each point and its surrounding points to determine whether a point is abnormal. The assumption is that there are many neighboring points around normal points, while the distance between abnormal points and their surrounding points is relatively far.
[0024] As a preferred embodiment, in S313, the density-based method is similar to the distance-based method. This type of method calculates the surrounding density of the point under study and the surrounding density of its neighboring points. Based on these two density values, a relative density is calculated as an anomaly score. That is, the higher the relative density, the higher the degree of anomaly. The underlying assumption is that the density of normal points and their neighboring points is similar, while the density of anomaly points differs significantly from that of surrounding points.
[0025] As a preferred embodiment, in S313, the deep learning method: the autoencoder consists of two parts: encoder one and decoder two. The left part is encoder one, which can compress high-dimensional input into a low-dimensional form. In this process, the neural network will try to retain useful information and remove some unimportant information and noise. The right part is decoder two, which is responsible for restoring the compressed data and trying to restore it to its original form.
[0026] Compared with existing technologies, this invention provides an operating system terminal detection algorithm based on an anomaly detection model, which has the following beneficial effects:
[0027] 1. By setting an anomaly detection model, which is an anomaly detection based on the operating system terminal, if an anomaly is found after an anomaly detection within the operating system terminal, the information is entered into the anomaly detection model. The anomaly detection model performs a second detection, which ensures the rigor of the operating system terminal detection and improves the quality of the operating system terminal detection.
[0028] 2. By setting up anomaly comparison N, comparison 1 compares the images, and then comparison 2 performs a double comparison detection. If an anomaly is found, it will enter anomaly comparison N, and then repeatedly compare different similar images to improve the accuracy of image comparison detection.
[0029] 3. By setting up detection and allocation, information is subjected to security checks to detect whether there are viruses and abnormal data, ensuring the security of the operating system terminal. At the same time, the information is allocated into digital information and images, and the information is processed separately to improve the efficiency of information processing and detection.
[0030] 4. The operating system terminal detection algorithm of the present invention can distinguish and detect anomalies in information, improve the amount of information processed, and increase detection efficiency. At the same time, separate detection and dual anomaly detection outside the operating system terminal will improve the detection accuracy and make it less likely to detect errors. Attached Figure Description
[0031] Figure 1 This is a schematic diagram of the overall structure of the present invention. Detailed Implementation
[0032] The present invention will be further described and illustrated below with reference to specific embodiments and the accompanying drawings:
[0033] Please see Figure 1 This invention discloses an operating system terminal detection algorithm based on an anomaly detection model, comprising an operating system terminal and an anomaly detection model. The operating system terminal includes the anomaly detection model, and the detection algorithm steps of the operating system terminal are as follows:
[0034] S1. Detection: The security information detection system within the operating system terminal detects the information entering the operating system terminal to check for viruses. If no viruses are found, the information proceeds directly to the next step. If the information contains viruses, it is defined as abnormal information and removed from the operating system terminal for further detection.
[0035] S2. Allocation: Separate the digital information from the image information, and then the digital information and the image information are respectively entered into the anomaly detection 1 and comparison 1 in the operating system terminal, and then proceed to the next step of processing;
[0036] S3. Comparison of digital information anomaly handling and image information anomaly handling.
[0037] S31: Digital information enters anomaly detection step 1 for anomaly detection.
[0038] S311. If the digital information does not show any abnormality in the anomaly detection result, the digital information will be processed normally.
[0039] S312. If the digital information is found to be abnormal in the anomaly detection one, the digital information will be entered into the anomaly detection model and re-detected by the anomaly detection two in the anomaly detection model;
[0040] S313. Anomaly Detection II: Anomaly Detection II includes Anomaly Detection I, statistical testing methods, depth-based methods, bias-based methods, distance-based methods, density-based methods, and deep learning methods, which are used for cyclical detection. If no problems are found, the digital information is processed normally. When Anomaly Detection II is used to cyclically detect digital information, if N < 7, the digital information is cyclically detected within Anomaly Detection II. Each time it is checked, N+1 is performed. If N ≥ 7, Anomaly Detection II ends. If an anomaly is found in one of them, the abnormal digital information is moved into the information anomaly and then removed from the operating system terminal.
[0041] S32: Image information is entered into Comparison 1 for anomaly detection.
[0042] S321. Compare the picture information in Comparison 1. If there is no abnormality, enter Comparison 2 to compare the picture information. If there is no abnormality, process the picture information normally. If an abnormality occurs in Comparison 1 and Comparison 2, enter Abnormal Comparison M;
[0043] S322. In Abnormal Comparison M, compare the picture information M times. If there is no abnormality, process the picture information normally. When Abnormal Comparison M performs cyclic detection on the picture information, if M < a and a ≥ 3, cycle the digital information for detection within Abnormal Comparison M. Each time it is checked, M + 1 will be performed. If M ≥ a, the detection of Abnormal Comparison M ends. If a comparison abnormality occurs in one of them, the picture information will enter the abnormal information and then be removed from the operating system terminal.
[0044] As a preferred option, in S313, the statistical testing methods are as follows: The basic assumption of these methods is that normal data follows a specific distribution and constitutes a large proportion, while outliers are significantly offset from normal points. The depth-based method locates outliers from the edge of the point space, determining the number of layers and outliers according to different needs. The densely packed black dots in the circle represent individual data points. The assumption is that the points with higher density and more concentrated distribution at the center of the point space are normal points, while outliers are located in the outer layers, i.e., sparser distribution areas. The bias-based method is a relatively simple statistical method. Originally designed for one-dimensional anomaly detection, given a dataset, each point is examined. If a point's value deviates significantly from the set's overall metric, it's considered an anomaly. This metric represents the decrease in variance after removing a point from the set. A threshold is set and compared to these deviation values to determine which points are anomalies. Distance-based methods calculate the distance between each point and its surrounding points to determine anomalies. The assumption is that normal points have many nearest neighbors, while anomaly points are far from their surroundings. Density-based methods are similar to distance-based methods. The method calculates the density of a given point and the density of its neighbors, then calculates a relative density based on these two values, which serves as an anomaly score. A higher relative density indicates a higher degree of anomaly. This method is based on the assumption that normal points have similar densities to their neighbors, while anomaly points have significantly different densities. The motivation for this approach is that distance-based anomaly detection methods do not handle datasets with varying densities well. If a distance-based model is used, with the radius and scale already set, point o2 is easily identified as an anomaly because many points in the upper right C1 subset are closer to their neighbors than o2, and many of these points would be labeled as normal. However, from the perspective of density, O2 is more like a normal point. Therefore, no matter which angle we look at it from, we may ignore the features in another dimension. So we still need to choose the algorithm or combine algorithms according to the specific scenario, target task, and the characteristics of the dataset itself. Deep learning method: The autoencoder consists of two parts: encoder one and decoder two. The left part is encoder one, which can compress the high-dimensional input into a low-dimensional form. In this process, the neural network will try to retain useful information and remove some unimportant information and noise. The right part is decoder two, which is responsible for restoring the compressed data and trying to restore it to its original form.
[0045] Example 1
[0046] An operating system terminal detection algorithm based on an anomaly detection model includes an operating system terminal and an anomaly detection model. The detection algorithm steps for the operating system terminal are as follows:
[0047] S1. Detection: The security information detection system within the operating system terminal detects the information entering the operating system terminal to check for viruses. If no viruses are found, the information proceeds directly to the next step. If the information contains viruses, it is defined as abnormal information and removed from the operating system terminal for further detection.
[0048] S2. Allocation: Separate the digital information from the image information, and then the digital information and the image information are respectively entered into the anomaly detection 1 and comparison 1 in the operating system terminal, and then proceed to the next step of processing;
[0049] S3. Comparison of digital information anomaly handling and image information anomaly handling.
[0050] S31: Digital information enters anomaly detection step 1 for anomaly detection.
[0051] S311. If the digital information does not show any abnormality in the anomaly detection result, the digital information will be processed normally.
[0052] S312. If the digital information is found to be abnormal in the anomaly detection one, the digital information will be moved into the information anomaly detection and then removed from the operating system terminal;
[0053] S32: Image information is entered into Comparison 1 for anomaly detection.
[0054] S321. Compare the image information in Comparison 1. If there is no abnormality, proceed to Comparison 2 to compare the image information. If there is no abnormality, process the image information normally. If an abnormality occurs in Comparison 1 and Comparison 2, the image information will be entered into the abnormal information and then removed from the operating system terminal.
[0055] Example 2
[0056] An operating system terminal detection algorithm based on an anomaly detection model includes an operating system terminal and an anomaly detection model. The detection algorithm steps for the operating system terminal are as follows:
[0057] S1. Detection: The security information detection system within the operating system terminal detects the information entering the operating system terminal to check for viruses. If no viruses are found, the information proceeds directly to the next step. If the information contains viruses, it is defined as abnormal information and removed from the operating system terminal for further detection.
[0058] S2. Allocation: Separate the digital information from the image information, and then the digital information and the image information are respectively entered into the anomaly detection 1 and comparison 1 in the operating system terminal, and then proceed to the next step of processing;
[0059] S3. Comparison of digital information anomaly handling and image information anomaly handling.
[0060] S31: Digital information enters anomaly detection step 1 for anomaly detection.
[0061] S311. If the digital information does not show any abnormality in the anomaly detection result, the digital information will be processed normally.
[0062] S312. If the digital information is found to be abnormal in the anomaly detection one, the digital information will be entered into the anomaly detection model and re-detected by the anomaly detection two in the anomaly detection model;
[0063] S313. Anomaly Detection II: Anomaly Detection II includes Anomaly Detection I, statistical testing methods, depth-based methods, bias-based methods, distance-based methods, density-based methods, and deep learning methods, which are used for cyclical detection. If no problems are found, the digital information is processed normally. When Anomaly Detection II is used to cyclically detect digital information, if N < 7, the digital information is cyclically detected within Anomaly Detection II. Each time it is checked, N+1 is performed. If N ≥ 7, Anomaly Detection II ends. If an anomaly is found in one of them, the abnormal digital information is moved into the information anomaly and then removed from the operating system terminal.
[0064] S32: Image information is entered into Comparison 1 for anomaly detection.
[0065] S321. Compare the image information in Comparison 1. If there is no abnormality, proceed to Comparison 2 to compare the image information. If there is no abnormality, process the image information normally. If an abnormality occurs in Comparison 1 and Comparison 2, proceed to Abnormal Comparison M.
[0066] S322. In the anomaly comparison M, the image information is compared M times. If there is no anomaly, the image information is moved to normal information processing. When the anomaly comparison M performs cyclic detection of the image information, a=3. If M<3, the digital information is cyclically detected in the anomaly comparison M. Each time it is checked, M+1 will be performed. If M≥3, the anomaly comparison M detection ends. If one of the comparisons is abnormal, the image information will be moved to the abnormal information and then removed from the operating system terminal.
[0067] Example 3
[0068] An operating system terminal detection algorithm based on an anomaly detection model includes an operating system terminal and an anomaly detection model. The detection algorithm steps for the operating system terminal are as follows:
[0069] S1. Detection: The security information detection system within the operating system terminal detects the information entering the operating system terminal to check for viruses. If no viruses are found, the information proceeds directly to the next step. If the information contains viruses, it is defined as abnormal information and removed from the operating system terminal for further detection.
[0070] S2. Allocation: Separate the digital information from the image information, and then the digital information and the image information are respectively entered into the anomaly detection 1 and comparison 1 in the operating system terminal, and then proceed to the next step of processing;
[0071] S3. Comparison of digital information anomaly handling and image information anomaly handling.
[0072] S31: Digital information enters anomaly detection step 1 for anomaly detection.
[0073] S311. If the digital information does not show any abnormality in the anomaly detection result, the digital information will be processed normally.
[0074] S312. If the digital information is found to be abnormal in the anomaly detection one, the digital information will be entered into the anomaly detection model and re-detected by the anomaly detection two in the anomaly detection model;
[0075] S313. Anomaly Detection II: Anomaly Detection II includes Anomaly Detection I, statistical testing methods, depth-based methods, bias-based methods, distance-based methods, density-based methods, and deep learning methods, which are used for cyclical detection. If no problems are found, the digital information is processed normally. When Anomaly Detection II is used to cyclically detect digital information, if N < 7, the digital information is cyclically detected within Anomaly Detection II. Each time it is checked, N+1 is performed. If N ≥ 7, Anomaly Detection II ends. If an anomaly is found in one of them, the abnormal digital information is moved into the information anomaly and then removed from the operating system terminal.
[0076] S32: Image information is entered into Comparison 1 for anomaly detection.
[0077] S321. Compare the image information in Comparison 1. If there is no abnormality, proceed to Comparison 2 to compare the image information. If there is no abnormality, process the image information normally. If an abnormality occurs in Comparison 1 and Comparison 2, proceed to Abnormal Comparison M.
[0078] S322. In the anomaly comparison M, the image information is compared M times. If there is no anomaly, the image information is moved to normal information processing. When the anomaly comparison M performs cyclic detection of the image information, a=10. If M<10, the digital information is cyclically detected in the anomaly comparison M. Each time it is checked, M+1 will be performed. If M≥10, the anomaly comparison M detection ends. If one of the comparisons is abnormal, the image information will be moved to the abnormal information and then removed from the operating system terminal.
[0079] In Examples 1, 2, and 3, Example 1 did not use an anomaly detection model or anomaly comparison. In Examples 2 and 3, the value of 'a' changed while the other parameters remained unchanged. It can be seen that the detection result in Example 1 has a higher probability of error, while the detection result in Example 3 has better quality. Therefore, it can be seen that when using an anomaly detection model and anomaly comparison, the larger the parameter 'a', the lower the probability of error in the detection result. However, the larger the parameter 'a', the longer the anomaly detection time also increases.
[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit the scope of protection of the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the essence and scope of the technical solutions of the present invention.
Claims
1. An operating system terminal detection algorithm based on an anomaly detection model, comprising an operating system terminal and an anomaly detection model, characterized in that: The operating system terminal includes an anomaly detection model. The detection algorithm included in the operating system terminal is as follows: S1. Detection: Use the security information detection system in the operating system terminal to detect the information entering the operating system terminal. Check whether the content information has a virus. If not, directly proceed to the next step. If the content carries a virus, directly define the information as abnormal information, and then remove it from the operating system terminal detection. S2. Allocation: Separate the digital information and the picture information, and then the digital information and the picture information enter the anomaly detection one and comparison 1 in the operating system terminal respectively, and then proceed to the next step of processing. S3. Abnormal processing of digital information and abnormal comparison of picture information S31: The digital information enters anomaly detection one for anomaly detection S311. If the detection result of the digital information in anomaly detection one is normal, the digital information will undergo normal information processing. S312. If the detection result of the digital information in anomaly detection one is abnormal, the digital information will enter the anomaly detection model and be re-detected by anomaly detection two in the anomaly detection model. S313. Anomaly detection two: Anomaly detection two includes anomaly detection one, statistical test methods, depth-based methods, deviation-based methods, distance-based methods, density-based methods, and deep learning methods. Perform cyclic detection. If there are no problems, perform normal information processing on the digital information. If one of them shows an anomaly, move the abnormal digital information into information anomaly, and then remove it from the operating system terminal. S32: The picture information enters comparison 1 for anomaly detection S321. Compare the picture information in comparison 1. If there is no anomaly, enter comparison 2 for picture information comparison. If there is no anomaly, perform normal information processing on the picture information. If an anomaly occurs in comparison 1 and comparison 2, enter anomaly comparison M. S322. Perform M comparisons on the picture information in anomaly comparison M. If there is no anomaly, the picture information will enter normal information processing. If one of them shows a comparison anomaly, the picture information will enter abnormal information, and then be removed from the operating system terminal.
2. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S1, if the content carries a virus, directly define the information as abnormal information, and then remove it from the operating system terminal detection. In S313, if one of them shows an anomaly, move the abnormal digital information into information anomaly, and then remove it from the operating system terminal. In S322, if one of them shows a comparison anomaly, the picture information will enter abnormal information, and then be removed from the operating system terminal.
3. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S313, when anomaly detection two performs cyclic detection on the digital information, if N < 7, the digital information will be cyclically detected within anomaly detection two, and N + 1 will be performed each time it is checked. If N ≥ 7, the detection of anomaly detection two ends.
4. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S322, when anomaly comparison M performs cyclic detection on the picture information, if M < a, a ≥ 3, the digital information will be cyclically detected within anomaly comparison M, and M + 1 will be performed each time it is checked. If M ≥ a, the detection of anomaly comparison M ends.
5. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S313, the statistical test method is based on the assumption that normal data follows a specific distribution and accounts for a large proportion, while the location of outliers is significantly different from that of normal data.
6. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S313, the depth-based method is used to locate abnormal points from the edge of the point space. The number of layers and the number of abnormal points are determined according to different needs. The dense black dots in the circle represent individual data points. The assumption is that the points in the center of the point space, which are relatively concentrated and have a high density, are normal points, while abnormal points are located in the outer layer, that is, in places where the distribution is relatively sparse.
7. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S313, the bias-based method is a relatively simple statistical method that was originally designed for single-dimensional anomaly detection. Given a dataset, each point is detected. If the value of a point deviates too much from the index of the entire set, then the point is an anomaly. The meaning of this index is the difference in variance reduction after a point is removed from the set. We determine which points are anomalies by setting a threshold and comparing it with these bias values.
8. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S313, the distance-based method is used to calculate the distance between each point and its surrounding points to determine whether a point is abnormal. The assumption is that normal points have many neighboring points, while abnormal points are far away from their surrounding points.
9. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S313, the density-based method is similar to the distance-based method. This type of method calculates the density of the surrounding points of the point under study and the density of the surrounding points of its neighboring points. Based on these two density values, a relative density is calculated as an anomaly score. That is, the higher the relative density, the higher the degree of anomaly. The underlying assumption is that the density of normal points and their nearest neighbors is similar, while the density of anomaly points differs significantly from that of their surrounding points. The motivation for designing this method is that distance-based anomaly detection methods cannot handle some datasets with varying densities very well. If a distance-based model is used, the radius and scale are already set, and point o2 is easily identified as an anomaly because many points in the upper right C1 subset are closer to their surrounding points than o2, and many of these points will be marked as normal points. However, from the perspective of density, o2 is more like a normal point. Therefore, from any perspective, we may overlook features in another dimension. Thus, the choice of algorithm or the combination of algorithms should be based on the specific scenario, target task, and characteristics of the dataset itself.
10. The operating system terminal detection algorithm based on an anomaly detection model according to claim 1, characterized in that: In S313, the deep learning method: the autoencoder consists of two parts: encoder one and decoder two. The left part is encoder one, which can compress high-dimensional input into a low-dimensional form. In this process, the neural network will try to retain useful information and remove some unimportant information and noise. The right part is decoder two, which is responsible for restoring the compressed data and trying to restore it to its original form.