Abnormal behavior detection method and device, equipment and storage medium

By preprocessing and clustering analysis of historical operation data, a normal behavior baseline model is established, and the abnormal behavior recognition model is trained using support vector machine algorithm, the recognition of traditional security systems in the face of advanced persistent threats and zero-day attacks is solved. The problem has achieved rapid detection and response to potential threats and improved security.

CN119203127APending Publication Date: 2024-12-27SHANGHAI DONGPU INFORMATION TECH CO LTD
View PDF 0 Cites 5 Cited by

Patent Information

Application Number
CN202411363024.3
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-09-27
Publication Date
2024-12-27

AI Technical Summary

Technical Problem

Traditional security monitoring systems are difficult to quickly detect and respond when facing advanced persistent threats and zero-day attacks, and relying on static rules and signature libraries seems unscrupulous.

Method used

By obtaining historical operation data for preprocessing and clustering analysis, a baseline model of normal behavior is established, and an abnormal behavior recognition model is trained using support vector machine algorithm, and operation data is monitored and analyzed in real time to identify abnormal behavior, and automated response measures are triggered based on the recognition results. .

Benefits of technology

It realizes rapid detection and response to potential threats, improves the monitoring and response capabilities of the security system, can quickly identify abnormal behaviors and implement corresponding measures, and enhances the security of terminal equipment and user operations.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN119203127A_ABST
    Figure CN119203127A_ABST
Patent Text Reader

Abstract

The invention relates to the technical field of data processing, in particular to an abnormal behavior detection method and device, equipment and a storage medium, and the method comprises the steps: obtaining historical operation data, and carrying out the preprocessing and division processing, and obtaining first and second preprocessed historical data; performing clustering analysis on the first preprocessed historical data by adopting a clustering algorithm, training based on a clustering analysis result to obtain a normal behavior baseline model, and inputting the second preprocessed historical data into the normal behavior baseline model to obtain normal behavior baseline information; training by adopting the normal behavior baseline information to obtain an abnormal behavior recognition model; real-time operation data is acquired and preprocessed, the preprocessed real-time operation data is input into the abnormal behavior recognition model to obtain an abnormal recognition result, and whether a response mechanism is triggered or not is judged according to the abnormal recognition result; according to the method disclosed by the invention, the abnormal behavior can be quickly identified, and the corresponding automatic response measure can be executed, so that the potential threats can be quickly detected and coped with.
Need to check novelty before this filing date? Find Prior Art

Citation Information

Cited By

  • Equipment fault early warning method and system based on AI algorithm, and storage medium

    CN119885046A

  • Computer information security monitoring system

    CN119961990A

  • Process interruption method, device and equipment based on central processing unit and readable medium

    CN121501465A

  • Central processor-based process interruption method, apparatus, device and readable medium

    CN121501465B

  • Security system and security method

    TWI934559B