Network protocol anomaly detection method and device and electronic equipment

Abstract

The invention provides a network protocol anomaly detection method and device and electronic equipment, and relates to the technical field of network protocol anomaly detection, and the method comprises the steps: collecting to-be-detected network protocol data; performing feature extraction on the to-be-detected network protocol data to obtain a to-be-detected data set; determining an abnormal point in the to-be-detected data set and an abnormal degree value corresponding to the abnormal point through a spatial clustering algorithm, and determining a local outlier factor corresponding to each data point in the to-be-detected data set through a local anomaly detection method; determining a target abnormal value corresponding to each data point in the to-be-detected data set according to the abnormal degree value and a local outlier factor; and alarming the network protocol corresponding to the target abnormal value according to the target abnormal value, so that the network abnormal protocol can be more accurately judged, and the accuracy of abnormal protocol detection is improved.

Description

Technical Field

[0001] The present application relates to the technical field of network protocol anomaly detection, and in particular to a network protocol anomaly detection method, device and electronic equipment. Background Art

[0002] A network protocol is a set of rules, standards or agreements established for data exchange in a computer network. It specifies the format, meaning, sequence and response mechanism of messages exchanged between communication entities, thereby ensuring the accuracy of data exchange and the reliability of transmission. However, with the rapid development of network technology, while improving the efficiency of data transmission, network protocols have also exposed some security risks, such as ARP spoofing, DNS hijacking and other attack methods based on protocol vulnerabilities, which seriously threaten the stability of the network and the security of user data. Summary of the invention

[0003] In order to at least overcome the above-mentioned deficiencies in the prior art, the purpose of the present application is to provide a network protocol anomaly detection method, device and electronic device.

[0004] In a first aspect, an embodiment of the present application provides a network protocol anomaly detection method, the network protocol anomaly detection method comprising:

[0005] Collect the network protocol data to be tested;

[0006] Extracting features of the network protocol data to be tested to obtain a data set to be tested;

[0007] Determine the abnormal points in the test data set and the abnormal degree values ​​corresponding to the abnormal points by using a spatial clustering algorithm, and determine the local outlier factors corresponding to each data point in the test data set by using a local anomaly detection method;

[0008] Determine the target outlier value corresponding to each data point in the test data set according to the outlier degree value and the local outlier factor;

[0009] An alarm is issued for a network protocol corresponding to the target abnormal value according to the target abnormal value.

[0010] In a possible implementation, the step of determining the abnormal points in the test data set and the abnormality degree values ​​corresponding to the abnormal points by using a spatial clustering algorithm includes:

[0011] Determine core points from the data set to be tested according to a preset neighborhood radius threshold and a preset neighborhood density threshold, thereby obtaining a core point set;

[0012] Determine the neighborhoods corresponding to the core points according to the preset neighborhood radius threshold, and judge whether the data points in the test data set are abnormal points according to the neighborhoods corresponding to the core points;

[0013] If so, the abnormality degree value corresponding to the abnormal point is calculated.

[0014] In a possible implementation, the abnormality degree value is calculated in the following manner:

[0015]

[0016] Wherein, d(p,m) represents the average Euclidean distance between the outlier point and a preset number of data points belonging to the same cluster cluster that are closest to the outlier point, m represents one of the preset number of data points belonging to the same cluster cluster that are closest to the outlier point, and R represents the preset neighborhood radius threshold.

[0017] In a possible implementation, the step of determining the local outlier factors corresponding to each data point in the test data set by using a local anomaly detection method includes:

[0018] Determine the k-neighbor distance corresponding to each data point in the test data set according to a preset number of neighbors;

[0019] Determine the influence domain and local density corresponding to each data point in the test data set according to the k-neighbor distance;

[0020] The local outlier factor corresponding to each data point in the test data set is determined according to the influence domain and the local density.

[0021] In a possible implementation, the step of determining the k-neighbor distance corresponding to each data point in the test data set according to a preset number of neighbors includes:

[0022] Selecting a first data point to be tested from the data set to be tested;

[0023] Determine a second data point to be tested according to a preset number of nearest neighbors;

[0024] Determine the distance between the first to-be-tested data point and the second to-be-tested data point according to the Euclidean distance calculation method, thereby obtaining a k-neighbor distance;

[0025] The k-neighbor distance corresponding to the first data point to be tested is calculated in the following way:

[0026]

[0027] Among them, p represents the first data point to be tested, o represents the second data point to be tested, k represents the preset number of neighbors, and n represents the n-dimensional space to which the data point belongs.

[0028] In a possible implementation, the local outlier factor is calculated in the following manner:

[0029]

[0030] Among them, den avg (IS k (p)) represents the average local density of each data point in the influence domain corresponding to the first data point to be tested, den(p) represents the local density corresponding to the first data point to be tested, IS k (p) represents the influence domain corresponding to the first data point to be measured.

[0031] In a possible implementation, the step of determining the outliers in the test data set by using a spatial clustering algorithm includes:

[0032] Determine the outliers in the test data set by using a spatial clustering algorithm to obtain the number of outliers;

[0033] The step of determining a target outlier value according to the outlier degree value and the local outlier factor comprises:

[0034] Standardizing the abnormality degree value and the local outlier factor to obtain a first standard value corresponding to the abnormality degree value and a second standard value corresponding to the local outlier factor, respectively;

[0035] Determine a weight parameter according to the number of outliers;

[0036] A target outlier value is calculated based on the weight parameter, the first standard value, and the second standard value.

[0037] In a possible implementation manner, the first standard value is calculated in the following manner:

[0038]

[0039] Among them, DBSCAN(P) represents the abnormality degree value, μ1 represents the average value of each abnormality degree value obtained by the spatial clustering algorithm, and δ1 represents the standard deviation of each abnormality degree value obtained by the spatial clustering algorithm;

[0040] The second standard value is calculated by the following method:

[0041]

[0042] Among them, INFLO k(a) represents the local outlier factor, μ2 represents the average value of each local outlier factor obtained by the local anomaly detection method, and δ2 represents the standard deviation of each local outlier factor obtained by the local anomaly detection method;

[0043] The weight parameter is calculated in the following way:

[0044]

[0045] Among them, y represents the total number of data points in the test data set, x represents the number of abnormal points obtained by the spatial clustering algorithm, and θ represents a constant;

[0046] The target outlier value is calculated in the following way:

[0047] score(a)=β×zs_DBSCAN(a)+(1-β)×zs_inflo(a)

[0048] Among them, β represents the weight parameter; zs_DBSCAN(a) represents the first standard value, and zs_inflo(a) represents the second standard value.

[0049] In a second aspect, an embodiment of the present application further provides a network protocol anomaly detection device, the network protocol anomaly detection device comprising:

[0050] A collection module, used for collecting the network protocol data to be tested;

[0051] A feature extraction module is used to extract features from the network protocol data to be tested to obtain a data set to be tested;

[0052] A first determination module is used to determine the abnormal points in the test data set and the abnormality degree values ​​corresponding to the abnormal points by using a spatial clustering algorithm, and to determine the local outlier factors corresponding to each data point in the test data set by using a local anomaly detection method;

[0053] A second determination module is used to determine the target outlier value corresponding to each data point in the test data set according to the outlier degree value and the local outlier factor;

[0054] An alarm module is used to alarm the network protocol corresponding to the target abnormal value according to the target abnormal value.

[0055] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by the processor, the method described in any of the above aspects is implemented.

[0056] Based on any one of the above aspects, the network protocol anomaly detection method, device and electronic device provided in the embodiments of the present application obtain the anomaly degree value and the local outlier factor respectively through the improved spatial clustering algorithm and the local anomaly detection method, and obtain the target anomaly value based on the anomaly degree value and the local outlier factor. In this way, the network protocol is detected from the two perspectives of density clustering and local anomaly, which can more accurately identify the network abnormal protocol and improve the accuracy of abnormal protocol detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0058] Figure 1 A flowchart of a network protocol anomaly detection method provided in this embodiment;

[0059] Figure 2 One of the sub-step schematic diagrams of step S300 provided in this embodiment;

[0060] Figure 3 The second schematic diagram of sub-steps of step S300 provided in this embodiment;

[0061] Figure 4 A schematic diagram of sub-steps of step S321 provided in this embodiment;

[0062] Figure 5 A schematic diagram of sub-steps of step S400 provided in this embodiment;

[0063] Figure 6 A schematic diagram of the structure of an electronic device provided in this embodiment;

[0064] Figure 7 A schematic diagram of the structure of the network protocol anomaly detection device provided in this embodiment.

[0065] Icons: 800 - electronic device; 810 - processor; 820 - machine-readable storage medium; 830 - network protocol anomaly detection device; 831 - acquisition module; 832 - feature extraction module; 833 - first determination module; 834 - second determination module; 835 - alarm module. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0067] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0068] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0069] In the description of this application, it should be noted that the terms "upper", "lower", etc. indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of the application is usually placed when in use, which is only for the convenience of describing this application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on this application. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0070] It should be noted that, in the absence of conflict, different features in the embodiments of the present application may be combined with each other.

[0071] The inventors have discovered that the currently commonly used network anomaly protocol detection technology usually relies on a single dimension for anomaly detection. This method mainly focuses on a specific feature or dimension to identify and detect abnormal behavior or attacks in network protocols. It may not be able to accurately identify network abnormal protocols, and may cause false positives and negative positives of abnormal behaviors or attacks in network protocols.

[0072] In view of this, this embodiment provides a solution that can solve the above-mentioned problem, and the solution provided by this embodiment is described in detail below.

[0073] Please refer to Figure 1 , Figure 1 Example A flowchart of a network protocol anomaly detection method provided by this embodiment, the method may include the following steps.

[0074] Step S100, collecting network protocol data to be tested.

[0075] In this embodiment, the network protocol data to be tested may be collected first, and then preprocessed. For example, data deduplication and missing value completion may be performed on the network protocol data to be tested.

[0076] Step S200: extracting features from the network protocol data to be tested to obtain a data set to be tested.

[0077] In this embodiment, features such as the total number of data packets, the length of data packets, the average packet length, the number of uplink and downlink packets, and the flow duration in the network protocol data to be tested can be extracted to obtain the data set to be tested.

[0078] Step S300, determining the abnormal points in the test data set and the abnormality degree values ​​corresponding to the abnormal points by a spatial clustering algorithm, and determining the local outlier factors corresponding to each data point in the test data set by a local anomaly detection method.

[0079] In this embodiment, all the abnormal points in the test data set can be determined by using an improved density-based spatial clustering algorithm that can process noise data (Density Based Spatial Clustering Of Applications With Noise, DBSCAN), and the abnormal degree values ​​corresponding to all the abnormal points can be calculated. At the same time, the local outlier factors corresponding to all the data points in the test data set can also be calculated by using a local anomaly detection method (Influenced Outlierness, INFLO).

[0080] Step S400: determining target outlier values ​​corresponding to respective data points in the test data set according to the outlier degree value and the local outlier factor.

[0081] In this embodiment, the target outlier values ​​corresponding to all data points in the test data set can be calculated according to the outlier degree value and the local outlier factor obtained in step S300.

[0082] Step S500: alarming a network protocol corresponding to the target abnormal value according to the target abnormal value.

[0083] In this embodiment, a preset score threshold (for example, the preset score threshold may be 2) may be set according to actual conditions, and the target abnormal value may be compared with the preset score threshold. If the target abnormal value is greater than the preset score threshold, an alarm may be issued for the network protocol corresponding to the target abnormal value. If all target abnormal values ​​are not greater than the preset score threshold, it indicates that there is no abnormal protocol in the current network environment.

[0084] In the above design, the anomaly degree value and the local outlier factor are obtained respectively through the improved spatial clustering algorithm and the local anomaly detection method, and the target anomaly value is obtained according to the anomaly degree value and the local outlier factor. In this way, the network protocol is detected from the two perspectives of density clustering and local anomaly, which can more accurately identify the network abnormal protocol and improve the accuracy of abnormal protocol detection.

[0085] In one possible implementation, see Figure 2 , step S300 may include the following sub-steps.

[0086] Step S311 , determining core points from the data set to be tested according to a preset neighborhood radius threshold and a preset neighborhood density threshold, thereby obtaining a core point set.

[0087] In this embodiment, a preset neighborhood radius threshold (for example, the preset neighborhood radius threshold may be 0.5) and a preset neighborhood density threshold (for example, the preset neighborhood density threshold may be 5) may be set first, and then all data points in the data set to be tested may be scanned. If the number of data points in the neighborhood of a certain data point p is greater than or equal to the preset neighborhood density threshold, the data point p may be marked as a core point and stored in the core point set C1. The preset neighborhood radius threshold is the maximum radius of the neighborhood range of a sample point, the preset neighborhood density threshold is the minimum critical value of the total number of sample points in the neighborhood, and the preset neighborhood radius threshold and the preset neighborhood density threshold may be used to describe the compactness of sample distribution in the neighborhood.

[0088] The neighborhood refers to the set of data points in the test data set whose distance to the data point is not greater than the preset neighborhood radius threshold, that is:

[0089] N db (p)={q∈D|d(p,q)≤R}

[0090] Where D represents the data set to be tested, d(p,q) represents the distance between data point p and data point q, and R represents the neighborhood radius threshold.

[0091] Step S312, determining the neighborhoods corresponding to the core points according to the preset neighborhood radius threshold, and judging whether the data points in the test data set are abnormal points according to the neighborhoods corresponding to the core points.

[0092] In this embodiment, any unmarked point (i.e., non-core point) can be randomly selected in the test data set, and it is determined whether the point belongs to the neighborhood of any core point in the core point set C1. If so, the point is marked as a boundary point and stored in the boundary point set C2; if not, the point is marked as an outlier.

[0093] Step S313: If yes, calculate the abnormality degree value corresponding to the abnormal point.

[0094] In this embodiment, if the unmarked point selected in the test data set is an outlier, the outlier degree value corresponding to the outlier point can be obtained by calculating the ratio of the average Euclidean distance between the outlier point and the w points closest to it belonging to a certain cluster and its neighborhood radius threshold R, that is:

[0095]

[0096] Among them, d(p,m) represents the average Euclidean distance between the outlier point p and the preset number w of data points belonging to the same cluster closest to the outlier point p, m represents one of the preset number w of data points belonging to the same cluster closest to the outlier point p, and R represents the preset neighborhood radius threshold. The larger the ratio of the average Euclidean distance between the outlier point and the w points belonging to a cluster closest to it to its neighborhood radius threshold R, the farther the outlier point is from the nearest cluster, and the higher the possibility of anomaly.

[0097] It should be noted that the preset number w can be 3, 4, 5, etc., and is not specifically limited here.

[0098] The average Euclidean distance d(p,m) between an outlier point and a preset number w of data points that are closest to the outlier point and belong to the same cluster can be calculated as follows:

[0099]

[0100] Among them, m represents a data point among the preset number w of data points belonging to the same cluster that is closest to the outlier point p, m∈C, C=C1∪C2, C represents the set of points belonging to a certain cluster among the data points, that is, the union of the core point set and the boundary point set, and n represents the n-dimensional space to which the data point belongs.

[0101] In addition, after calculating the abnormality degree value corresponding to the abnormal point, it is also necessary to determine whether there is an unmarked point in the test data set D. If so, continue to select any unmarked point to execute step S312 until there is no unmarked point in the test data set D. When there is no unmarked point in the test data set D, all abnormal points in the test data set D and the abnormality degree values ​​corresponding to the abnormal points can be obtained.

[0102] The inventors have found that the spatial clustering algorithm in the prior art can detect abnormal points that cannot form clusters by finding core points to form temporary clusters and merging temporary clusters to obtain final clusters. However, this method can only be used to detect abnormal points and cannot measure the degree of abnormality of the abnormal points. The spatial clustering algorithm provided in the present application does not require the number of clusters to be declared in advance, and can cluster data sets of any shape to obtain abnormal points in the data set, and can quantify the abnormal points to obtain the abnormal value of each abnormal point.

[0103] In one possible implementation, see Figure 3 , step S300 may include the following sub-steps.

[0104] Step S321, determining the k-neighbor distance corresponding to each data point in the test data set according to a preset number of neighbors.

[0105] In this embodiment, a preset number of neighbors k may be set first, and then any unlabeled point p may be selected from the data set to be tested, and the k-neighbor distance of the unlabeled point p may be calculated. The preset number of neighbors k indicates the number of data points that need to be selected that are closest to the unlabeled point p, and the k-neighbor distance of the unlabeled point p indicates the distance between the kth closest data point o and the object p among the several data points closest to the unlabeled point p. For example, the preset number of neighbors k may be 5.

[0106] It should be noted that the value of the preset number of nearest neighbors k can be adjusted according to actual conditions. For example, the value of the preset number of nearest neighbors k can also be 4, 6, 7, etc., which is not specifically limited here.

[0107] Step S322: determining the influence domain and local density corresponding to each data point in the test data set according to the k-neighbor distance.

[0108] In this embodiment, the k-nearest neighbors N of the data point p can be used to calculate the k (p) and reverse k-nearest neighbor RNN k (p) Determine the influence domain IS of data point p k (p), the influence domain IS of data point p k (p) can be expressed as:

[0109] IS k (p) = N k (p)∪RNN k (p)

[0110] Among them, the k-nearest neighbors N of the data point p k (p) can be calculated based on the k-neighbor distance d of the data point p k (p) Get, the k-nearest neighbors N of data point p k(p) indicates that the distance from the test data set D to the data point p is not greater than the k-neighbor distance d of the data point p. k (p) is a set of data points, namely:

[0111] N k (p)={q∈D|d(p,q)≤d k (p)}

[0112] Reverse k-nearest neighbor RNN for data point p k (p) represents the set of data points whose k-nearest neighbors in the test data set D include data point p. If the k-nearest neighbors of data point q include data point p, then the reverse k-nearest neighbors of data point p include data point q, that is:

[0113] RNN k (p) = {q|q∈D, p∈N k (q)}

[0114] In addition, the local density of data point p can also be calculated based on the k-neighboring distance d of data point p k (p) is obtained, the local density den(p) of data point p can be obtained as the k-neighboring distance d of data point p. k The reciprocal of (p):

[0115]

[0116] Where den(p) represents the local density of data point p, d k (p) represents the k-neighbor distance of data point p.

[0117] Step S323: determining a local outlier factor corresponding to each data point in the test data set according to the influence domain and the local density.

[0118] In this embodiment, the average local density of all data points in the influence domain of data point p can be calculated according to the influence domain of data point p obtained in step S322, and then the local outlier factor of data point p can be obtained by calculating the ratio of the average local density of all data points in the influence domain of data point p to the local density of data point p. If the value of the local outlier factor is larger, it means that data point p is relatively far away from other points and may be an abnormal point.

[0119] In addition, after calculating the local outlier factor of the data point p, it is also necessary to determine whether the local outlier factor has been calculated for each data point in the test data set. If there are data points whose local outlier factors have not been calculated, the data points that have not been calculated are selected to execute step S321 until the local outlier factor has been calculated for each data point in the test data set.

[0120] The inventors have found that the local anomaly detection method in the prior art obtains anomaly values ​​by comparing the local density difference between a data point and its neighboring points, and is prone to misjudgment when detecting edge points between regions of different densities. The local anomaly detection method provided by the present application can reduce the misjudgment of edge points when regions of different densities are very close in a data set by considering the neighbors of the data point and its reverse neighbors, better express the density characteristics of the region where the data point is located, and obtain more accurate data point anomalies.

[0121] In one possible implementation, see Figure 4 , step S321 may include the following sub-steps.

[0122] Step S321a, selecting a first data point to be tested from the data set to be tested.

[0123] In this embodiment, a preset number of nearest neighbors k may be set first, and any first data point p to be tested may be randomly selected from the data set to be tested, where the first data point p to be tested is an unmarked point.

[0124] Step S321b, determining a second data point to be tested according to a preset number of nearest neighbors.

[0125] In this embodiment, the kth data point closest to the first data point to be tested p can be determined as the second data point to be tested o according to the preset neighbor number k.

[0126] Step S321c: determine the distance between the first data point to be tested and the second data point to be tested according to the Euclidean distance calculation method, thereby obtaining a k-neighbor distance.

[0127] In this embodiment, the k-neighbor distance corresponding to the first data point to be measured can be calculated in the following way:

[0128]

[0129] Among them, p represents the first data point to be tested, o represents the second data point to be tested, k represents the preset number of neighbors, and n represents the n-dimensional space to which the data point belongs.

[0130] In a possible implementation, the local outlier factor may be calculated in the following manner:

[0131]

[0132] Among them, den avg (IS k (p)) represents the average local density of each data point in the influence domain corresponding to the first data point p to be tested, den(p) represents the local density corresponding to the first data point p to be tested, IS k(p) represents the influence domain corresponding to the first data point p to be measured.

[0133]

[0134] Among them, den avg (IS k (p)) represents the average local density of all data points in the influence domain of the first data point to be tested p, |IS k (p)| represents the number of data points in the influence domain of the first data point p to be tested.

[0135] In a possible implementation, in step S300, when the outliers in the test data set are determined by using a spatial clustering algorithm, the number of outliers in the test data set can also be obtained.

[0136] Please refer to Figure 5 , step S400 may include the following sub-steps.

[0137] Step S410, standardizing the abnormality level value and the local outlier factor to obtain a first standard value corresponding to the abnormality level value and a second standard value corresponding to the local outlier factor, respectively.

[0138] In this embodiment, since the spatial clustering algorithm and the local anomaly detection method have different quantification methods for outliers, the Z-Score standardization method can be used to standardize the obtained abnormality degree value and local outlier factor, and the absolute value of the value obtained after standardization is taken to obtain the first standard value and the second standard value.

[0139] For any data point a in the test data set, since the spatial clustering algorithm can only obtain the outliers in the test data set and their corresponding outlier values, and the data point a is not necessarily an outlier, it is necessary to first determine whether the data point a is an outlier. If the data point a is not an outlier, the first standard value of the data point a can be 0. If the data point a is an outlier, the first standard value can be calculated in the following way:

[0140]

[0141] Among them, DBSCAN(P) represents the abnormality degree value, μ1 represents the average value of each abnormality degree value obtained by the spatial clustering algorithm, and δ1 represents the standard deviation of each abnormality degree value obtained by the spatial clustering algorithm.

[0142] The second standard value can be calculated as follows:

[0143]

[0144] Among them, INFLO k(a) represents the local outlier factor, μ2 represents the average value of each local outlier factor obtained by the local anomaly detection method, and δ2 represents the standard deviation of each local outlier factor obtained by the local anomaly detection method.

[0145] Step S420: determining a weight parameter according to the number of outliers.

[0146] In this embodiment, since the spatial clustering algorithm and the local anomaly detection method have different focuses on network protocol anomaly detection, it is necessary to add a weight parameter to adjust the focus of the first standard value and the second standard value to obtain a more accurate target anomaly value.

[0147] The weight parameters can be calculated as follows:

[0148]

[0149] Where y represents the total number of data points in the test data set, x represents the number of outliers obtained by the spatial clustering algorithm, and β∈[0,1). To avoid the situation where β=0 when x=1, a constant θ greater than 0 and less than 1 can be added. The value of the constant θ is very small, which can be 0.01. The more outliers detected by the spatial clustering algorithm, the larger the weight parameter.

[0150] It should be noted that the value of the constant θ can be adjusted according to actual conditions. For example, the value of the constant θ can also be 0.001, 0.02, etc., which is not specifically limited here.

[0151] Usually, since the number of data points in the test data set is not zero, the number of outliers detected by the spatial clustering algorithm is also not zero, and the number of outliers detected by the spatial clustering algorithm is less than the number of all data points in the test data set, therefore, 1 <x+θ<y, We can get β∈(0,1).

[0152] It should be noted that if the number of outliers detected by the spatial clustering algorithm is 0, it is necessary to focus more on the detection results of the local anomaly detection method. In this case, β can be 0.

[0153] Step S430, calculating a target outlier value according to the weight parameter, the first standard value and the second standard value.

[0154] In this embodiment, the target outlier value can be calculated in the following way:

[0155] score(a)=β×zs_DBSCAN(a)+(1-β)×zs_inflo(a)

[0156] Among them, β represents the weight parameter; zs_DBSCAN(a) represents the first standard value, and zs_inflo(a) represents the second standard value.

[0157] The larger the target outlier value is, the more likely the network protocol is an abnormal protocol.

[0158] This embodiment also provides an electronic device 800, please refer to Figure 6 , Figure 6 A block diagram of the electronic device 800 is shown as an example. The electronic device includes a processor 810, a machine-readable storage medium 820 and a network protocol anomaly detection device 830. The machine-readable storage medium 820 and the processor 810 are electrically connected to each other directly or indirectly to realize data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. The network protocol anomaly detection device 830 includes a plurality of software function modules that can be stored in the machine-readable storage medium 820 in the form of software or firmware or solidified in the operating system (OS) of the network protocol anomaly detection device 830. The processor 810 is used to execute executable modules stored in the machine-readable storage medium 820, such as software function modules and computer programs included in the network protocol anomaly detection device 830.

[0159] The machine-readable storage medium 820 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The machine-readable storage medium 820 is used to store a program, and the processor 810 executes the program after receiving an execution instruction.

[0160] The processor 810 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 810 may be a general-purpose processor 810, including a central processing unit 810 (CPU), a network processor 810 (NP), etc.; it may also be a digital signal processor 810 (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The various methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor 810 may be a microprocessor 810 or the processor 810 may also be any conventional processor 810, etc.

[0161] Please refer to Figure 7 The embodiment of the present application further provides a network protocol anomaly detection device 830, which includes a plurality of functional modules that can be stored in a machine-readable storage medium 820 in the form of software. Functionally, the network protocol anomaly detection device 830 may include a collection module 831, a feature extraction module 832, a first determination module 833, a second determination module 834, and an alarm module 835. Among them:

[0162] The acquisition module 831 may be used to acquire the network protocol data to be tested.

[0163] In this embodiment, the acquisition module 831 can be used to perform Figure 1 As shown in step S100, for the detailed description of the acquisition module 831, reference may be made to the description of the step S100.

[0164] The feature extraction module 832 may be used to extract features from the network protocol data to be tested to obtain a data set to be tested.

[0165] In this embodiment, the feature extraction module 832 can be used to perform Figure 1 As shown in step S200, for the detailed description of the feature extraction module 832, please refer to the description of step S200.

[0166] The first determination module 833 can be used to determine the abnormal points in the test data set and the abnormality degree values ​​corresponding to the abnormal points through a spatial clustering algorithm, and determine the local outlier factors corresponding to each data point in the test data set through a local anomaly detection method.

[0167] In this embodiment, the first determining module 833 can be used to execute Figure 1As shown in step S300, for the detailed description of the first determining module 833, reference may be made to the description of step S300.

[0168] The second determination module 834 may be configured to determine target outlier values ​​corresponding to respective data points in the test data set according to the outlier degree value and the local outlier factor.

[0169] In this embodiment, the second determination module 834 can be used to perform Figure 1 As shown in step S400, for the detailed description of the second determining module 834, reference may be made to the description of step S400.

[0170] The alarm module 835 may be configured to generate an alarm for a network protocol corresponding to the target abnormal value according to the target abnormal value.

[0171] In this embodiment, the alarm module 835 can be used to execute Figure 1 As shown in step S500, for the detailed description of the alarm module 835, reference may be made to the description of step S500.

[0172] In summary, this embodiment provides a network protocol anomaly detection method, device and electronic device, which respectively obtain the anomaly degree value and the local outlier factor through the improved spatial clustering algorithm and the local anomaly detection method, and obtain the target anomaly value according to the anomaly degree value and the local outlier factor. In this way, the network protocol is detected from the two perspectives of density clustering and local anomaly, which can more accurately identify the network abnormal protocol and improve the accuracy of abnormal protocol detection.

[0173] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0174] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network protocol anomaly detection method, characterized in that: The method comprises: Collect the network protocol data to be tested; Extracting features of the network protocol data to be tested to obtain a data set to be tested; Determine the abnormal points in the test data set and the abnormal degree values ​​corresponding to the abnormal points by using a spatial clustering algorithm, and determine the local outlier factors corresponding to each data point in the test data set by using a local anomaly detection method; Determine the target outlier value corresponding to each data point in the test data set according to the outlier degree value and the local outlier factor; An alarm is issued for a network protocol corresponding to the target abnormal value according to the target abnormal value.

2. The network protocol anomaly detection method according to claim 1, characterized in that: The step of determining the abnormal points in the test data set and the abnormality degree values ​​corresponding to the abnormal points by using a spatial clustering algorithm includes: Determine core points from the data set to be tested according to a preset neighborhood radius threshold and a preset neighborhood density threshold, thereby obtaining a core point set; Determine the neighborhoods corresponding to the core points according to the preset neighborhood radius threshold, and judge whether the data points in the test data set are abnormal points according to the neighborhoods corresponding to the core points; If so, the abnormality degree value corresponding to the abnormal point is calculated.

3. The network protocol anomaly detection method according to claim 2, characterized in that: The abnormality degree value is calculated by the following method: Wherein, d(p,m) represents the average Euclidean distance between the outlier point and a preset number of data points belonging to the same cluster cluster that are closest to the outlier point, m represents one of the preset number of data points belonging to the same cluster cluster that are closest to the outlier point, and R represents the preset neighborhood radius threshold.

4. The network protocol anomaly detection method according to claim 1, characterized in that: The step of determining the local outlier factors corresponding to each data point in the test data set by using a local anomaly detection method comprises: Determine the k-neighbor distance corresponding to each data point in the test data set according to a preset number of neighbors; Determine the influence domain and local density corresponding to each data point in the test data set according to the k-neighbor distance; The local outlier factor corresponding to each data point in the test data set is determined according to the influence domain and the local density.

5. The network protocol anomaly detection method according to claim 4, characterized in that: The step of determining the k-neighbor distance corresponding to each data point in the test data set according to the preset number of neighbors includes: Selecting a first data point to be tested from the data set to be tested; Determine a second data point to be tested according to a preset number of nearest neighbors; Determine the distance between the first to-be-tested data point and the second to-be-tested data point according to the Euclidean distance calculation method, thereby obtaining a k-neighbor distance; The k-neighbor distance corresponding to the first data point to be tested is calculated in the following way: Among them, p represents the first data point to be tested, o represents the second data point to be tested, k represents the preset number of neighbors, and n represents the n-dimensional space to which the data point belongs.

6. The network protocol anomaly detection method according to claim 5, characterized in that: The local outlier factor is calculated as follows: Among them, den avg (IS k (p)) represents the average local density of each data point in the influence domain corresponding to the first data point to be tested, den(p) represents the local density corresponding to the first data point to be tested, IS k (p) represents the influence domain corresponding to the first data point to be measured.

7. The network protocol anomaly detection method according to claim 1, characterized in that: The step of determining the outliers in the test data set by using a spatial clustering algorithm comprises: Determine the outliers in the test data set by using a spatial clustering algorithm to obtain the number of outliers; The step of determining a target outlier value according to the outlier degree value and the local outlier factor comprises: Standardizing the abnormality degree value and the local outlier factor to obtain a first standard value corresponding to the abnormality degree value and a second standard value corresponding to the local outlier factor, respectively; Determine a weight parameter according to the number of outliers; A target outlier value is calculated based on the weight parameter, the first standard value, and the second standard value.

8. The network protocol anomaly detection method according to claim 7, characterized in that: The first standard value is calculated by the following method: Among them, DBSCAN(P) represents the abnormality degree value, μ1 represents the average value of each abnormality degree value obtained by the spatial clustering algorithm, and δ1 represents the standard deviation of each abnormality degree value obtained by the spatial clustering algorithm; The second standard value is calculated by the following method: Among them, INFLO k (a) represents the local outlier factor, μ2 represents the average value of each local outlier factor obtained by the local anomaly detection method, and δ2 represents the standard deviation of each local outlier factor obtained by the local anomaly detection method; The weight parameter is calculated in the following way: Among them, y represents the total number of data points in the test data set, x represents the number of abnormal points obtained by the spatial clustering algorithm, and θ represents a constant; The target outlier value is calculated in the following way: score(a)=β×zs_DBSCAN(a)+(1-β)×zs_inflo(a) Among them, β represents the weight parameter; zs_DBSCAN(a) represents the first standard value, and zs_inflo(a) represents the second standard value.

9. A network protocol anomaly detection device, characterized in that: include: A collection module, used for collecting the network protocol data to be tested; A feature extraction module is used to extract features from the network protocol data to be tested to obtain a data set to be tested; A first determination module is used to determine the abnormal points in the test data set and the abnormality degree values ​​corresponding to the abnormal points by using a spatial clustering algorithm, and to determine the local outlier factors corresponding to each data point in the test data set by using a local anomaly detection method; A second determination module is used to determine the target outlier value corresponding to each data point in the test data set according to the outlier degree value and the local outlier factor; An alarm module is used to alarm the network protocol corresponding to the target abnormal value according to the target abnormal value.

10. An electronic device, characterized in that: The electronic device includes a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed by the processor, the method described in any one of claims 1 to 8 is implemented.

Images