Equipment anomaly detection method and system based on anomaly index and electronic equipment

Abstract

The invention provides an equipment anomaly detection method and system based on an anomaly index and electronic equipment. The method comprises the following steps: collecting and analyzing traffic data of the equipment; counting characteristic values of more than one dimension; calculating to obtain an abnormal index baseline of more than one dimension; calculating a corresponding deviation value according to the anomaly index base line of more than one dimension and the real-time anomaly index of more than one dimension; and judging whether the equipment works normally according to the deviation value. The invention further provides a system which uses any one of the equipment anomaly detection methods based on the anomaly indexes. The invention further provides the electronic equipment which comprises the system. According to the method, the index change algorithm caused by the flow change is simplified, so that the abnormal index fluctuation can be quickly calculated, the stability of the network flow situation of the equipment can be quantitatively evaluated macroscopically, the flow abnormity can be found in time, the calculation mode is simple, the CPU consumption is extremely low, and engineering implementation is easy.

Description

Technical Field

[0001] The present invention relates to the field of device anomaly detection, and in particular to a device anomaly detection method, system and electronic equipment based on an anomaly index. Background Art

[0002] There are many research results on anomaly detection based on traffic baselines. They mainly use certain characteristics of network traffic, such as bandwidth bps, packet rate pps, message length, or the value of some other characteristic field, to form a baseline by counting characteristic vectors, set a tolerance interval, and then compare the current actual traffic characteristics with the baseline value to calculate the difference between the actual value and the baseline value. If it falls within the tolerance interval, it is considered a normal error, otherwise it is considered an abnormal traffic. Baseline threshold-based methods usually set the threshold range in percentage or absolute value.

[0003] Baselines established based on data such as bandwidth, packet rate, and message length are all data baselines for raw traffic statistics. The advantage is that the calculation method is simple, but the disadvantage is that the dimensions of raw data expression are relatively limited and monotonous, which can easily lead to false alarms. Summary of the invention

[0004] In view of the shortcomings of the prior art described above, the purpose of the present invention is to provide a device anomaly detection method, system and electronic device based on anomaly index, which is used to solve the problem that the dimensions of the original data expression in the prior art are relatively limited and monotonous, and are prone to false alarms.

[0005] To achieve the above objectives and other related objectives, the present invention provides a device anomaly detection method based on anomaly index, comprising:

[0006] Collecting and analyzing flow data of the device;

[0007] Count the eigenvalues ​​of more than one dimension;

[0008] Calculating the abnormal index baseline of the more than one dimension;

[0009] Calculating corresponding deviation values ​​according to the abnormality index baselines of the more than one dimension and the real-time abnormality indexes of the more than one dimension;

[0010] Whether the device is operating normally is determined according to the deviation value.

[0011] In one embodiment of the present invention, the anomaly index is calculated by the baseline probability and expected proportion of features of more than one dimension of the device traffic data.

[0012] In one embodiment of the present invention, in the step of counting feature values ​​of more than one dimension, the features of more than one dimension include: the destination IP address and destination port of the device for external communication, the port and source IP address monitored by itself, and the message data information sent and received by the device.

[0013] In one embodiment of the present invention, in the step of counting feature values ​​of more than one dimension, the features of more than one dimension include: the destination IP address and destination port of the device for external communication, the port and source IP address monitored by itself, and the message data information sent and received by the device.

[0014] In one embodiment of the present invention, in the step of calculating the abnormality index baseline of more than one dimension, the formula of the abnormality index is: Where P(X i ) refers to X i The probability that the class message data meets the baseline, Q(X i ) refers to X i The proportion of such messages to the total messages of the device during the baseline data collection phase.

[0015] In one embodiment of the present invention, in the step of calculating the anomaly index baseline of more than one dimension, the message includes the following dimensions: dimension X, probability statistics of the number of messages for IP; dimension Y, probability statistics of message size; dimension Z, probability statistics of message rate.

[0016] In one embodiment of the present invention, in the step of collecting and analyzing the traffic data of the device, the dimension X data is collected to obtain all external communication conditions of the device, and the number of messages sent or received by the device for each other IP is obtained by counting. The number of messages sent or received by each IP is divided by all messages of the local machine, which is the probability of the number of messages for each IP.

[0017] In one embodiment of the present invention, in the step of collecting and analyzing the traffic data of the device, the dimension Y divides the message size into several size intervals according to the actual business situation; the number of messages that meet the definition of the size interval divided by the total number of messages sent is the message size probability.

[0018] In one embodiment of the present invention, in the step of collecting and analyzing the traffic data of the device, the dimension Z divides the message rate into several rate intervals according to the actual business situation; the number of time periods that meet the definition of the rate interval divided by the total number of time periods is the message rate probability.

[0019] In one embodiment of the present invention, in the step of calculating the anomaly index baselines of the more than one dimension, corresponding to the dimension X, the dimension Y and the dimension Z, the anomaly index baselines are I(X)_Base, I(Y)_Base and I(Z)_Base respectively;

[0020] The characteristic value of the dimension X: for the probability statistics of the number of packets of the IP, the device calculates the distribution after summarizing the number of packets sent and received by each other IP;

[0021] The characteristic value of the dimension Y: probability statistics of message size, and the proportion of message size of device communication messages distributed by direction;

[0022] The characteristic value of the dimension Z: message rate probability statistics.

[0023] In one embodiment of the present invention, in the step of calculating the deviation according to the abnormal index baseline of more than one dimension and the real-time abnormal index of more than one dimension, the real-time abnormal index I(X), I(Y) and I(Z) are calculated using real-time data respectively; the deviations of the real-time abnormal index from the abnormal index baseline are D(X), D(Y) and D(Z) respectively, and the total deviation is recorded as D(T);

[0024] Among them, D(X)=|I(X)-I(X)_base|, D(Y)=|I(Y)-I(Y)_base|, D(Z)=|I(Z)-I(Z)_base|, D(T)=|I(T)-I(T)_base|.

[0025] In one embodiment of the present invention, in the step of determining whether the device is working normally according to the deviation value, when the D(X) exceeds the threshold value ThX, or the D(Y) exceeds the threshold value ThY, or the D(Z) exceeds the threshold value ThZ, or the D(T) exceeds the threshold value ThT, the device is determined to be abnormal and an alarm message is issued.

[0026] The present invention also provides a system using any of the above-mentioned device anomaly detection methods based on anomaly index.

[0027] The present invention also provides an electronic device, comprising the system as described above.

[0028] As described above, the device anomaly detection method based on anomaly index of the present invention has the following beneficial effects: by using the anomaly index algorithm proposed by the present invention, an anomaly index baseline is established from multiple (for example, 3) dimensions of the network traffic data of a certain device, and a quantitative index for measuring the network traffic of the device is calculated to form an anomaly index baseline for the entire device, and the index change algorithm caused by traffic changes is simplified, so that the fluctuation of the anomaly index can be quickly calculated, and the stability of the network traffic situation of the device can be quantitatively evaluated from a macro perspective, and traffic anomalies can be discovered in time. The calculation method of the scheme of the present invention is simple, the CPU consumption is very small, and it is easy to implement in engineering. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Shown is a schematic diagram of the steps of a method for detecting anomaly of equipment based on anomaly index according to the present invention.

[0030] Figure 2 Shown is a schematic diagram of a device abnormality detection system according to the present invention. DETAILED DESCRIPTION

[0031] The following is an explanation of the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the features in the following embodiments and the embodiments can be combined with each other without conflict. It should also be understood that the terms used in the embodiments of the present invention are intended to describe specific embodiments, rather than to limit the scope of protection of the present invention. The test methods for which specific conditions are not specified in the following examples are usually carried out under conventional conditions or according to the conditions recommended by the manufacturers.

[0032] See also Figure 1 and Figure 2 . It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings in this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the limiting conditions for the implementation of the present invention, so they have no substantial technical significance. Any modification of the structure, change in the proportional relationship, or adjustment of the size should still fall within the scope of the technical content disclosed by the present invention without affecting the effects and purposes that can be achieved by the present invention. At the same time, the terms such as "upper", "lower", "left", "right", "middle" and "one" quoted in this specification are only for the convenience of description, and are not used to limit the scope of the implementation of the present invention. Changes or adjustments in their relative relationships should also be regarded as the scope of the implementation of the present invention without substantially changing the technical content.

[0033] Information entropy is an indicator used to measure uncertainty, that is, the probability of occurrence of discrete random events. Simply put, the more chaotic the situation, the greater the information entropy, and vice versa.

[0034] The present invention makes practical optimization on the concept of information entropy, and proposes and applies the concept of abnormal index.

[0035] See also Figure 1 The present invention provides a device anomaly detection method based on anomaly index, comprising:

[0036] Collect and analyze traffic data of equipment;

[0037] Count the eigenvalues ​​of more than one dimension;

[0038] Calculate anomaly index baselines for more than one dimension;

[0039] Calculating corresponding deviation values ​​according to the abnormality index baseline of more than one dimension and the real-time abnormality index of more than one dimension;

[0040] Determine whether the device is working properly based on the deviation value.

[0041] The present invention infers the status of a device by detecting the network traffic of the device. First, the network traffic of key devices in the system is collected, and the characteristic data of each dimension are counted. The abnormality index is calculated based on these characteristics to form the abnormality index baseline of a single device. Then, the tolerance judgment method is used to detect whether the network traffic of the device is abnormal, and then determine whether the device is abnormal.

[0042] A preferred embodiment of the present invention is specifically described as follows:

[0043] First, use methods such as switch traffic mirroring to obtain the network traffic of the device.

[0044] Use network traffic monitoring and auditing equipment to analyze network traffic. For each device, periodically (1 minute, 10 minutes, 30 minutes, etc.) count and retain multi-dimensional features. The multi-dimensional features mainly include:

[0045] The device's destination IP address and destination port for external communications, its own listening port, and source IP address;

[0046] The size and number of messages sent by the device.

[0047] The size and data of the messages received by the device.

[0048] Then, the network traffic information of the device over a period of time (period) is counted to calculate the network traffic information entropy (abnormal index) baseline of the device.

[0049] For a certain event, the smaller the probability of its occurrence, the greater the amount of information; the greater the probability of its occurrence, the smaller the amount of information (the minimum is not less than 0). In the present invention, 2 is uniformly taken as the base (10 or other numbers can also be taken as the base), and the information formula is expressed as follows:

[0050] h(x)=-log 2 P(X)

[0051] The amount of information is very suitable for measuring abnormal situations because the probability of abnormal situations is relatively small. When an abnormal situation occurs, the amount of information carried by the data will increase suddenly. When everything is running normally, the amount of information is minimal.

[0052] The essence of information entropy is the mathematical expectation of the amount of information, that is, the expectation of the amount of information brought by all possible events.

[0053] The standard calculation formula for information entropy is:

[0054]

[0055] Where p(x i ) indicates that the random event x is x i probability.

[0056] In the calculation formulas for information entropy and information quantity, P(X)>0 is required, otherwise it cannot be calculated.

[0057] When using the information entropy formula to calculate the abnormal state of network traffic, there are still some problems:

[0058] 1) How to calculate the probability of sudden network traffic, such as sudden network connection.

[0059] 2) How to calculate the probability of sudden disappearance of network traffic, such as sudden disconnection of network connection.

[0060] 3) How to calculate the probability of slowly decreasing or increasing network traffic.

[0061] Based on these problems, the present invention proposes the concept of anomaly index and provides a complete solution that can be used to calculate and measure the network traffic anomaly of a device.

[0062] The definition of anomaly index is the mathematical expectation of the amount of information brought by all possible events.

[0063] In the present invention, referring to the standard calculation formula of information entropy, the calculation formula of the anomaly index is changed to:

[0064]

[0065] P(X i ) refers to Xi The probability that the data of a class of packets conforms to the baseline. The logarithmic value represents the amount of information. If it completely conforms to the baseline, then P(X i )=100%, and the amount of information after taking the logarithm is 0, indicating that there is no abnormality.

[0066] Q(X i ) refers to X i The proportion of such messages in the total messages of the device during the baseline data collection phase, that is, the probability of the message appearing in the baseline.

[0067] The calculated anomaly index I(X) represents the mathematical expectation of the amount of information that all X events meet the baseline.

[0068] Based on the mathematical definitions of anomaly index and information volume, in order to effectively represent the anomaly index of a device's network traffic, we must first define the network events that need to be monitored in the network traffic, and then statistically calculate the probabilities of these events to calculate the anomaly index corresponding to the device.

[0069] The present invention can detect anomalies of several types of statistical indicators / dimensions (for example, three types of statistical indicators, that is, three dimensions). As an embodiment, the specific description is as follows.

[0070] The statistics of network packets are divided into three dimensions, namely X, Y, and Z:

[0071] 1) Dimension X: For the probability statistics of the number of packets of an IP, the device calculates the distribution after summarizing the number of packets sent and received by each other IP, which is the concept of corresponding probability. In a specific network, the communication relationship between devices is relatively fixed. After collecting and analyzing relevant traffic data for a period of time, all external communication conditions of the device can be obtained, and the number of packets sent or received by each IP of the device can be obtained. The calculation method is: the number of packets sent or received by each IP, divided by all packets of the device.

[0072] Table 1 Probability statistics of IP packets

[0073] IP address direction Message ratio Probability P( Probability Q 192.168.1.100 send 15％ 100％ 15％ 192.168.1.100 take over 5％ 100％ 5％ 192.168.1.101 send 10％ 100％ 10％ 192.168.1.101 take over 10％ 100％ 10％ 192.168.1.126 send 20％ 100％ 20％ 192.168.1.126 take over 15％ 100％ 15％ 192.168.1.200 send 5％ 100％ 5％ 192.168.1.200 take over 5％ 100％ 5％ 192.168.1.222 send 5％ 100％ 5％ 192.168.1.222 take over 10％ 100％ 10％ other Send / Receive 0％ -- --

[0074] Table 1

[0075] Table 1 shows an example of baseline data. For dimension X, according to the above abnormality index calculation formula, the abnormality index baseline of X can be calculated as I(X)_Base=0.

[0076] When calculating the value of the abnormal index baseline, parameters P and Q are based on the period statistical proportion data.

[0077] Among them, the abnormal index baseline is not calculated for the probability of 0.

[0078] 2) Dimension Y: probability statistics of message size. The proportion of message size of device communication messages distributed by direction is statistically analyzed, which corresponds to the concept of probability. The message size is divided into 4 intervals according to the actual business situation (different devices have different businesses and can be divided into different intervals. The 4 intervals are only examples): Size<200Byte; 200Byte<=Size<500Byte; 500Byte<=Size<1000Byte; 1000Byte<=Size. The probability of sending messages in each of the 4 intervals is calculated. The statistical algorithm is: the number of messages that meet the interval definition divided by the total number of messages.

[0079] The statistical results are shown in Table 2, which are probability statistics of message size.

[0080] Packet size direction Message ratio Probability P Probability Q Size<200Byte send 25％ 100％ 25％ Size<200Byte take over 15％ 100％ 15％ 200Byte<=Size<500Byte send 0％ -- -- 200Byte<=Size<500Byte take over 0％ -- -- 500Byte<=Size<1000Byte send 10％ 100％ 10％ 500Byte<=Size<1000Byte take over 10％ 100％ 10％ 1000Byte<=Size send 15％ 100％ 15％ 1000Byte<=Size take over 25％ 100％ 25％

[0081] Table 2

[0082] For dimension Y, according to the above anomaly index calculation formula, the anomaly index of Y can be calculated to be I(Y)_Base=0.

[0083] When calculating the abnormal index baseline, parameters P and Q are based on period statistical proportion data.

[0084] Among them, the abnormal index baseline is not calculated for the probability of 0.

[0085] 3) Dimension Z: probability statistics of message rate. The message rate is generally expressed as the number of messages per second, referred to as PPS (Packet Per Second). The message rate PPS is divided into three intervals according to the actual data collection situation (different intervals are divided according to different services and networks, that is, the intervals are divided according to the fluctuation range of the actual business and network. This is only an embodiment, and it can also be divided according to other methods): PPS<10; 10<=PPS<100; 100<=PPS. The probability of occurrence of message rates is counted for each of the three intervals. The rate involves a time period and needs to be counted periodically. If counted by seconds, the number of messages per second is PPS; if counted by minutes, the number of messages per minute divided by 60 is PPS. The statistical algorithm is: the number of time periods in which the message rate PPS meets the interval definition is divided by the total number of time periods for data collection and analysis.

[0086] For example, the traffic of 1 hour, i.e. 60 minutes, is counted with a period of 1 minute. In 24 minutes, the packet rates of both sending and receiving are less than 10 PPS, and in the remaining 32 minutes, the packet rates of both sending and receiving are greater than 10 PPS but less than 100 PPS. The statistical results are shown in Table 3.

[0087] Message rate direction Occurrence ratio Probability P Probability Q PPS<10 send 20％ 100％ 20％ PPS<10 take over 20％ 100％ 20％ 10<=PPS<100 send 30％ 100％ 30％ 10<=PPS<100 take over 30％ 100％ 30％ 100<=PPS send 0％ -- -- 100<=PPS take over 0％ -- --

[0088] Table 3

[0089] Table 3 is the probability statistics of the message rate. For dimension Z, according to the above-mentioned anomaly index calculation formula, the anomaly index of Z can be calculated to be I(Z)_Base=0.

[0090] When calculating the anomaly index baseline, parameters P and Q are based on period statistical proportion data (i.e., the number of time periods in which the message rate PPS meets the interval definition divided by the total number of time periods for learning and analysis).

[0091] Among them, the abnormal index baseline is not calculated for the probability of 0.

[0092] 4) According to the time period of the data collection (i.e. learning) baseline, the same period sampling data is used to calculate the anomaly index of the three dimensions of each period, which are I(X), I(Y), and I(Z). According to the algorithm definition of the anomaly index, the smaller the probability of the data, the greater the amount of information generated, and the higher the anomaly index. Therefore, once a new low-probability event appears in the system (such as adding a communication with an unknown IP address, or an unseen message size), the anomaly index will increase significantly. However, considering that some scenarios in the system have a probability of 0 and are not involved in the calculation of the anomaly index, if in extreme cases, these scenarios appear, and the corresponding other existing scenario disappears, and the probabilities of the two are the same, the calculated anomaly index will remain unchanged, but the network traffic information has changed significantly, that is, the anomaly index cannot accurately represent the amount of information.

[0093] The abnormality index of the equipment is defined as I(T), I(T)=I(X)+I(Y)+I(Z).

[0094] Correspondingly, I(T)_Base=I(X)_Base+I(Y)_Base+I(Z)_Base.

[0095] The deviations of the abnormal index from the abnormal index baseline are D(X), D(Y) and D(Z) respectively, and the total deviation is recorded as D(T).

[0096] D(X)=|I(X)-I(X)_base|, D(Y)=|I(Y)-I(Y)_base|, D(Z)=|I(Z)-I(Z)_base|, D(T)=|I(T)-I(T)_base|.

[0097] When D(X) exceeds the threshold ThX, or D(Y) exceeds the threshold ThY, or D(Z) exceeds the threshold ThZ, or D(T) exceeds the threshold ThT, the device is judged to be abnormal and an alarm message is issued.

[0098] The above thresholds can be adjusted according to the actual situation. After running for a period of time, the alarms generated by the system are manually confirmed. If there are many false alarms, it means that the parameter needs to be adjusted larger. If there are missed alarms, it means that the parameter needs to be adjusted smaller.

[0099] The following uses I(X) as an example to illustrate the calculation methods for these complex scenarios.

[0100] Assume that the sampling results of a certain time period are as shown in Table 4. For known events Xi, the probability of using the mathematical expectation is calculated, which is the probability learned by the baseline, that is, the proportion of messages. For new events Xi, the probability of using the mathematical expectation is calculated, which is the actual proportion of messages in this period, because there is no record of this event in the baseline.

[0101]

[0102] Table 4

[0103] Table 4 shows complex scenario 1. By comparing Table 4 with the baseline sample in Table 1, it can be seen that the messages from 192.168.1.1 occupy a proportion of the message from 192.168.1.222, while the messages from 192.168.1.222 are much reduced.

[0104] First, calculate the parameter probability P:

[0105] Assume B = baseline message ratio, A = current cycle message ratio, then

[0106] P=1-|AB| / B (if B=0 or P<=0, then P=P min )

[0107] Among them, P represents the probability of meeting the baseline. B is the baseline, so |AB| / B represents the deviation ratio of the message ratio in this period, and P = 1-deviation ratio, which is the probability that the message ratio in this period meets the baseline.

[0108] P min Represents the extremely small probability in this system. The specific value of this extremely small probability can be determined based on the minimum probability in the collected data baseline. It should be 2 orders of magnitude smaller than the actual minimum probability. For example, the minimum probability in this example is 5%. The extremely small probability benchmark P min Take 0.01%.

[0109] For the traffic sent by 192.168.1.222, the calculation parameter probability P of its information volume is:

[0110] P=1-|1%-5%| / 5%=20%

[0111] For 192.168.1.1, whether sending or receiving, the calculation parameter probability of the amount of information is P = P min =0.01%.

[0112] Then, the calculated abnormal index of X in this period is

[0113] I(X)=5%*log 2 (0.2)+10%*log 2 (0.1)+4%*log 2 (0.0001)+9%*log 2 (0.0001)

[0114] =0.05*2.3+0.1*3.3+0.04*13+0.09*13

[0115] =0.115+0.33+0.52+1.17

[0116] =2.135

[0117] Since I(X)_base=0, the deviation D(X) is I(X) at this time, and D(X)=2.135.

[0118] Assume that the sampling results of another time period are as shown in Table 5:

[0119]

[0120] Table 5

[0121] Table 5 shows complex scenario 2. During this period, no new IPs are added, but the proportion of messages changes slightly.

[0122] Then, the calculated abnormal index of X in this period is:

[0123] I(X)=20%*log 2 (0.95)+15%*log 2 (0.94)+5%*log 2 (0.8)+10%*log 2 (0.9)

[0124] =0.2*0.07+0.15*0.09+0.05*0.3+0.1*0.16

[0125] =0.014+0.0135+0.015+0.016

[0126] =0.0585

[0127] Since I(X)_base=0, the deviation D(X) is I(X) at this time, D(X)=0.0585.

[0128] 5) Summarize the abnormal indexes of the three dimensions, I = I(X) + I(Y) + I(Z). If any abnormal index of X, Y, or Z exceeds the threshold, or the overall sum exceeds the threshold, an alarm message should be generated.

[0129] The abnormality index baseline is used to determine whether the device network traffic is abnormal. As an embodiment, the threshold benchmark is set to 0.5 (the benchmark value can be adjusted according to the actual situation. After running for a period of time, the alarms generated by the system are manually confirmed. If there are many false alarms, it means that the parameter needs to be adjusted larger. If there are missed alarms, it means that the parameter needs to be adjusted smaller). It means that the error between the actual abnormality index and the abnormality index baseline cannot exceed 0.5, otherwise it means that the network traffic is abnormal. In one embodiment, assuming that ThX = 0.5, when D(X) = 2.135, it obviously exceeds the threshold ThX, and an alarm message should be generated.

[0130] From the above, it can be seen that the anomaly index based on the device anomaly detection method of the present invention is calculated by the probability of deviation from the baseline and the expected proportion of the characteristics of more than one dimension of the device flow data. The steps of the anomaly detection method include: collecting and analyzing the flow data of the device; counting the characteristic values ​​of each dimension; calculating the anomaly index baseline of each dimension; calculating the anomaly index of real-time data and calculating the deviation; judging whether the device flow is abnormal, and then inferring whether the device is abnormal.

[0131] As an embodiment, the present invention can be applied to equipment anomaly detection in a nuclear power network. By performing network traffic analysis on a host or control device in the nuclear power network, an entropy baseline of the network traffic of the host or control device is collected and calculated, and then the host or control device is detected to see if it is abnormal based on the baseline tolerance.

[0132] The present invention also provides a device abnormality detection system. Figure 2, the system uses the above-mentioned device anomaly detection method based on anomaly index, including a historical data collection module, an anomaly index baseline calculation module, a real-time data collection module, a real-time anomaly index calculation module, a comparison module and a result output module. The historical data collection module is responsible for collecting and analyzing the flow data of the device, and counting the characteristic values ​​of more than one dimension. The anomaly index baseline calculation module is responsible for calculating the anomaly index baseline from the characteristic values ​​of the historical flow data. The real-time data collection module is responsible for collecting the characteristic values ​​of the flow data of a certain time period in real time. The real-time anomaly index calculation module is responsible for calculating the real-time anomaly index from the characteristic values ​​of the real-time flow data. The comparison module is responsible for calculating the corresponding deviation value based on the anomaly index baseline and the real-time anomaly index, and judging whether the device is working normally based on the deviation value. The result output module is responsible for outputting the working status of the device, especially issuing an alarm message when an anomaly is encountered.

[0133] The present invention also provides an electronic device, comprising the above-mentioned device abnormality detection system. The electronic device can be used to detect abnormalities of specific system equipment, such as abnormalities of equipment in a nuclear power system.

[0134] In summary, the present invention uses an abnormal index algorithm to establish an abnormal index baseline from three dimensions for the network traffic data of a certain device, calculates a quantitative index to measure the network traffic of the device, forms an abnormal index baseline, and simplifies the entropy change algorithm caused by traffic changes, so that the abnormal index fluctuation can be quickly calculated, and the stability of the network traffic situation of the device can be quantitatively evaluated from a macro perspective, and traffic anomalies can be discovered in time. The detection method of the present invention has a simple calculation method, very little CPU consumption, and is easy to implement in engineering. Therefore, the present invention effectively overcomes the various shortcomings of the prior art and has a high industrial utilization value.

[0135] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A device anomaly detection method based on anomaly index, characterized in that: include: Collecting and analyzing flow data of the device; Count the eigenvalues ​​of more than one dimension; Calculating the abnormal index baseline of the more than one dimension; Calculating corresponding deviation values ​​according to the abnormality index baselines of the more than one dimension and the real-time abnormality indexes of the more than one dimension; Whether the device is operating normally is determined according to the deviation value.

2. The device anomaly detection method based on anomaly index according to claim 1, characterized in that: The anomaly index is calculated by the probability of compliance with a baseline and the expected proportion of features of more than one dimension of the device traffic data.

3. The device anomaly detection method based on anomaly index according to claim 1, characterized in that: In the step of counting feature values ​​of more than one dimension, the features of more than one dimension include: the destination IP address and destination port of the device for external communication, the port and source IP address monitored by itself, and the message data information sent and received by the device.

4. The device anomaly detection method based on anomaly index according to claim 1, characterized in that: In the step of calculating the abnormal index baseline of more than one dimension, the formula of the abnormal index is: Where P(X i ) refers to X i The probability that the class message data meets the baseline, Q(X i ) refers to X i The proportion of such messages to the total messages of the device during the baseline data collection phase.

5. The device anomaly detection method based on anomaly index according to claim 4 is characterized in that: In the step of calculating the abnormal index baseline of more than one dimension, the message includes the following dimensions: dimension X, probability statistics of the number of messages for IP; dimension Y, probability statistics of message size; dimension Z, probability statistics of message rate.

6. The device anomaly detection method based on anomaly index according to claim 5, characterized in that: In the step of collecting and analyzing the traffic data of the device, the dimension X data is collected to obtain all external communication conditions of the device, and the number of messages sent or received by the device for each other IP is obtained by counting. The number of messages sent or received by each IP is divided by all messages of the local machine, which is the probability of the number of messages for each IP.

7. The device anomaly detection method based on anomaly index according to claim 5, characterized in that: In the step of collecting and analyzing the traffic data of the device, the dimension Y divides the message size into several size intervals according to the actual business situation; the number of messages that meet the definition of the size interval divided by the total number of messages sent is the message size probability.

8. The device anomaly detection method based on anomaly index according to claim 5, characterized in that: In the step of collecting and analyzing the traffic data of the device, the dimension Z divides the message rate into several rate intervals according to the actual business situation; the number of time periods that meet the definition of the rate interval divided by the total number of time periods is the message rate probability.

9. The device anomaly detection method based on anomaly index according to claim 5, characterized in that: In the step of calculating the anomaly index baselines of the more than one dimension, corresponding to the dimension X, the dimension Y and the dimension Z, the anomaly index baselines are I(X)_Base, I(Y)_Base and I(Z)_Base respectively.

10. The device anomaly detection method based on anomaly index according to claim 9, characterized in that: In the step of calculating the deviation based on the anomaly index baseline of more than one dimension and the real-time anomaly index of more than one dimension, the real-time anomaly index I(X), I(Y) and I(Z) are calculated respectively using real-time data; the deviations of the real-time anomaly index from the anomaly index baseline are D(X), D(Y) and D(Z), respectively, and the total deviation is recorded as D(T), wherein D(X) = |I(X)-I(X)_base|, D(Y) = |I(Y)-I(Y)_base|, D(Z) = |I(Z)-I(Z)_base|, and D(T) = |I(T)-I(T)_base|.

11. The device anomaly detection method based on anomaly index according to claim 10, characterized in that: In the step of judging whether the device is working normally according to the deviation value, when the D(X) exceeds the threshold value ThX, or the D(Y) exceeds the threshold value ThY, or the D(Z) exceeds the threshold value ThZ, or the D(T) exceeds the threshold value ThT, the device is judged to be abnormal and an alarm message is issued.

12. A device anomaly detection system, characterized in that: The device anomaly detection method based on anomaly index as described in any one of claims 1 to 11 comprises a historical data collection module, an anomaly index baseline calculation module, a real-time data acquisition module, a real-time anomaly index calculation module, a comparison module and a result output module.

13. An electronic device, characterized in that: Includes the equipment anomaly detection system as described in claim 12.

Images