Abnormality detection method and device, storage medium and electronic device
By encoding the IP addresses in the traffic data and inputting the unsupervised learning model for abnormal detection, the problem of supervised detection in the prior art relying on tag data and not fully utilized IP address information is solved, and a higher abnormal detection accuracy is achieved.
Patent Information
- Application Number
- CN202311334692.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-10-16
- Publication Date
- 2025-04-18
AI Technical Summary
In the prior art, supervision and detection rely on tag data and fail to fully utilize communication information of IP addresses, resulting in a decrease in the accuracy of abnormal detection.
By extracting the IP address in the traffic data, encode it to obtain the IP address weight value, and input the traffic data and IP address weight value into the unsupervised learning autoencoder and GMM clustering model for abnormal detection.
It improves the accuracy of abnormal detection, makes full use of the communication information of IP addresses, and reduces the dependence on tag data.
Smart Images
Figure CN119853928A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer network security, and in particular to an anomaly detection method and device, a storage medium, and an electronic device. Background Art
[0002] Most network intrusion detection models are based on supervised learning, which requires a large amount of labeled data and consumes a lot of manpower. In real-world scenarios, normal traffic data far exceeds attack data, and the data distribution is extremely unbalanced. Using supervised learning will cause the classifier to favor data categories with a high proportion, resulting in reduced detection accuracy for attack data.
[0003] Statistical intrusion detection methods in related technologies can be divided into three steps: data preprocessing, feature processing, and model building. Data preprocessing includes data encoding, handling missing values, and normalization to facilitate subsequent feature processing. Feature processing aims to reduce data dimensionality, remove redundant features, and reduce model training time. Finally, the feature-processed data is used for model construction, and the trained model undergoes final evaluation and iterative modification. Furthermore, since most methods use supervised approaches for model selection, they rely on a large number of labeled samples. Furthermore, unbalanced datasets can also reduce the detection rate of anomalous data.
[0004] However, the statistical-based intrusion detection methods in related technologies either directly ignore the IP address feature during feature processing, or simply perform binary encoding or one-hot encoding on the IP address, without fully utilizing the associated information of communication between IPs.
[0005] Currently, no effective solution has been proposed to address the problem in related technologies that supervised detection relies on labeled data and the communication information of IP addresses is not fully utilized. Summary of the Invention
[0006] The main purpose of this application is to provide an anomaly detection method and device, a storage medium, and an electronic device to solve the problem that supervised detection relies on label data and the communication information of the IP address is not fully utilized.
[0007] In order to achieve the above objectives, according to one aspect of the present application, an anomaly detection method is provided for use in a client.
[0008] The anomaly detection method according to the present application includes: extracting IP addresses from traffic data; encoding each IP address to obtain an IP address weight value; inputting the traffic data and the IP address weight value into a preset anomaly detection model, and outputting an anomaly detection result, wherein the preset detection model is an unsupervised learning model.
[0009] Furthermore, encoding each IP address to obtain an IP address weight value includes: encoding each IP address, converting a character type into a numeric type, and obtaining an IP address weight value of each IP address.
[0010] Furthermore, the encoding of each IP address and conversion of the character type into a numerical type includes: determining an initial IR value for each IP address, wherein the initial IR value is 1 / N, and N is the total number of IP addresses; iteratively updating the IR value of each IP address according to a preset calculation method; iteratively updating the preset calculation method until convergence to obtain the IR value corresponding to each IP and use it as the IP address weight value.
[0011] Furthermore, before inputting the traffic data and the IP address weight value into the preset anomaly detection model, it also includes: calculating the correlation between any two features in the traffic data; if the correlation between any two features is greater than a threshold, retaining any one of the features.
[0012] Furthermore, the traffic data and the IP address weight value are input into a preset anomaly detection model, and an anomaly detection result is output, wherein the preset detection model is an unsupervised learning model, including: the preset anomaly detection model includes an autoencoder and a GMM clustering model.
[0013] Furthermore, the preset anomaly detection model is trained and tested in the following manner: the autoencoder is obtained by training with normal sample data, the mean square error of the output value and the input value is calculated as the loss value, and the autoencoder parameters are updated in each iteration until the loss value no longer decreases; the sample to be tested is used as the input of the model, the mean square error of the output and input values is calculated and this value is used as the input of the GMM clustering model, and the clustering result is used as the final output result.
[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an anomaly detection method is provided for use in an anomaly detection server.
[0015] The anomaly detection method according to the present application includes: obtaining IP addresses in traffic data; encoding each IP address to obtain an IP address weight value; based on the traffic data and the IP address weight value, based on a preset anomaly detection model, outputting an anomaly detection result and sending it to the client, wherein the preset detection model is an unsupervised learning model.
[0016] In order to achieve the above-mentioned objective, according to another aspect of the present application, an abnormality detection device is provided.
[0017] The anomaly detection device according to the present application includes: an extraction module for extracting IP addresses from traffic data; an encoding module for encoding each IP address to obtain an IP address weight value; a detection module for inputting the traffic data and the IP address weight value into a preset anomaly detection model and outputting an anomaly detection result, wherein the preset detection model is an unsupervised learning model.
[0018] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned method embodiments when running.
[0019] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above-mentioned method embodiments.
[0020] In the embodiments of the present application, the anomaly detection method and device, storage medium, and electronic device adopt a method of extracting IP addresses from traffic data, and obtain an IP address weight value by encoding each IP address, thereby achieving the purpose of inputting the traffic data and the IP address weight value into a preset anomaly detection model and outputting an anomaly detection result, thereby achieving the technical effect of improving the accuracy of anomaly detection and making full use of IP address information, and further solving the technical problem that supervised detection relies on label data and the communication information of the IP address is not fully utilized. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] The drawings that constitute part of this application are used to provide a further understanding of this application and make other features, objects and advantages of this application more apparent. The illustrative embodiment drawings of this application and their descriptions are used to explain this application and do not constitute an improper limitation of this application. In the drawings:
[0022] Figure 1 Schematic diagram of the hardware structure of the abnormality detection method according to an embodiment of the present application;
[0023] Figure 2 is a flowchart of an anomaly detection method according to an embodiment of the present application;
[0024] Figure 3 2 is a schematic diagram of the structure of an anomaly detection device according to an embodiment of the present application. DETAILED DESCRIPTION
[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.
[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0027] In this application, terms such as "upper," "lower," "left," "right," "front," "back," "top," "bottom," "inner," "outer," "center," "vertical," "horizontal," "transverse," and "longitudinal" indicate positions or locations based on the positions or locations shown in the accompanying drawings. These terms are primarily intended to better describe this application and its embodiments and are not intended to limit the devices, elements, or components indicated to having a specific orientation, or to being constructed or operated in a specific orientation.
[0028] Furthermore, some of the above terms may be used to express other meanings besides indicating a position or location. For example, the term "on" may also be used to indicate a dependency or connection in certain circumstances. Those skilled in the art will understand the specific meanings of these terms in this application based on the specific circumstances.
[0029] Furthermore, the terms "installed," "disposed," "provided with," "connected," "connected," and "socketed" should be interpreted broadly. For example, they can refer to fixed connections, removable connections, or integral structures; mechanical connections or electrical connections; direct connections, indirect connections through an intermediary, or internal communication between two devices, elements, or components. Those skilled in the art will understand the specific meanings of these terms in this application based on the specific circumstances.
[0030] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0031] During their research, the inventors discovered that related technologies use an autoencoder-based anomaly detection. This method uses an autoencoder for anomaly detection. First, bidirectional flow features are generated from the raw traffic data. Then, features with high correlation are removed. Normal data is used to train the autoencoder and construct an anomaly detection model.
[0032] However, there is still at least one of the following defects in the related art:
[0033] 1) Most intrusion detection models use supervised models. Supervised models require large amounts of labeled data and are labor-intensive. Furthermore, data distribution in real-world scenarios is highly uneven, with normal data far outnumbering abnormal data. Unbalanced datasets can cause supervised anomaly detection models to favor classes with a high proportion during training, resulting in low accuracy for classes with a low proportion.
[0034] 2) During data preprocessing, IP addresses are either ignored or simply encoded, without fully mining the information in the IP communication process.
[0035] 3) Some intrusion detection models that use autoencoders require manual threshold setting. If the threshold is set too high, the false alarm rate will increase, and if the threshold is set too low, the false alarm rate will increase.
[0036] Based on the above defects, this application uses an unsupervised autoencoder combined with a clustering algorithm as an anomaly detection model to avoid manually setting thresholds and at the same time use the PageRank web page ranking algorithm to encode IP addresses and fully mine IP address communication information.
[0037] like Figure 1 The figure shows a schematic diagram of the hardware structure of the anomaly detection method according to the embodiment of the present application, which includes: a client 103, traffic data 102 and a server 101. The anomaly detection method in the embodiment of the present application can be used for the client or the server. Generally speaking, the statistical intrusion detection method can be divided into three steps: traffic data 102 preprocessing, traffic data 102 feature processing, and model construction. Data preprocessing includes data encoding, processing missing values, normalization, etc., to facilitate the subsequent feature processing process. The purpose of feature processing is to reduce the data dimension, remove redundant features, and reduce the time for training the model. Finally, the data after feature processing is used for model construction, and the trained model is finally evaluated and iteratively modified on the client 103 or the server 101.
[0038] like Figure 2As shown, the method includes the following steps S201 to S203:
[0039] Step S201, extracting IP addresses from traffic data;
[0040] Step S202: Encode each IP address to obtain an IP address weight value;
[0041] Step S203: input the traffic data and the IP address weight value into a preset anomaly detection model, and output an anomaly detection result, wherein the preset detection model is an unsupervised learning model.
[0042] From the above description, it can be seen that this application achieves the following technical effects:
[0043] By extracting IP addresses from traffic data and encoding each IP address, an IP address weight value is obtained, thereby achieving the purpose of inputting the traffic data and the IP address weight value into a preset anomaly detection model and outputting anomaly detection results, thereby achieving the technical effect of improving the accuracy of anomaly detection and making full use of IP address information, and further solving the technical problem that supervised detection relies on label data and the communication information of IP addresses is not fully utilized.
[0044] In step S201, the IP addresses in the traffic data are extracted. Typically, during data preprocessing, IP addresses are either ignored or simply encoded, without fully exploiting the information in the IP communication process. The IP addresses in the traffic data are then used for the next step of processing.
[0045] As an optional implementation manner, association information of communications between each of the IP addresses.
[0046] As an optional implementation method, the IP address is encoded based on the PageRank web page ranking algorithm.
[0047] In the above step S202, each IP address is encoded to obtain an IP address weight value. Specifically, each IP address is encoded, and the character type is converted into a numeric type to obtain the IP address weight value of each IP address.
[0048] After encoding, it is convenient to build the subsequent anomaly detection model. The process is as follows:
[0049] Initialize an IR value for each IP address. The initial value is 1 / N, where N is the total number of IP addresses.
[0050] Iterate and update the IR value of each IP address according to formula (1), where E represents the incoming neighbor set of vertex i, O jIt represents the out-degree of vertex j, and d is an adjustable parameter to adjust the weight value in the propagation process. Formula (1) is used to iterate and update continuously until convergence. The value of IR corresponding to each IP is the weight of the IP address.
[0051]
[0052] In the above step S203, the traffic data and the IP address weight value are input into a preset anomaly detection model, and an anomaly detection result is output, wherein the preset detection model is an unsupervised learning model.
[0053] The preset anomaly detection model includes an autoencoder and a GMM clustering model.
[0054] It can be understood that the use of unsupervised learning based on autoencoders and GMM clustering models reduces the cost of label data and avoids the low accuracy of minority class detection caused by data imbalance.
[0055] As a preference in this embodiment, before inputting the traffic data and the IP address weight value into the preset anomaly detection model, it also includes: calculating the correlation between any two features in the traffic data; if the correlation between any two features is greater than a threshold, retaining any one of the features.
[0056] In specific implementation, for feature processing, the correlation between each feature and other features is calculated. If the correlation between two features is greater than a threshold, only one of the features is retained. This method can remove redundant features and improve the efficiency of the intrusion detection model.
[0057] As a preference in this embodiment, the preset anomaly detection model is trained and tested in the following manner: the autoencoder is obtained by training with normal sample data, the mean square error of the output value and the input value is calculated as the loss value, and the autoencoder parameters are updated each iteration until the loss value no longer decreases; the sample to be tested is used as the input of the model, the mean square error of the output and input values is calculated and the value is used as the input of the GMM clustering model, and the clustering result is used as the final output result.
[0058] In practice, the anomaly detection model is constructed using an autoencoder combined with a GMM clustering algorithm. This avoids the drawback of manually setting thresholds for autoencoders used for anomaly detection. The anomaly model construction involves two steps: training and testing. During the training process, the autoencoder is trained using normal samples, calculating the mean squared error (MSE) between the output and input values as the loss value. The autoencoder parameters are updated with each iteration until the loss value no longer decreases. During the detection process, the test sample is used as the model input, and the mean squared error (MSE) between the output and input values is calculated. This value is then used as the input for the GMM clustering model, and the clustering result is the final output.
[0059] According to an embodiment of the present application, there is also provided an anomaly detection method for an anomaly detection server, the method comprising:
[0060] Get the IP address in the traffic data;
[0061] Encode each IP address to obtain the IP address weight value;
[0062] According to the traffic data and the IP address weight value, based on a preset anomaly detection model, an anomaly detection result is output and sent to the client, wherein the preset detection model is an unsupervised learning model.
[0063] In some embodiments, encoding each IP address to obtain an IP address weight value includes:
[0064] Each IP address is encoded, and the character type is converted into a numeric type to obtain the IP address weight value of each IP address.
[0065] In some embodiments, encoding each IP address to convert a character type into a numeric type includes:
[0066] Determine the initial IR value for each IP address, where the initial IR value is 1 / N, where N is the total number of IP addresses;
[0067] Iteratively updating the IR value of each IP address according to a preset calculation method;
[0068] The preset calculation method is iteratively updated until convergence, and the IR value corresponding to each IP is obtained and used as the IP address weight value.
[0069] In some embodiments, before inputting the traffic data and the IP address weight value into a preset anomaly detection model, the method further includes:
[0070] Calculating the correlation between any two features in the traffic data;
[0071] If the correlation between two features is greater than a threshold, either feature is retained.
[0072] In some embodiments, the traffic data and the IP address weight value are input into a preset anomaly detection model to output an anomaly detection result, wherein the preset detection model is an unsupervised learning model, including:
[0073] The preset anomaly detection model includes an autoencoder and a GMM clustering model.
[0074] In some embodiments, the preset anomaly detection model is trained and tested as follows:
[0075] The autoencoder is obtained by training using normal sample data, the mean square error between the output value and the input value is calculated as the loss value, and the autoencoder parameters are updated each iteration until the loss value no longer decreases;
[0076] The sample to be tested is used as the input of the model, and the mean square error between the output and the input value is calculated. This value is used as the input of the GMM clustering model, and the clustering result is used as the final output result.
[0077] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0078] According to an embodiment of the present application, an abnormality detection device for implementing the above method is also provided, such as Figure 3 As shown, the device includes:
[0079] Extraction module 301, used to extract IP addresses from traffic data;
[0080] The encoding module 302 is used to encode each IP address to obtain an IP address weight value;
[0081] The detection module 303 is used to input the traffic data and the IP address weight value into a preset anomaly detection model and output an anomaly detection result, wherein the preset detection model is an unsupervised learning model.
[0082] The extraction module 301 of the present embodiment extracts IP addresses from traffic data. Typically, during data preprocessing, IP addresses are either ignored or simply encoded, failing to fully exploit the information contained in the IP communication process. The IP addresses obtained from the traffic data are used for further processing.
[0083] As an optional implementation, the association information communicated between each of the IP addresses,
[0084] As an optional implementation method, the IP address is encoded based on the PageRank web page ranking algorithm.
[0085] Specifically, in the encoding module 302 of the embodiment of the present application, each IP address is encoded, and the character type is converted into a numeric type to obtain the IP address weight value of each IP address.
[0086] After encoding, it is convenient to build the subsequent anomaly detection model. The process is as follows:
[0087] Initialize an IR value for each IP address. The initial value is 1 / N, where N is the total number of IP addresses.
[0088] Iterate and update the IR value of each IP address according to formula (1), where E represents the incoming neighbor set of vertex i, O j It represents the out-degree of vertex j, and d is an adjustable parameter to adjust the weight value in the propagation process. Formula (1) is used to iterate and update continuously until convergence. The value of IR corresponding to each IP is the weight of the IP address.
[0089]
[0090] In the detection module 303 of the embodiment of the present application, the traffic data and the IP address weight value are input into a preset anomaly detection model, and an anomaly detection result is output, wherein the preset detection model is an unsupervised learning model.
[0091] The preset anomaly detection model includes an autoencoder and a GMM clustering model.
[0092] It can be understood that the use of unsupervised learning based on autoencoders and GMM clustering models reduces the cost of label data and avoids the low accuracy of minority class detection caused by data imbalance.
[0093] Obviously, those skilled in the art should understand that the modules or steps of the present application described above can be implemented using a general-purpose computing device. They can be concentrated on a single computing device or distributed across a network consisting of multiple computing devices. Alternatively, they can be implemented using program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.
[0094] In order to better understand the above-mentioned abnormality detection method process, the above-mentioned technical solution is explained below in conjunction with the preferred embodiment, but is not used to limit the technical solution of the embodiment of the present invention.
[0095] In the embodiment of the present application, the anomaly detection method uses an unsupervised autoencoder combined with a clustering algorithm as an anomaly detection model, avoiding manually setting thresholds while drawing on the PageRank web page ranking algorithm to encode IP addresses and fully mine IP address communication information.
[0096] The process of the anomaly detection method specifically includes:
[0097] Step S401: extract the IP address from the traffic data.
[0098] Step S402: Encode each IP address, convert the character type into a numeric type, and obtain the IP address weight value of each IP address.
[0099] Step S403, determine the initial IR value of each IP address, where the initial IR value is 1 / N, and N is the total number of IP addresses; iteratively update the IR value of each IP address according to a preset calculation method; iteratively update until convergence through the preset calculation method, and obtain the IR value corresponding to each IP and use it as the IP address weight value.
[0100] Each IP address is encoded, and the character type is converted into a numeric type to obtain the IP address weight value of each IP address.
[0101] After encoding, it is convenient to build the subsequent anomaly detection model. The process is as follows:
[0102] Initialize an IR value for each IP address, the initial value is 1 / N, N is the total number of IP addresses, and iteratively update the IR value of each IP address according to formula (1), where E represents the incoming neighbor set of vertex i, O j Represents the out-degree of vertex j, d is an adjustable parameter to adjust the weight value during the propagation process
[0103] Use formula (1) to iterate and update continuously until convergence. The value of IR corresponding to each IP is the weight of the IP address.
[0104]
[0105] Step S404: Calculate the correlation between any two features in the traffic data; if the correlation between any two features is greater than a threshold, retain any one of the features.
[0106] Step S405: input the traffic data and the IP address weight value into a preset anomaly detection model, and output an anomaly detection result, wherein the preset detection model is an unsupervised learning model.
[0107] The anomaly detection model is constructed using an autoencoder combined with a GMM clustering algorithm, avoiding the drawback of manually setting thresholds for autoencoders used for anomaly detection. The anomaly model construction involves two steps: training and testing. During the training process, the autoencoder is trained using normal samples, calculating the mean squared error (MSE) between the output and input values as the loss value. The autoencoder parameters are updated with each iteration until the loss value no longer decreases. During the detection process, the test sample is used as the model input, and the mean squared error (MSE) between the output and input values is calculated. This value is then used as the input for the GMM clustering model, and the clustering result is the final output.
[0108] An embodiment of the present application further provides a storage medium storing a computer program, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.
[0109] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:
[0110] S1, extract IP addresses from traffic data;
[0111] S2, encode each IP address to obtain the IP address weight value;
[0112] S3, inputting the traffic data and the IP address weight value into a preset anomaly detection model, and outputting an anomaly detection result, wherein the preset detection model is an unsupervised learning model.
[0113] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.
[0114] An embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.
[0115] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.
[0116] Optionally, in this embodiment, the processor may be configured to execute the following steps through a computer program:
[0117] S1, extract IP addresses from traffic data;
[0118] S2, encode each IP address to obtain the IP address weight value;
[0119] S3, inputting the traffic data and the IP address weight value into a preset anomaly detection model, and outputting an anomaly detection result, wherein the preset detection model is an unsupervised learning model.
[0120] Optionally, specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.
[0121] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.
Claims
1. An anomaly detection method, characterized in that: For a client, the method comprises: Extract IP addresses from traffic data; Encode each IP address to obtain the IP address weight value; The traffic data and the IP address weight value are input into a preset anomaly detection model, and an anomaly detection result is output, wherein the preset detection model is an unsupervised learning model.
2. The method according to claim 1, characterized in that The step of encoding each IP address to obtain an IP address weight value includes: Each IP address is encoded, and the character type is converted into a numeric type to obtain an IP address weight value of each IP address.
3. The method according to claim 2, characterized in that The encoding of each IP address and conversion of character type into numeric type includes: Determine the initial IR value of each IP address, where the initial IR value is 1 / N, where N is the total number of IP addresses; Iteratively updating the IR value of each IP address according to a preset calculation method; The preset calculation method is iteratively updated until convergence, and the value of the IR corresponding to each IP is obtained and used as the IP address weight value.
4. The method according to claim 1, characterized in that: Before inputting the traffic data and the IP address weight value into a preset anomaly detection model, the method further includes: Calculating the correlation between any two features in the traffic data; If the correlation between two features is greater than a threshold, either feature is retained.
5. The method according to claim 1, characterized in that The flow data and the IP address weight value are input into a preset anomaly detection model, and an anomaly detection result is output, wherein the preset detection model is an unsupervised learning model, including: The preset anomaly detection model includes an autoencoder and a GMM clustering model.
6. The method according to claim 5, characterized in that The preset anomaly detection model is trained and tested in the following manner: The autoencoder is obtained by training with normal sample data, the mean square error between the output value and the input value is calculated as the loss value, and the autoencoder parameters are updated each iteration until the loss value no longer decreases; The sample to be tested is used as the input of the model, and the mean square error between the output and the input value is calculated. This value is used as the input of the GMM clustering model, and the clustering result is used as the final output result.
7. An anomaly detection method, characterized in that: For use in an anomaly detection server, the method comprises: Get the IP address in the traffic data; Encode each IP address to obtain the IP address weight value; According to the traffic data and the IP address weight value, based on a preset anomaly detection model, an anomaly detection result is output and sent to the client, wherein the preset detection model is an unsupervised learning model.
8. An abnormality detection device, characterized in that: For a client, the device comprises: An extraction module, used to extract IP addresses from traffic data; The encoding module is used to encode each IP address to obtain an IP address weight value; The detection module is used to input the traffic data and the IP address weight value into a preset anomaly detection model and output an anomaly detection result, wherein the preset detection model is an unsupervised learning model.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 7 when executed.
10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.