Abnormal traffic detection method for closed network in resource limited scene

Abstract

The invention discloses an abnormal traffic detection method for a closed network in a resource-limited scene, and belongs to the technical field of network space security. The method comprises the following steps: preprocessing network traffic to obtain a traffic sample; calculating locality sensitive hash values of the samples in sequence to obtain a sample abstract; setting and maintaining a sliding window with a fixed size, wherein the sliding window is used for storing K sample abstracts of the latest benign network traffic; preprocessing network traffic to be tested to obtain a sample to be tested, calculating an abstract of the sample to be tested, calculating similarity between the abstract of the sample to be tested and K sample abstracts in the sliding window, calculating an abnormal score of the sample to be tested by using a k-nearest neighbor strategy, and judging whether the traffic is abnormal traffic or not. The method does not depend on an artificial intelligence model, data marking and feature extraction are not needed, a good detection effect can be achieved with low computing resource overhead, and compared with an existing detection technology based on a locality sensitive hash function, the false alarm rate and the missing report rate are remarkably reduced.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and specifically relates to an abnormal traffic detection method for a closed network in a resource-constrained scenario. Background Art

[0002] In the era of rapid development of information technology, the network has been deeply integrated into all aspects of social production. The development of technology represented by the Internet of Things has made special information-physical systems, such as networked medical equipment and intelligent electricity metering terminals, closely related to cyberspace. The network security issues of special systems are particularly prominent. Abnormal traffic such as network attacks may have a serious impact on the stability of network systems and the integrity of data. Researchers have proposed a variety of methods for detecting abnormal traffic, including: rule-based matching methods, supervised learning model-based methods, and unsupervised learning model-based methods. Among them, rule matching and supervised learning models lack the ability to detect unknown types of anomalies. Considering that the characteristics of benign traffic are relatively stable and not as variable as abnormal traffic, unsupervised methods based only on benign traffic have attracted much attention from researchers. Unsupervised anomaly detection technology detects anomalies based on the degree of deviation of the sample to be tested from the benign traffic baseline. Its training process does not rely on labeled malicious samples and has strong generalization ability.

[0003] Existing typical unsupervised anomaly detection technologies include: reconstruction-based method Autoencoder (Reference 1: J.Zhai, S.Zhang, J.Chen and Q.He, "Autoencoder and Its Various Variants," 2018IEEE International Conference on Systems, Man, and Cybernetics (SMC), Miyazaki, Japan, 2018, pp.415-419, doi: 10.1109 / SMC.2018.00080.), distance metric-based method KNN (Reference 2: Song S M. Research on Computer Software Security Detection Technology Based on KNN Algorithm [J]. Journal of Engineering and Technology Management (JETM), 2024, 1 (1).), and empirical cumulative distribution-based method ECOD (Reference 3: Z.Li, Y.Zhao, X.Hu, N.Botta, C.Ionescu and GHChen, "ECOD: Unsupervised Outlier Detection Using Empirical Cumulative Distribution Functions," in IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 12, pp. 12181-12193, 1Dec. 2023, doi: 10.1109 / TKDE.2022.3159580.); the partition-based method IForest (reference 4: FT Liu, KMTing and Z.-H. Zhou, "Isolation Forest," 2008 Eighth IEEE International Conference on Data Mining, Pisa, Italy, 2008, pp. 413-422, doi: 10.1109 / ICDM.2008.17.), the single-classification hyperplane-based method OCSVM (reference 5: A. Bounsiar and M. G.Madden,"One-Class Support Vector Machines Revisited,"2014InternationalConference on Information Science&Applications(ICISA),Seoul,Korea(South),2014,pp.1-4,doi:10.1109 / ICISA.2014.6847442.); clustering-based method CBLOF (reference 6: HeZ,Xu X,Deng S.Discovering cluster-based local outliers[J].Pattern recognitionletters,2003,24(9-10):1641-1650.). However, these existing unsupervised detection techniques all have some limitations. The reconstruction-based method is based on deep neural network implementation, which has high computational overhead. In addition, when the training data is insufficient or the data quality is not high, it is easy to overfit, which affects the detection performance. The distance metric-based method needs to calculate the distance between a large amount of data, which takes up a lot of computing resources and is not suitable for high-dimensional data. The "dimensionality disaster" problem may occur. The method based on empirical cumulative distribution makes a priori assumptions about the distribution of benign samples. The noise in the data may lead to unstable results and affect the detection accuracy. The methods based on partitioning, single classification hyperplane and clustering have large computational complexity and are not effective in high-dimensional space due to factors such as data sparsity.

[0004] However, the greater limitation lies in the dependence on hardware resources. Most of the existing unsupervised technologies are based on machine learning or deep learning models, which have certain requirements for computing resources such as processors and memory. However, in dedicated IoT environments, such as industrial IoT and telemedicine, limited hardware resources need to be used to ensure the stable operation of business functions. Their business activities are subject to limited hardware resources, and they are even forced to use simple communication protocols and shorten the message load as much as possible. In this case, the processing, memory and other resources available for the abnormal traffic detection model are very limited, which limits the deployment and operation of the detection model. At present, some researchers have proposed that methods based on local sensitive hash functions can be used to detect anomalies in scenarios with limited resources. However, the performance of the proposed method in real IoT traffic has not met its claims, and there is still considerable room for improvement.

[0005] In general, the shortcomings of existing unsupervised anomaly detection methods and existing abnormal traffic detection technologies based on locality-sensitive hash functions in resource-constrained scenarios are mainly reflected in the following aspects:

[0006] (1) The deployment overhead is high. Some typical unsupervised learning abnormal traffic detection methods rely on artificial intelligence models and require special software and hardware support, such as graphics computing cards, CUDA parallel computing libraries, etc. In resource-constrained scenarios, there may be a lack of conditions for deploying these software and hardware. At the same time, the introduction of these software and hardware is not conducive to the security management and control of closed networks.

[0007] (2) Limited scalability. After training, many anomaly detection algorithms have fixed model parameters and structures, making it difficult to adapt to new abnormal patterns or attack methods in a timely manner, which is the "concept drift" problem. Existing methods often require major adjustments to the model structure when introducing new data features, improving algorithms, or integrating other technologies, which increases the complexity of implementation and maintenance. The particularity of closed networks also increases the cost of updating models.

[0008] (3) The false alarm rate and missed alarm rate remain high. Some researchers have noticed the effectiveness of local sensitive hash functions in detecting abnormal traffic in resource-constrained scenarios. However, the false alarm rate and missed alarm rate of abnormal samples in the proposed method remain high.

[0009] (4) Poor real-time performance. Since the models relied on by existing unsupervised detection technologies are relatively complex, the decision-making process takes a long time when hardware resources are limited, making it difficult to provide real-time detection capabilities in dedicated IoT scenarios. Summary of the invention

[0010] In view of the problems that the existing unsupervised anomaly detection models based on machine learning and deep learning are limited in deployment in resource-constrained scenarios, have high computational complexity, and cannot meet real-time detection needs, the present invention proposes a lightweight abnormal traffic detection method for closed networks in resource-constrained scenarios. A local sensitive hash function is introduced to calculate the traffic anomaly score, which does not rely on artificial intelligence models and does not require data labeling and feature extraction. It can achieve good detection effects with low computing resource overhead. Moreover, compared with the existing detection technology based on local sensitive hash functions, the false alarm rate and missed alarm rate of the method of the present invention are significantly reduced.

[0011] The present invention provides a method for detecting abnormal traffic in a closed network under resource-constrained scenarios, comprising the following steps:

[0012] Step 1: preprocessing the acquired network traffic, including: extracting valid data fields from network data packets, detecting whether the valid data fields extracted from a single data packet meet a preset length, and if the length is insufficient, sequentially splicing the valid data fields extracted from multiple data packets to form a sample; the valid data field includes a data packet ID, a flag bit, and data;

[0013] Step 2: Calculate the local sensitive hash value for each sample in sequence to obtain the summary of the sample;

[0014] Step 3: Set and maintain a sliding window W of fixed size n, in which the summaries of the latest n samples of benign network traffic are stored; n is a positive integer greater than 2;

[0015] Step 4: In the detection phase, obtain each sample to be tested according to step 1 for the network traffic to be tested, obtain the summary of the sample to be tested according to step 2, calculate the summary similarity of each sample to be tested with the n samples in the sliding window W, and use the k-nearest neighbor strategy to calculate the anomaly score g of the sample to be tested;

[0016] Step 5: Compare the anomaly score g of the sample to be tested with the preset threshold θ. If g is greater than θ, the sample to be tested is judged as benign traffic, otherwise the sample to be tested is judged as abnormal traffic; update the summary of the sample to be tested that is judged as benign traffic to the sliding window W; when it is judged as abnormal traffic, trigger the alarm mechanism.

[0017] In step 4, a heap of fixed length k is set, in which the first k maximum values ​​of summary similarity between the sample to be tested and the n samples in the sliding window W are stored, and the average value of the k similarities in the heap is calculated as the abnormality score of the sample to be tested.

[0018] Compared with the prior art, the advantages of the abnormal traffic detection method for closed networks in resource-constrained scenarios of the present invention are:

[0019] (1) The method of the present invention reduces the running overhead to a great extent. The present invention uses the local sensitive hashing method to calculate the sample summary in step 2, and the calculation only involves simple addition, array sequential search and integer variable averaging; in step 3, the sliding window method and the k nearest neighbor strategy used in step 4 are used to calculate the similarity by storing the auxiliary array and the k nearest neighbor strategy. The calculation of the similarity involves bit calculation, which is lightweight and fast. At the same time, the time complexity of the heap algorithm is O(nlog k). The present invention reduces the space complexity from O(n) to O(k), and the complexity of calculating the average value is also reduced from O(n) to O(k), usually k=√n. Compared with other methods that need to save floating point matrices and perform matrix calculations, the method of the present invention is more lightweight.

[0020] (2) The method of the present invention reduces the overhead while taking into account the detection accuracy. The similarity score calculated based on the local sensitive hash function is used as a good indicator for detecting network traffic anomalies. At the same time, the sliding window and k-nearest neighbor strategy meet the needs of real-time monitoring and detection, avoiding the interference of outdated or irrelevant data on the current detection, and improving the reliability of detection.

[0021] (3) In some resource-constrained scenarios, due to the low bandwidth, the traffic data packets sent may have a simple frame format and short data, so the difference between benign traffic and abnormal traffic may not be obvious. For such scenarios, the method of the present invention aggregates multiple messages and then calculates the local sensitive hash summary. The number of messages is dynamically adjusted based on the current network bandwidth.

[0022] (4) The method of the present invention introduces a local sensitive hash function method to detect network traffic anomalies. It does not rely on artificial intelligence models. Compared with traditional unsupervised methods, it does not require feature extraction and model training, is immune to concept drift, has low computing and storage overhead, and is more suitable for deployment in closed networks with limited resources.

[0023] (5) Compared with the traditional anomaly detection method based on local sensitive hashing, the method of the present invention introduces a sliding window method based on the dynamic characteristics of the network traffic behavior pattern changing over time, so that the network traffic to be detected is only compared with the latest benign traffic, thereby reducing the detection error; at the same time, since the network traffic contains some redundant and invalid information for error correction and truncation, this part of information may affect the difference between benign traffic and abnormal traffic. The present invention retains the data fields that are effective for detection in the preprocessing stage, thereby improving the effect of the local sensitive hash function in detecting network traffic anomalies; when performing similarity comparison, the k nearest neighbor strategy is also introduced to further reduce storage overhead and improve the detection effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of an implementation of the lightweight abnormal traffic detection method of the present invention;

[0025] Figure 2 A flowchart of performing network traffic preprocessing in step 1 of the method of the present invention;

[0026] Figure 3 A flowchart of calculating a local sensitive hash summary using the Nilsimsa algorithm as an example in step 2 of the method of the present invention;

[0027] Figure 4 A flow chart of flow detection in step 5 of the method of the present invention;

[0028] Figure 5 This is a performance comparison chart of different abnormal traffic detection methods in anomaly detection experiments;

[0029] Figure 6 Comparison of storage overhead of different abnormal traffic detection methods. DETAILED DESCRIPTION

[0030] The implementation of the technical solution of the present invention is described below with reference to the accompanying drawings and embodiments.

[0031] The present invention provides a lightweight abnormal traffic detection method for a closed network in a resource-constrained scenario. The overall implementation process is as follows: Figure 1 As shown. The method of the present invention introduces a local sensitive hash function to detect network traffic anomalies. The local sensitive hash summary of the latest set of benign traffic is stored in a sliding window. In the detection stage, the average similarity between the sample to be tested and the top k largest traffic in the sliding window is calculated as the anomaly score. Compared with other unsupervised learning anomaly detection methods, the method proposed in the present invention significantly reduces the operating overhead while ensuring a certain detection accuracy, and is more suitable for resource-constrained network scenarios. The implementation steps of the method of the present invention are described in detail below.

[0032] Step 1: Preprocess the received network traffic. The process is as follows: Figure 2 shown.

[0033] For the acquired network traffic data packets, their valid data fields should be extracted, including: retaining the packet ID, flag bit and data part, discarding unnecessary or invalid field information such as checksum. In some scenarios with small data packets, since the difference between individual data packets is not obvious, the valid parts of multiple data packets can be spliced ​​together for processing. Check whether the valid data field extracted from the current data packet meets the preset length. If the length is insufficient, continue to extract the valid field for the next data packet, and splice the valid data fields extracted from multiple data packets in sequence as a sample. The sample that meets the preset length is used as the input of the local sensitive hash.

[0034] Step 2: Calculate the local sensitive hash value based on the sample data obtained in step 1. The local sensitive hash function used by the method of the present invention by default is the Nilsimsa algorithm.

[0035] like Figure 3As shown in the figure, the calculation process of the local sensitive hash function is explained by taking the Nilsimsa algorithm as an example. It provides an output with a length of 32 bytes, which represents the distribution of triples in the data. The specific processing process of the Nilsimsa algorithm for each input sample includes: first, use a 5-character sliding window to scan the input sample data character by character. Whenever a new character enters the window, 8 different trigrams are generated, and each triple is processed using the hash function h(*). This hash function outputs an integer value i=h(trigram) in the range of [0, 256). After the analysis is completed, the result is saved in a 256-length array acc, and the number of occurrences of each hash value is counted, that is, when the hash function output value is i, acc[i] is incremented by 1, and the initial value of each element in acc is 0. The total number of processed triplets is divided by 256 to obtain the average number of triplets at each position in the value acc, and the average number is used as the threshold threshold. If the number of occurrences of the hash value of the triple exceeds the threshold threshold, the triple is considered to be significant. The digest array digest is obtained according to the frequency of the triples at each position of the acc array, that is, the element value in the acc array is compared with the threshold threshold, and the position with a value greater than the threshold is marked as 1 in the digest digest, otherwise it is marked as 0, that is, if acc[i]>threshold, mark digest[i]=1, otherwise mark digest[i]=0, and obtain an array digest with a length of 256 bits. Finally, the obtained digest array is flipped again to obtain the final digest, that is, the final digest is an array of 256 bits. Figure 3 In the example, the array digest and the final digest are expressed in hexadecimal format, with each digit corresponding to 4 bits. For example, the first digit 8 in the array digest corresponds to 1000, which is 0001 after flipping, corresponding to the last digit of the digest, that is, 1.

[0036] The method of the present invention introduces a local sensitive hash function method to detect network traffic anomalies. Traditional hash functions map different data to different hash buckets, and non-uniformly distributed data is approximately evenly distributed in the hash bucket. The local sensitive hash function retains the similarity relationship between data, and the local sensitive hash functions generated by similar data are also similar or even the same. Generally speaking, the similarity of benign traffic is higher, while the similarity of abnormal traffic and benign traffic is lower. This method does not rely on artificial intelligence models, does not require feature extraction and model training, is immune to concept drift, has low operating overhead, and is more suitable for deployment in closed networks with limited resources.

[0037] Step 3: Maintain a sliding window to save the latest local sensitive hash values. In step 1, the network traffic is preprocessed to obtain a sample stream in chronological order, and then the summary of each sample is obtained in step 2. In this step, a sliding window of a fixed size K is pre-set and maintained to store the summary of the latest K samples of benign network traffic. The data stored in the sliding window will be used to detect abnormal network traffic. In the embodiment of the present invention, K is set to a positive integer greater than 2.

[0038] The method of the present invention uses a sliding window to maintain the benign traffic characteristics of the latest network traffic. During detection, the sample summary of the traffic to be tested is calculated for similarity with the sample summary of the benign traffic in the sliding window, and the average of the first k maximum values ​​is taken as the anomaly score. The sliding window method can quickly update and process data, which helps to achieve real-time anomaly detection and respond to potential threats in a timely manner. The fixed-size sliding window limits the memory usage and is suitable for running on devices with limited storage space. In addition, the sliding window improves the adaptability of the model to dynamic changes in data and improves the effectiveness of detection.

[0039] Step 4: In the detection phase, the similarity between the summary of each traffic sample to be tested and the sample summary in the sliding window is calculated. The method of the present invention maintains a heap, in which the first k maximum values ​​of the similarity are stored, and the average value of the similarity in the heap is taken as the abnormal score of the traffic sample to be tested.

[0040] In the embodiment of the present invention, the Nilsimsa algorithm is used to obtain the sample digest, and the method for calculating the similarity of the sample digests is: count the number of bits with equal values ​​in the two sample digests, and subtract 128 from the statistical value to obtain the similarity s. The larger the value of the similarity s is, the more similar the two sample digests are. Therefore, the similarity value range of the two sample hash digests is -128 to 128.

[0041] This step adopts an anomaly detection strategy based on k nearest neighbors. Directly calculating all similarities and averaging them is easily affected by noise or outliers, without considering the local characteristics of the data. If the similarity distribution of the samples is uneven, errors may occur. The method of the present invention selects an appropriate k to effectively reduce the impact of noise on the detection results, obtain a smoother result, and reduce the impact of single-point anomalies on the overall results. In addition, by maintaining a smaller heap array, memory usage is significantly reduced while reducing computational overhead.

[0042] Locally sensitive hashing can map inputs of arbitrary length to outputs of fixed length while preserving the similarity between data points. The locally sensitive hash value of benign traffic will be similar to previous benign traffic, while the opposite is true for abnormal traffic. Therefore, the locally sensitive hash value of network traffic can be calculated and the similarity can be calculated with the hash value of normal data as a basis for judging whether the data is abnormal. Due to different time periods, the behavior pattern of normal traffic may change to a certain extent, and their locally sensitive hash values ​​may not be similar. In addition, in scenarios with limited resources, saving the locally sensitive hash values ​​of all normal data will take up too much storage space. Therefore, a fixed-size window can be maintained to only save the locally sensitive hash values ​​calculated from the latest network traffic, thereby reducing storage overhead while improving detection results.

[0043] Step 5: Compare the anomaly score of the network traffic sample to be detected with the preset threshold θ to determine whether it is abnormal traffic.

[0044] The process of the detection phase is as follows Figure 4 As shown. In the embodiment of the present invention, the network traffic to be tested is preprocessed according to step 1 to obtain the sample to be tested, the sample summary is extracted according to step 2, and then the similarity between each sample summary to be tested and each sample summary in the sliding window currently maintained in step 3 is calculated, and then the average value of the top k maximum similarities is obtained as the abnormal score g of the sample to be tested. If the Nilsimsa algorithm is selected, the larger the value of g, the more similar it is, so traffic greater than the threshold θ is identified as benign traffic, and traffic less than or equal to the threshold is identified as abnormal traffic. When the current sample is determined to be benign traffic, the content of the sliding window W described in step 3 will be updated. When the current sample is determined to be abnormal traffic, an alarm mechanism will be triggered.

[0045] The method of the present invention is compared with the existing method. The comparison results are as follows Figure 5 and 6 shown.

[0046] like Figure 5As shown, the horizontal axis is the three selected indicators for evaluating detection capabilities. Accuracy is a basic indicator for evaluating the overall effectiveness of the classification model, indicating the proportion of samples correctly classified by the model to the total number of samples; the false alarm rate is an indicator used to measure the performance of the classification model, which refers to the proportion of all samples that are actually negative that are incorrectly predicted as positive by the model. The lower the false alarm rate, the higher the accuracy of the model in predicting negative samples, and the fewer cases of misjudgment as positive; the ROC curve area (AUROC) measures the ability of the model to distinguish between categories, and does not depend on any specific decision threshold, so it can provide a comprehensive model performance evaluation without being affected by the threshold selection. The vertical axis is the score of different evaluation indicators experimentally tested in a resource-constrained network scenario taking the controller area network as an example, and different abnormal traffic detection methods are represented by columns of different colors. It can be seen from the figure that the method of the present invention shows better performance under different evaluation indicators than the existing typical methods, with the accuracy and ROC curve area reaching more than 95%, and the false alarm rate less than 5%. Compared with the direct use of the Nilsimsa algorithm for anomaly detection, the improved performance is obvious. This shows that the method proposed in the present invention not only has lower operating costs, but also has stronger detection capabilities, achieving a balance between detection accuracy and operating costs.

[0047] like Figure 6 As shown in the figure, the storage overhead of the method of the present invention is compared with that of the partition-based method. The horizontal axis is different methods, and the vertical axis is the logarithmic overhead size, in kB. The sliding window size selected in the experiment is 100, and the k nearest neighbor parameter k=5. It can be seen from the figure that the storage overhead of the method of the present invention is much smaller than that of the partition-based method.

[0048] In general, the method of the present invention extracts the valid fields of network traffic, calculates the local sensitive hash value, makes anomaly judgment based on the similarity of hash summaries, introduces traffic aggregation, sliding window and k-nearest neighbor strategy, avoids the interference of irrelevant and noisy data, and improves the anomaly detection effect.

[0049] Except for the technical features described in the specification, all of them are known technologies to those skilled in the art. The present invention omits the description of known components and known technologies to avoid redundancy and unnecessary limitation of the present invention. The implementation methods described in the above embodiments do not represent all implementation methods consistent with the present application. On the basis of the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative labor are still within the protection scope of the present invention.

Claims

1. A method for detecting abnormal traffic in a closed network under resource-constrained scenarios, characterized in that: The steps include: Step 1: pre-process the acquired network traffic in sequence to generate a sample stream, the pre-processing includes: extracting valid data fields from network data packets, detecting whether the valid data fields extracted from a single data packet meet the preset length, and if the length is insufficient, sequentially splicing the valid data fields extracted from n data packets to form a sample; the valid data field includes a data packet ID, a flag bit and data; n is a positive integer; Step 2: Calculate the local sensitive hash value for each sample in sequence to obtain the summary of the sample; Step 3: Set and maintain a sliding window W of fixed size K, in which the summaries of the latest K samples of benign network traffic are stored; K is a positive integer greater than 2; Step 4: In the detection phase, obtain each sample to be tested according to step 1 for the network traffic to be tested, obtain the summary of the sample to be tested according to step 2, calculate the summary similarity of each sample to be tested with the K samples in the sliding window W, and take the average of the first k maximum similarities as the anomaly score g of the sample to be tested; Step 5: Compare the anomaly score g of the sample to be tested with the preset threshold θ. If g is greater than θ, the sample to be tested is judged as benign traffic, otherwise the sample to be tested is judged as abnormal traffic; update the summary of the sample to be tested that is judged as benign traffic to the sliding window W; when it is judged as abnormal traffic, trigger the alarm mechanism.

2. The method according to claim 1, characterized in that In the step 2, the input sample is calculated using the Nilsimsa algorithm for locally sensitive hash values ​​to generate a sample summary, including: using a 5-character sliding window to scan the data of the input sample character by character, generating 8 different triples for each sliding window, using the same hash function to calculate the hash value for the triple, and counting the 256-length array acc, wherein the i-th element of acc counts the number of occurrences of the hash value i; dividing the total number of triplets processed by the input sample by 256 to obtain a threshold threshold, if the number of occurrences of the hash value of a triple exceeds the threshold, the triple is considered to be significant; comparing the value of each element in the array acc with the threshold threshold to obtain a summary array digest, if the i-th element value of acc is greater than the threshold, setting the i-th element value of digest to 1, otherwise setting the i-th element value of digest to 0, and finally flipping the obtained summary array digest to obtain the summary of the input sample.

3. The method according to claim 1, characterized in that In step 4, a heap of fixed length k is set, in which the first k maximum values ​​of summary similarities between the sample to be tested and the K samples in the sliding window W are stored, and the average value of the k similarities in the heap is calculated as the anomaly score of the sample to be tested.

4. The method according to claim 1 or 3, characterized in that: In step 4, the similarity calculation method of the abstracts of the two samples is: count the number of bits with equal values ​​in the two sample abstracts, subtract 128 from the statistical value to obtain the similarity s, and the larger the value of the similarity s, the more similar the two sample abstracts are.

Images