A behavior anomaly detection method and system based on data behavior bias

Abstract

The present invention discloses a behavior anomaly detection method and system based on data behavior bias, the method comprising: obtaining relevant business indicators; determining input vectors; calculating theoretical data behavior bias indicators; performing normal mean regression on theoretical data behavior bias indicator data to obtain expected regression curves, upper envelopes, lower envelopes and enlarged envelopes; calculating data behavior bias indicators under business forms; comparing data behavior bias indicators under business forms with expected regression curves, upper envelopes, lower envelopes and enlarged envelopes to obtain business behavior anomaly detection results. The present invention quantifies the impact of data behavior anomalies, and it is more effective to identify behavioral anomalies through the depth of abnormal impact; establishes a data behavior bias periodic fluctuation model to eliminate the fluctuation impact on the time period, and more accurately identifies abnormal behaviors; establishes a business volume fluctuation impact suppression function to suppress the impact of business volume fluctuations on the effectiveness of abnormal behavior detection.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal detection of user behavior and application behavior in computer software and network business services, and in particular to a method and system for detecting abnormal behavior based on data behavior bias. Background Art

[0002] In network and business operation and maintenance, statistical threshold mechanisms are often used to identify abnormal user behavior. For example, in monitoring TCP network attack behavior, thresholds for single-user access frequency and incremental changes in the establishment of overall TCP links in the network are usually set to quickly determine possible TCP attacks. Rapid detection of UDP attacks and ICMP attacks also uses a similar approach.

[0003] The above-mentioned prior art identifies abnormal user behavior, and this mechanism has at least the following defects: first, data behavior may fluctuate on the time axis, but in engineering practice, the threshold cannot adapt to the reasonable fluctuations in the time period, that is, the threshold setting is either too large or too small, resulting in insufficient detection effectiveness; second, it is difficult to adapt to fluctuations in business volume. For example, when the business volume increases, the amount of anomalies increases; when the business volume decreases, the amount of anomalies decreases accordingly. In this case, the threshold mechanism will also lead to insufficient detection effectiveness or even misjudgment; third, the threshold mechanism cannot be adaptively adjusted with the normal changes in the overall behavior, that is, in engineering practice, the threshold needs to be readjusted after the overall behavior changes. In the process of natural and gradual changes in the overall behavior, the threshold mechanism will be in a state of insufficient effectiveness or even failure for a long time. Summary of the invention

[0004] To this end, an object of the present invention is to propose a behavior anomaly detection method and system based on data behavior bias to solve the problems mentioned in the background technology and overcome the deficiencies in the prior art.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A behavior anomaly detection method based on data behavior bias, comprising: obtaining relevant business indicators; dividing the relevant business indicators into a training sample set and a real-time detection sample set; determining an input vector according to the relevant business indicators; calculating a theoretical data behavior bias indicator according to the training sample set, the input vector and a data behavior bias amount formula based on traffic fluctuation influence suppression Behavioral paranoia about theoretical data and indicator data Perform normal mean regression to obtain the expected regression curve f(t), upper envelope U(t), lower envelope D(t) and amplified envelope R(t); calculate the data behavior bias index under the business form based on the real-time detection sample set, input vector and the data behavior bias formula based on traffic fluctuation suppression. The data behavior paranoia indicator under the business form By comparing with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the amplified envelope R(t), the business behavior anomaly detection result is obtained.

[0007] Preferably, the related indicators at least include the number of TCP upstream messages, the number of TCP downstream messages, the number of SYN requests, the number of SYN responses, the TCP upstream flow and the TCP downstream flow.

[0008] Preferably, the input vector and the data behavior bias amount formula based on traffic fluctuation influence suppression are as follows:

[0009] Input vector:

[0010] {v t : Current time, v1: TCP upstream message count, v2: TCP downstream message count, v3: upstream TCP

[0011] -SYN times, v4: Downstream TCP-ACK times}

[0012] Data behavior bias formula:

[0013] p θt (t)=p0(t)+μ(t)

[0014]

[0015]

[0016] Among them, p0(t) represents the weighted function of attribute service quality indicator data, μ(t) is the expected load indicator suppression function, δ is the load change suppression degree, is the historical center value at the same moment in the time domain period, γ is the paranoid type weight, 0≤γ≤1.

[0017] As a preferred method, the theoretical data behavior bias index is calculated based on the training sample set, the input vector and the data behavior bias amount formula based on the suppression of traffic fluctuation influence. Before, it also includes: grouping the training sample set according to the sampling period, that is, all the data at the same time point in the period are taken as a sequence to be counted at the current time point, and the time series T = {t1, t2, ..., t p}, the original bias matrix at each time point is t p , They represent the time-increasing sequence of the sampling time period and the original biased sequence of each time series point respectively.

[0018] As a preference, the theoretical data is biased against the indicator data Before normal mean regression, it also includes: using the quantile range method to remove the theoretical data behavior bias indicator data Abnormal data in .

[0019] As a preference, the data behavior bias indicator under the business form By comparing with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the amplified envelope R(t), the business behavior anomaly detection result is obtained. The specific process is as follows:

[0020] Data behavior paranoia indicators under business forms Compared with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the enlarged envelope R(t), the specific comparison results are as follows:

[0021] like The paranoid detection result at that moment is a business anomaly, and the system issues a real-time alarm;

[0022] like The paranoid detection result at that moment is that the business is suspected to be abnormal, and the system issues a real-time alarm;

[0023] like The paranoid detection result at this moment is that the business is normal;

[0024] like The paranoid detection result at this moment is that the business is normal;

[0025] like The paranoid detection result at that moment is a system abnormality, and the system issues a real-time alarm.

[0026] As a preferred embodiment, it also includes: sampling a number of monitoring points within a fixed period, the number of monitoring points is recorded as A, presetting the paranoid strength quantization thresholds T1 and T2, T1>T2>0, counting the number of distortion points in the monitoring points within the historical fixed period, recorded as B, and judging The relationship between the thresholds T1 and T2; specifically, if Then the paranoia intensity is 0; if The paranoia intensity is 3; if Then the paranoia intensity is 2; if Then the paranoia intensity is 1.

[0027] The present invention also provides a behavior anomaly detection system based on data behavior bias, including: an indicator acquisition module for acquiring relevant business indicators; a vector generation module for generating input vectors according to the acquired relevant business indicators; a bias indicator calculation module for calculating theoretical data behavior bias indicators according to a data behavior bias amount formula based on traffic fluctuation influence suppression. Data behavior bias indicators under business forms The curve image generation module generates the expected regression curve f(t), upper envelope U(t), lower envelope D(t) and enlarged envelope R(t) and their images according to the calculation results of the bias index calculation module; the detection and comparison module generates the bias index of the data behavior under the business form according to the business form. It is compared with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the amplified envelope R(t), and the comparison result is output; a bias strength determination module is used to calculate and output the bias strength of the business; a storage module is used to store the relevant data generated by each module; a display module is used to display the output results of the curve image generation module, the detection and comparison module and the bias strength determination module; an alarm module is used to issue an alarm based on the comparison result of the detection and comparison module and the bias strength output by the bias strength determination module.

[0028] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the above-mentioned behavior anomaly detection method based on data behavior bias are implemented.

[0029] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for detecting behavioral anomalies based on data behavioral bias as described above is implemented.

[0030] Therefore, the present invention has the following beneficial effects:

[0031] The present invention provides a behavior anomaly detection method and system based on data behavior bias, which collects data from multiple dimensions such as business time, business volume change, and abnormal behavior impact, introduces a mathematical model, quantifies the impact of data behavior anomalies, and more effectively identifies behavioral anomalies through the depth of abnormal impact; the present invention establishes a data behavior bias periodic fluctuation model, that is, a data behavior bias quantity formula based on traffic fluctuation impact suppression, eliminates the fluctuation impact on the time period, and more accurately identifies abnormal behavior; the present invention establishes a business volume fluctuation impact suppression function, which is used to suppress the impact of business volume fluctuations on the effectiveness of abnormal behavior detection.

[0032] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0034] Figure 1is a flow chart of the method of the present invention;

[0035] Figure 2 Schematic diagram of the TCP flow paranoid anomaly detection envelope in an embodiment of the present invention;

[0036] Figure 3 Schematic diagram of TCP traffic anomaly detection according to an embodiment of the present invention;

[0037] Figure 4 is a schematic diagram of the system structure of an embodiment of the present invention;

[0038] Figure 5 The figure is a basic structural block diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0040] like Figure 1 As shown, a behavior anomaly detection method based on data behavior bias includes: obtaining relevant business indicators; dividing the relevant business indicators into a training sample set and a real-time detection sample set; determining an input vector according to the relevant business indicators; calculating a theoretical data behavior bias index according to the training sample set, the input vector and a data behavior bias amount formula based on traffic fluctuation influence suppression Behavioral paranoia about theoretical data and indicator data Perform normal mean regression to obtain the expected regression curve f(t), upper envelope U(t), lower envelope D(t) and amplified envelope R(t); calculate the data behavior bias index under the business form based on the real-time detection sample set, input vector and the data behavior bias formula based on traffic fluctuation suppression. The data behavior paranoia indicator under the business form By comparing with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the amplified envelope R(t), the business behavior anomaly detection result is obtained.

[0041] The present invention provides a behavior anomaly detection method based on data behavior bias, which collects data from multiple dimensions such as business time, business volume change, and abnormal behavior impact, introduces a mathematical model, quantifies the impact of data behavior anomalies, and more effectively identifies behavioral anomalies through the depth of abnormal impact; the present invention establishes a data behavior bias periodic fluctuation model, that is, a data behavior bias quantity formula based on traffic fluctuation impact suppression, eliminates the fluctuation impact on the time period, and more accurately identifies abnormal behavior; the present invention establishes a business volume fluctuation impact suppression function, which is used to suppress the impact of business volume fluctuations on the effectiveness of abnormal behavior detection.

[0042] Specifically, the relevant indicators include at least the number of TCP upstream packets, the number of TCP downstream packets, the number of SYN requests, the number of SYN responses, the TCP upstream flow, and the TCP downstream flow.

[0043] It should be understood that the above-mentioned related indicators are only illustrative. According to the implementation requirements, the above-mentioned related indicators can be simply increased, reduced or replaced, which should be included in the protection scope of the present invention.

[0044] Specifically, the formula for the input vector and the data behavior bias based on the suppression of traffic fluctuations is as follows:

[0045] Input vector:

[0046] {v t : Current time, v1: TCP upstream message count, v2: TCP downstream message count, v3: upstream TCP

[0047] -SYN times, v4: Downstream TCP-ACK times}

[0048] Data behavior bias formula:

[0049] p θt (t)=p0(t)+μ(t)

[0050]

[0051]

[0052] Among them, p0(t) represents the weighted function of attribute service quality indicator data, μ(t) is the expected load indicator suppression function, δ is the load change suppression degree, is the historical center value at the same moment in the time domain period, γ is the paranoid type weight, 0≤γ≤1.

[0053] It should be understood that the input vector is determined according to relevant business indicators, which are divided into training sample sets and real-time detection sample sets. The data behavior bias calculated based on the input vector determined by the training sample set is the theoretical data behavior bias index. The data behavior bias value calculated based on the input vector determined by the real-time detection sample set is the data behavior bias index under the business form.

[0054] The relevant business indicators are collected according to the time period, that is, at every moment, a set of indicator data including the number of TCP upstream packets, the number of TCP downstream packets, the number of SYN requests, the number of SYN responses, the TCP upstream flow and the TCP downstream flow can be collected. The difference between the training sample set and the real-time detection sample set is that the training samples are obtained in batches from a given data source and belong to historical data; the real-time detection sample set is obtained in real time from a given data source and is real-time data.

[0055] Both the training sample set and the real-time detection sample set contain several groups of relevant business indicator data. Each group of relevant business indicator data can determine an input vector. An input vector can be used to calculate a theoretical data behavior bias index through the data behavior bias amount formula based on the suppression of traffic fluctuations. Or a data behavior paranoia indicator under a business form

[0056] As an implementation method, a theoretical data behavior bias index is calculated based on a training sample set, an input vector, and a data behavior bias amount formula based on suppression of traffic fluctuation influence. Before, it also includes: grouping the training sample set according to the sampling period, that is, all the data at the same time point in the period are taken as a sequence to be counted at the current time point, and the time series T = {t1, t2, ..., t p}, the original bias matrix at each time point is t p , They represent the time-increasing sequence of the sampling time period and the original biased sequence of each time series point respectively.

[0057] As an implementation method, in the case of theoretical data behavior paranoid indicator data Before normal mean regression, it also includes: using the quantile range method to remove the theoretical data behavior bias indicator data Abnormal data in .

[0058] As an implementation method, data behavior bias indicators under business forms By comparing with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the amplified envelope R(t), the business behavior anomaly detection result is obtained. The specific process is as follows:

[0059] Data behavior paranoia indicators under business forms Compared with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the enlarged envelope R(t), the specific comparison results are as follows:

[0060] like The paranoid detection result at that moment is a business anomaly, and the system issues a real-time alarm;

[0061] like The paranoid detection result at that moment is that the business is suspected to be abnormal, and the system issues a real-time alarm;

[0062] like The paranoid detection result at this moment is that the business is normal;

[0063] like The paranoid detection result at this moment is that the business is normal;

[0064] like The paranoid detection result at that moment is a system abnormality, and the system issues a real-time alarm.

[0065] As an implementation method, the method further includes: sampling a number of monitoring points within a fixed period, the number of monitoring points is recorded as A, presetting the paranoid strength quantization thresholds T1 and T2, T1>T2>0, counting the number of distortion points in the monitoring points within the historical fixed period, recorded as B, and judging The relationship between the thresholds T1 and T2; specifically, if Then the paranoia intensity is 0; if The paranoia intensity is 3; if Then the paranoia intensity is 2; if Then the paranoia intensity is 1.

[0066] It should be understood that, as an implementation method, the paranoid intensity quantization thresholds T1 and T2 can be selectively set according to actual business behavior, and are not specifically limited in this implementation method. For example, they can be set according to changes in user behavior and / or business scale and / or time. Different user behaviors and / or different business scales and / or different times can set corresponding paranoid intensity quantization thresholds T1 and T2.

[0067] As another implementation, the paranoia strength quantization thresholds T1 and T2 may be a single fixed value that does not change with changes in user behavior and / or business scale and / or time.

[0068] Next, a behavior anomaly detection method based on data behavior bias of the present invention is further described in detail with reference to the accompanying drawings.

[0069] The present invention defines the result obtained by selecting a group of indicators related to changes in user behavior, business scale, time, etc. after substituting them into a mathematical model for calculation as a data behavior bias indicator. Track its fluctuations in the time domain, capture periodic fluctuation characteristics, and construct the expected operation curve f(t), upper envelope U(t), lower envelope D(t), and R envelope R(t) of its fluctuations in the time domain. Determine the rationality of data interaction in network and service operation and maintenance by observing the fluctuations of the data behavior bias indicator in the envelope cavity, and capture the behavior of the data behavior bias indicator breaking through the R envelope to detect and determine whether there is data bias behavior that affects business and network operations, and quantify the bias intensity. The specific process is as follows:

[0070] (1) Clarify the monitored objects, data behaviors and related business indicators

[0071] Monitored object: This can be a network or application related entity.

[0072] Determine the data behaviors that need to be detected, such as TCP flood attack behaviors, UDP attack behaviors, ICMP attack behaviors, user service preferences, etc.

[0073] Select and obtain relevant indicators based on the determined data behavior detection.

[0074] Changes in data behavior usually trigger changes in one or more related indicators. The related change indicators are selected as input parameters of the detection algorithm: for example, a TCP flood attack causes an increase in upstream messages and an increase in the number of SYN establishment requests. Indicators such as the number of TCP upstream messages, the number of TCP downstream messages, the number of SYN requests, the number of SYN responses, TCP upstream traffic, and TCP downstream traffic can be selected as input parameters of the paranoid detection algorithm for detecting TCP flood attack behavior.

[0075] (2) Define data bias calculation rules

[0076] Defining bias means quantifying the degree of imbalance in the data performance of business behavior. For example, when the TCP business is running smoothly, the ratio of the number of SYN establishment requests to the upstream traffic and the ratio of the number of SYN establishment requests to the number of upstream messages are relatively stable. When subjected to a TCP flood attack, the ratio of the number of SYN establishment requests to the upstream traffic and the ratio of the number of SYN establishment requests to the number of upstream messages will increase.

[0077] Input vector determination: t = {v t : Current time, v1: TCP uplink message count, v2: TCP downlink message count, v3: Uplink TCP-SYN times, v4: Downlink TCP-ACK times}

[0078] Quantitative definition of data behavior bias:

[0079] Flow change impact suppression function:

[0080] Quantitative definition of data behavior bias based on suppression of traffic fluctuations:

[0081] Among them, δ is the load change suppression degree, which can be 1, 2, 3, etc. It is the historical center value at the same moment in the time domain period.

[0082] (3) Data sample collection

[0083] ① Training sample collection

[0084] The training samples are obtained in batches from a given data source. Each sample contains a certain number of attribute features. Suppose the training sample set is:

[0085] θ0={[x 11 ,x 12 ,...,x 1m ],[x 21 ,x 22 ,...,x 2m ]…[x n1 ,x n2 ,...,x nm ]}

[0086] Where n is the number of samples, the lower limit of the number of samples is set to threshold, n ≥ threshold, and m is the number of sample attributes.

[0087] ②Test sample collection

[0088] Collection of real-time detection samples. Real-time detection samples are obtained from a given data source in real time. Each sample contains a certain number of attribute features. Suppose the real-time detection sample set is:

[0089] θ1={[x 11 ,x 121 ,...,x 1m ],[x 21 ,x 22 ,...,x 2m ]…[x q1 ,x q2 ,...,x qm ]}

[0090] Where q is the number of samples and the value of q depends on the actual production environment, and m is the number of sample attributes.

[0091] (4) Sample training denoising and envelope generation

[0092] The historical data of the training sample period are grouped according to the sampling period, that is, all the data at the same time point in the whole period are taken as a statistical series to be studied at the current time point. The same time point here refers to the same moment in the total period in days. Generally, let the whole time series T = {t1, t2, ..., t p}, the original bias matrix at each time point is t p , They are respectively represented as the time increasing sequence of the sampling time period and the original bias sequence of each time series point, and the theoretical final state bias p θt (t) is defined as the comprehensive relationship between the weighted attribute service quality indicator data, denoted as p0(t), and the expected load indicator suppression function, denoted as μ(t), that is, under different loads and original bias definitions. Theoretical final state bias p θt (t) is a nonlinear mapping function of μ(t) and p0(t), which is related to the expected load index suppression function (μ(t), μ(t) is the load tracking corresponding curve under the paranoid business form (where the final state paranoid suppression level power constant is δ)) and the original weighted paranoid type (p0(t), where the paranoid type weight vector is γ). The theoretical final state correction paranoid matrix at each time point is Using the quantile range method to remove After removing the abnormal data from the matrix, the data is regressed to the normal mean to obtain the expected regression curve, upper envelope U(t), lower envelope D(t) and enlarged envelope R(t).

[0093] The quantile range method is an outlier detection algorithm for skewed distribution data. It is used to determine the difference between the third quartile and the first quartile. The interquartile range is equal to Q3-Q1, where Q3 is the third quartile and Q1 is the first quartile, which can represent the degree of dispersion of each sequence variable. The quantile range method can be used to identify outliers, and data that exceeds the upper and lower limits of the interquartile range are considered outliers. The standardized interquartile range is the interquartile range multiplied by a factor of 0.7413, which is equivalent to the standard deviation (SD) in the normal distribution, such as Figure 2 This is the image after the TCP traffic final state bias is removed and normal mean regressed.

[0094] After denoising through sample training, the algorithm can effectively remove the interference of abnormal sequences on the post-detection state, and the algorithm detection baseline is based on self-supervisory features to learn noise and research objects, and has detection adaptive characteristics.

[0095] (5) Dynamic service quality detection stage

[0096] After establishing the expected regression curve, upper envelope U(t), lower envelope D(t), and amplified envelope R(t) of the selected object, anomaly detection can be performed on the real-time output sample indicators of the selected object. The schematic diagram of object anomaly detection is shown in Figure 3 As shown, the detection process is as follows:

[0097] For each discrete time point, obtain the real-time detection sample set θ1, and calculate the theoretical bias under the business form based on the real-time load of the sample and the original bias. The four envelopes calculated by the bias, namely the expected curve f(t), the upper envelope U(t), the lower envelope D(t), and the R envelope R(t), are numerically compared. In addition, in order to further quantify the intensity of this type of bias, several monitoring points are sampled within a fixed period, and the number of monitoring points is recorded as A. The bias intensity quantification thresholds are T1 and T2, and T1>T2>0. The specific comparison of the nonlinear discrete time-varying anomaly detection system is as follows:

[0098] like The paranoid detection at that moment is a business anomaly, and the production / detection system should issue a real-time alarm;

[0099] like The paranoid detection at this moment is a suspected business abnormality and should be continuously monitored;

[0100] like The paranoid detection at this moment indicates that the business is normal;

[0101] like The paranoid detection at this moment is that the business is normal (determined according to the specific business scenario);

[0102] like The paranoid detection at this moment is a system abnormality.

[0103] The number of distortion points in the monitoring points within the historical fixed period is recorded as B, and the judgment The relationship between the thresholds T1 and T2 is as follows: The paranoia intensity is 0. The paranoia intensity is the largest, and the paranoia intensity value is defined as 3. The service quality situation continues to deteriorate. The bias intensity is large, and the bias intensity value is defined as 2. We should continue to pay attention to the changes in the degradation direction. The intensity of paranoia is relatively small, and the value of paranoia intensity is defined as 1. It manifests as sporadic random attacks, so you only need to pay proper attention to it.

[0104] In view of the defects of the traditional technical statistical threshold mechanism, the present invention collects data from multiple dimensions such as business time, business volume change, and abnormal behavior impact, and introduces a mathematical model to solve the existing technical problems, mainly including:

[0105] Quantification of the impact of data behavior anomalies, i.e., behavioral paranoia definition, is more effective in identifying behavioral anomalies through the depth of anomaly impact;

[0106] The paranoid periodic fluctuation model of data behavior is established to eliminate the impact of fluctuations in time periods and identify abnormal behaviors more accurately;

[0107] A business volume fluctuation impact suppression function is established to suppress the impact of business volume fluctuations on the effectiveness of abnormal behavior detection.

[0108] like Figure 4 As shown, the present invention also provides a behavioral anomaly detection system based on data behavioral bias, including: an indicator acquisition module, a vector generation module, a bias indicator calculation module, a curve image generation module, a detection comparison module, a bias intensity determination module, a storage module, a display module and an alarm module.

[0109] The indicator acquisition module is respectively connected to the vector generation module, the bias indicator calculation module and the storage module; the bias indicator calculation module is respectively connected to the vector generation module, the detection and comparison module, the curve image generation module and the storage module; the detection and comparison module is respectively connected to the curve image generation module and the storage module; the curve image generation module is respectively connected to the bias strength determination module and the storage module; the bias strength determination module is connected to the storage module; the vector generation module is connected to the storage module; and the display module and the alarm module are both connected to the storage module.

[0110] The indicator acquisition module is used to obtain relevant business indicators. The relevant business indicators are divided into training sample sets and real-time detection sample sets. The relevant indicators at least include the number of TCP upstream messages, the number of TCP downstream messages, the number of SYN requests, the number of SYN responses, TCP upstream traffic and TCP downstream traffic.

[0111] The vector generation module generates an input vector based on the obtained relevant business indicators. Specifically, the input vector is in the following form:

[0112] {v t : Current time, v1: TCP upstream message count, v2: TCP downstream message count, v3: upstream TCP

[0113] -SYN times, v4: Downstream TCP-ACK times}

[0114] The bias index calculation module calculates the theoretical data behavior bias index based on the data behavior bias amount formula based on the suppression of traffic fluctuations. Data behavior bias indicators under business forms

[0115] The curve image generation module generates the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the enlarged envelope R(t) and their images according to the calculation results of the bias index calculation module, such as Figure 2 shown.

[0116] Detection and comparison module, based on data behavior bias indicators under business forms Compare with the expected regression curve f(t), upper envelope U(t), lower envelope D(t) and amplified envelope R(t), and output the comparison result.

[0117] The bias strength determination module calculates and outputs the bias strength / bias amount of business data behavior.

[0118] The storage module stores the relevant data generated by each module.

[0119] The display module displays the output results of the curve image generation module, the detection and comparison module and the bias strength determination module.

[0120] The alarm module issues an alarm based on the comparison result of the detection and comparison module and the bias strength output by the bias strength determination module. The paranoid detection result at that moment is a business anomaly, and the alarm module issues a real-time alarm; if The paranoid detection result at that moment is that the business is suspected to be abnormal, and the alarm module issues a real-time alarm; if The paranoid detection result at this moment is that the system is abnormal, and the alarm module issues a real-time alarm.

[0121] The sample training denoising module groups the historical data of the training sample period according to the sampling period, that is, all the data at the same time point in the whole period is taken as a statistical sequence to be studied at the current time point. The same time point here refers to the same moment in the total period in days. Generally, let the whole time series T = {t1, t2, ..., t p}, the original bias matrix at each time point is t p , They are respectively represented as the time increasing sequence of the sampling time period and the original bias sequence of each time series point, and the theoretical final state bias p θt (t) is defined as the comprehensive relationship between the weighted attribute service quality indicator data, denoted as p0(t), and the expected load indicator suppression function, denoted as μ(t), that is, under different loads and original bias definitions. Theoretical final state bias p θt(t) is a nonlinear mapping function of μ(t) and p0(t), which is related to the expected load index suppression function (μ(t), μ(t) is the load tracking corresponding curve under the paranoid business form (where the final state paranoid suppression level power constant is δ)) and the original weighted paranoid type (p0(t), where the paranoid type weight vector is γ). The theoretical final state correction paranoid matrix at each time point is (include ). Use the quantile range method to remove Matrix of abnormal data.

[0122] In order to solve the above technical problems, the embodiment of the present invention further provides a computer device, for details, please refer to Figure 5 , including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of a behavior anomaly detection method based on data behavior bias as described above are implemented.

[0123] The computer device includes a memory, a processor, and a network interface that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device with component memory, a processor, and a network interface, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0124] Computer devices can be computing devices such as desktop computers, notebooks, PDAs, and cloud servers. Computer devices can interact with users through keyboards, mice, remote controls, touch pads, or voice control devices.

[0125] The memory includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory can be an internal storage unit of a computer device, such as a hard disk or memory of the computer device. In other embodiments, the memory can also be an external storage device of a computer device, such as a plug-in hard disk equipped on the computer device, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory can also include both the internal storage unit of the computer device and its external storage device. In this embodiment, the memory is generally used to store the operating system and various application software installed on the computer device, such as the program code of the behavior anomaly detection method based on data behavior bias, etc. In addition, the memory can also be used to temporarily store various types of data that have been output or are to be output.

[0126] The processor may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor is generally used to control the overall operation of a computer device. In this embodiment, the processor is used to run program codes stored in a memory or process data, such as running program codes of a behavior anomaly detection method based on data behavior bias.

[0127] The network interface may include a wireless network interface and / or a wired network interface, which is generally used to establish a communication connection between a computer device and other electronic devices.

[0128] The present invention also provides another embodiment, namely, providing a computer-readable storage medium, which stores the behavior anomaly detection program based on data behavior bias, and the behavior anomaly detection program based on data behavior bias can be executed by at least one processor to enable the at least one processor to perform the steps of the behavior anomaly detection method based on data behavior bias as described above.

[0129] The present invention collects data from multiple dimensions such as business time, business volume changes, and abnormal behavior impact, introduces a mathematical model, quantifies the abnormal impact of data behavior, and more effectively identifies abnormal behavior through the depth of abnormal impact; the present invention establishes a data behavior paranoid periodic fluctuation model, that is, a data behavior paranoid quantity formula based on traffic fluctuation impact suppression, eliminates the fluctuation impact on the time period, and more accurately identifies abnormal behavior; the present invention establishes a business volume fluctuation impact suppression function, that is, an expected load indicator suppression function, which is used to suppress the impact of business volume fluctuations on the effectiveness of abnormal behavior detection.

[0130] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0131] It is not difficult for those skilled in the art to understand that the present invention includes any combination of the invention content and specific implementation methods of the above specification and the various parts shown in the drawings. Due to the limited space and to make the specification concise, the various schemes composed of these combinations are not described one by one. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0132] Although the embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. Those skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention without departing from the principles and purpose of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A behavior anomaly detection method based on data behavior bias, characterized in that: include: Obtain relevant business indicators; the relevant business indicators are divided into a training sample set and a real-time detection sample set; Determine the input vector based on relevant business indicators; The theoretical data behavior bias index is calculated based on the training sample set, input vector and the data behavior bias amount formula based on the suppression of traffic fluctuations. Behavioral paranoia about theoretical data and indicator data Perform normal mean regression to obtain the expected regression curve f(t), upper envelope U(t), lower envelope D(t) and enlarged envelope R(t); The data behavior bias index under the business form is calculated based on the real-time detection sample set, input vector and the data behavior bias amount formula based on the suppression of traffic fluctuations. The data behavior paranoia indicator under the business form Compare with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the amplified envelope R(t) to obtain the business behavior anomaly detection result; The formulas for the input vector and the data behavior bias based on traffic fluctuation influence suppression are as follows: Input vector: {v t : Current time, v1: TCP upstream message count, v2: TCP downstream message count, v3: upstream TCP-SYN times, v4: downstream TCP-ACK times} Data behavior bias formula: p θt (t)=p0(t)+μ(t) Among them, p0(t) represents the weighted function of attribute service quality indicator data, μ(t) is the expected load indicator suppression function, δ is the load change suppression degree, is the historical center value at the same moment in the time domain period, γ is the paranoid type weight, 0≤γ≤1.

2. The method for detecting behavioral anomalies based on data behavioral bias according to claim 1, characterized in that: The related indicators at least include the number of TCP upstream messages, the number of TCP downstream messages, the number of SYN requests, the number of SYN responses, the TCP upstream flow and the TCP downstream flow.

3. The behavior anomaly detection method based on data behavior bias according to claim 1, characterized in that: The theoretical data behavior bias index is calculated based on the training sample set, input vector and the data behavior bias formula based on the suppression of traffic fluctuations. Before, it also includes: grouping the training sample set according to the sampling period, that is, all the data at the same time point in the period are taken as a sequence to be counted at the current time point, and the time series T = {t1, t2, ..., t p }, the original bias matrix at each time point is t p , They represent the time-increasing sequence of the sampling time period and the original biased sequence of each time series point respectively.

4. The method for detecting behavioral anomalies based on data behavioral bias according to claim 1, characterized in that: Indicator data on theoretical data behavior paranoia Before normal mean regression, it also includes: using the quantile range method to remove the theoretical data behavior bias indicator data Abnormal data in .

5. The behavior anomaly detection method based on data behavior bias according to claim 1, characterized in that: Data behavior bias indicators under the business model By comparing with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the amplified envelope R(t), the business behavior anomaly detection result is obtained. The specific process is as follows: Data behavior paranoia indicators under business forms Compared with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the enlarged envelope R(t), the specific comparison results are as follows: like The paranoid detection result at that moment is a business anomaly, and the system issues a real-time alarm; like The paranoid detection result at that moment is that the business is suspected to be abnormal, and the system issues a real-time alarm; like The paranoid detection result at this moment is that the business is normal; like The paranoid detection result at this moment is that the business is normal; like The paranoid detection result at that moment is a system abnormality, and the system issues a real-time alarm.

6. The behavior anomaly detection method based on data behavior bias according to claim 5, characterized in that: Also includes: Sample several monitoring points in a fixed period, the number of monitoring points is recorded as A, preset the paranoid strength quantization thresholds T1 and T2, T1>T2>0, count the number of distortion points in the monitoring points in the historical fixed period, recorded as B, and judge Relationship with thresholds T1 and T2; Specifically, if Then the paranoia intensity is 0; like Then the paranoia intensity is 3; like Then the paranoia intensity is 2; like Then the paranoia intensity is 1.

7. A behavior anomaly detection system based on data behavior bias, applicable to the behavior anomaly detection method based on data behavior bias according to claim 1, characterized in that: include: Indicator acquisition module, used to obtain relevant business indicators; A vector generation module generates an input vector based on the obtained relevant business indicators; The bias index calculation module calculates the theoretical data behavior bias index based on the data behavior bias amount formula based on the suppression of traffic fluctuations. Data behavior bias indicators under business forms The curve image generation module generates the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the enlarged envelope R(t) and their images according to the calculation results of the bias index calculation module; Detection and comparison module, based on data behavior bias indicators under business forms Compare with the expected regression curve f(t), the upper envelope U(t), the lower envelope D(t) and the amplified envelope R(t), and output the comparison result; The bias strength determination module calculates and outputs the bias strength of the business; Storage module, storing relevant data generated by each module; A display module, which displays the output results of the curve image generation module, the detection and comparison module, and the bias strength determination module; The alarm module issues an alarm based on the comparison result of the detection and comparison module and the bias intensity output by the bias intensity determination module.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of a behavior anomaly detection method based on data behavior bias as described in claims 1-6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a behavior anomaly detection method based on data behavior bias as described in claims 1-6 are implemented.

Images