Network security anomaly detection method based on isolated forest and KNN

Abstract

The invention provides a network security anomaly detection method based on an isolated forest and a KNN, and the method comprises the steps: firstly obtaining to-be-detected network traffic data, and then calling an isolated forest model to carry out the preliminary detection of the preprocessed network traffic data, and obtaining suspected abnormal data points. Next, a KNN model is called to classify the suspected abnormal data points to obtain abnormal data points, and finally abnormal analysis is carried out on data features of the abnormal data points to determine abnormal categories and abnormal behaviors of the abnormal data points. According to the method, a two-stage detection mechanism of the isolated forest model and the KNN model is adopted, the advantages of the two models are complementary, the accuracy of the detection result and the detection efficiency are improved, and the probability of false alarm and missing alarm is reduced. Moreover, the method can adapt to various different types of network flow data, does not need to depend on a large amount of annotation data, can be widely applied to different network security scenes, and has high generalization capability.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security anomaly detection method based on isolation forest and KNN. Background Art

[0002] With the rapid development of network technology, network security threats are becoming increasingly serious. Various network attacks (such as DDoS attacks, port scanning, malware propagation, etc.) pose a major threat to the security of information systems. Network traffic often contains a large amount of normal data and a small amount of abnormal data, and traditional rule-based detection methods are often unable to cope with complex and dynamic attack patterns and have low generalization capabilities. In addition, when the network size is large, the detection efficiency and accuracy of abnormal data are low. Summary of the invention

[0003] The present invention provides a network security anomaly detection method based on isolation forest and KNN, which is used to solve the defects that the network security anomaly detection method in the prior art cannot cope with complex and dynamic attack modes and has low detection efficiency and accuracy when the data scale is large.

[0004] The present invention provides a network security anomaly detection method based on isolation forest and KNN, the method comprising the following steps: Obtain the network traffic data to be detected; Calling the isolation forest model to perform preliminary detection on the preprocessed network traffic data to obtain suspected abnormal data points; Calling the KNN model to classify the suspected abnormal data points to obtain abnormal data points; Anomaly analysis is performed on the data features of the abnormal data points to determine the abnormal category and abnormal behavior of the abnormal data points.

[0005] In some embodiments, the calling of the isolation forest model to perform preliminary detection on the preprocessed network traffic data to obtain suspected abnormal data points includes: Multiple isolated trees in the isolation forest model are used to make decisions for each data point to be detected in the preprocessed network traffic data, and the corresponding isolation score is obtained; When the isolation score is greater than a preset score threshold, the data point to be detected is determined as a suspected abnormal data point.

[0006] In some embodiments, calling the KNN model to classify the suspected abnormal data points to obtain abnormal data points includes: Determine the value of K in the KNN model; For each suspected abnormal data point to be classified, calculate the similarity between the suspected abnormal data point to be classified and other data points, where the similarity is a normalized Euclidean distance weighted by information entropy; Select K suspected abnormal data points with the smallest normalized Euclidean distance from other data points; If the category of the suspected abnormal data point to be classified is the category with the smallest category quantity ratio among the K suspected abnormal data points, then the suspected abnormal data point to be classified is determined to be an abnormal data point.

[0007] In some embodiments, the number of isolated trees in the isolation forest model is obtained through training with network traffic data samples, and the training method of the isolation forest model adopts an incremental learning method.

[0008] In some embodiments, the value of K in the KNN model is obtained by training with samples of suspected abnormal data points, and the samples of suspected abnormal data points are obtained by screening network traffic data samples by calling a pre-trained isolation forest model, and the training method of the isolation forest model adopts an incremental learning method.

[0009] In some embodiments, after obtaining the network traffic data to be detected, the method further includes: Extracting data features of the network traffic data to be detected; Performing a preprocessing operation on the network traffic data to be detected according to the data characteristics to obtain preprocessed network traffic data; The data features include at least one of the following: Network IP address; Network port number; Network protocol type; Network traffic volume; Request frequency; The performing of a preprocessing operation on the network traffic data to be detected according to the data characteristics comprises: When the network traffic data to be detected meets one of the following screening conditions, the network traffic data to be detected is screened out: There are missing values ​​in the data features; there are outliers in the data features; the data format of the data features is incorrect; there is noise in the data features.

[0010] The present invention also provides a network security anomaly detection device based on isolation forest and KNN, the device includes the following modules: An acquisition module, used to acquire network traffic data to be detected; A detection module, used for calling an isolation forest model to perform preliminary detection on the preprocessed network traffic data to obtain suspected abnormal data points; A classification module is used to call the KNN model to classify the suspected abnormal data points to obtain abnormal data points; The determination module is used to perform anomaly analysis on the data features of the abnormal data points to determine the abnormal category and abnormal behavior of the abnormal data points.

[0011] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a network security anomaly detection method based on isolation forest and KNN as described above is implemented.

[0012] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the network security anomaly detection method based on isolation forest and KNN as described in any one of the above is implemented.

[0013] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned network security anomaly detection methods based on isolation forest and KNN.

[0014] The network security anomaly detection method based on isolation forest and KNN provided by the present invention performs preliminary detection on network traffic data through isolation forest. Isolation forest has low computational complexity, is suitable for processing large-scale network data, can quickly identify abnormal points in the data, and greatly improves the detection efficiency. The KNN model is then used as an auxiliary precision tool to accurately classify the abnormal points after preliminary screening, further improving the accuracy of the detection results and reducing the probability of false positives and false negatives. In addition, the method is adaptable to a variety of different types of network traffic data without relying on a large amount of labeled data, and can be widely used in different network security scenarios to cope with various complex and dynamic attack modes, with high generalization capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a flow chart of the network security anomaly detection method based on isolation forest and KNN provided by the present invention.

[0017] Figure 2 It is a principle framework diagram of the network security anomaly detection method based on isolation forest and KNN provided by the present invention.

[0018] Figure 3It is a structural schematic diagram of a network security anomaly detection device based on isolation forest and KNN provided by the present invention.

[0019] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] The network security anomaly detection method based on isolation forest and KNN provided by the present invention can be applied to the server or terminal of the network security protection system to assist the network security protection system in network security monitoring. When the network security protection system monitors network traffic in real time, the method can obtain the collected network traffic data in real time, automatically perform network security anomaly detection, and finally determine the category and behavior of the abnormal data, and feed it back to the network security protection system to provide decision support for network security incident response.

[0022] The following describes the network security anomaly detection method based on isolation forest and KNN of the present invention in conjunction with the accompanying drawings. Figure 1 : is a flow chart of the network security anomaly detection method based on isolation forest and KNN provided by the present invention, such as Figure 1 As shown, the method includes the following steps 101 to 104, which are described one by one below.

[0023] Step 101: Obtain network traffic data to be detected.

[0024] like Figure 2 When the network security protection system monitors network traffic in real time, it obtains the network traffic data to be detected by collecting the corresponding number of traffic data packets. The network traffic data has multiple data features, and each data feature may cause security risks. The data features include at least one of the following: network IP address; network port number; network protocol type; network traffic size; request frequency. These data features are all features that are prone to cause network security problems. Of course, there are other data features, such as request type, specific request data, etc., which are not limited in the embodiments of the present invention.

[0025] like Figure 2As shown, in order to facilitate the use of the detection model to uniformly detect the network traffic data, the embodiment of the present invention also standardizes the network traffic data to be detected. First, the data features of the network traffic data to be detected are extracted, and then a preprocessing operation is performed on the network traffic data to be detected according to the data features to obtain the preprocessed network traffic data.

[0026] The preprocessing operation here refers to the data cleaning process, including: when the network traffic data to be detected meets one of the screening conditions, the network traffic data to be detected is screened out. Of course, screening out does not necessarily mean skipping the detection of the network traffic data directly, but performing other detection processing, depending on the situation. The screening conditions specifically include: missing values ​​in the data features; abnormal values ​​in the data features; incorrect data format of the data features; noise in the data features.

[0027] If there are missing values ​​in the data features, it means that some of the network traffic data to be tested cannot extract data features, resulting in missing items. This type of network traffic data may have its own protection mechanism or shell mechanism, which makes it impossible to extract some data features. Therefore, it is not possible to skip the detection of this type of network traffic data directly. It is necessary to perform additional detection processing, perform unified detection processing after shelling or removing the protection mechanism, or directly fill the missing values ​​with the median, scale the data to the same range, or standardize with zero mean and unit variance.

[0028] However, if there are abnormal values ​​in the data features, the data format of the data features is incorrect, there is noise in the data features, such as values ​​outside the reasonable range of the data items, the counting units or data formats of the data features do not meet the specifications, and there are some noise data in the data that are irrelevant to the features themselves. These are anomalies in the data features themselves or in the feature extraction process, which make the data features unusable for classification. These network traffic data to be detected can be directly screened out, that is, excluded from this anomaly detection.

[0029] In the embodiment of the present invention, after obtaining the network traffic data to be detected, multiple data features are extracted and then preprocessed, which can effectively combine the characteristic properties of the data itself to realize network security anomaly detection and cope with a variety of complex or dynamic network abnormal behaviors. The effectiveness of the detection is guaranteed. In addition, the preprocessing of the data features also ensures the effective operation of the subsequent detection model recognition process.

[0030] Step 102: Call the isolation forest model to perform preliminary detection on the preprocessed network traffic data to obtain suspected abnormal data points.

[0031] Since a large amount of network traffic data is collected in real time in the network security protection system, in order to quickly identify possible abnormal data points from the large amount of data. Figure 2 As shown, after data standardization, the embodiment of the present invention uses the isolation forest model to quickly screen the data, and calls the isolation forest model to perform preliminary detection on the pre-processed network traffic data to obtain suspected abnormal data points.

[0032] Specifically, multiple isolated trees in the isolation forest model are used to generate decisions for each data point to be detected in the preprocessed network traffic data to obtain the corresponding isolation score. Isolation forest can construct isolation trees, which are essentially a decision tree. For the preprocessed network traffic data, the corresponding feature set is selected as the data point to be detected, such as data features such as IP address, port number, and protocol type. Each decision tree "isolates" each data point to be detected by randomly selecting data features and randomly selecting split values. The purpose of the decision tree is to "isolate" the data points to be detected. Isolated data points require less random splits, while normal data points require more splits.

[0033] By making decisions for each data point to be detected through the isolation tree, a corresponding isolation score will be obtained to characterize the degree of isolation of the data point to be detected. A score threshold T is preset here. For each data point to be detected, the corresponding isolation score is calculated by the isolation forest model, and then a judgment is performed. When the isolation score is greater than the preset score threshold T, the data point to be detected is determined as a suspected abnormal data point. When the isolation score is less than or equal to the preset score threshold T, the data point to be detected is determined as a normal data point. Figure 2 As shown in , after isolating each data point to be detected through multiple isolation trees, possible abnormal data sets can be quickly detected. After screening, suspected abnormal data points and normal data points can be used as positive samples and negative samples for isolation forest model training respectively.

[0034] Since the isolation forest model can quickly and efficiently identify isolated points from a large amount of network traffic data and thus determine them as suspected abnormal data points, potential abnormal network security behaviors can be discovered in a timely manner during security testing.

[0035] However, the detection effect of the isolation forest model depends on the number of isolated trees. How to select the appropriate number of isolated trees is the key to the detection effect, which requires the training of the isolation forest model. In addition, the detection effect of the isolation forest model also depends on the size of the input sample set, which can be adjusted in the actual detection process. The number of isolated trees in the isolation forest model is obtained after training with network traffic data samples.

[0036] The training process can be pre-trained during security anomaly detection. By collecting historical network traffic data samples (including positive and negative samples), an isolation forest model is pre-trained to determine the number of isolated trees. However, such an isolation forest model cannot adapt to changes in the network environment, because network traffic data is constantly updated, and abnormal network attack patterns are also updated, so the pre-trained model has limitations.

[0037] Based on this, the training method of the isolation forest model in the embodiment of the present invention adopts an incremental learning method. By regularly updating the network traffic data sample set, the isolation forest model is incrementally learned, and the model is continuously updated and optimized so that it can adapt to changes in the network environment. Each time new network traffic data is added, after screening out suspected abnormal data points and normal data points, they can be used as positive samples and negative samples for training, respectively, to timely train the model, regularly update the number of isolated trees in the model, and optimize the model performance.

[0038] In the embodiment of the present invention, when there is a large amount of network security data to be detected, calling the isolation forest model can quickly identify possible abnormal data points from the large amount of data, eliminate a large number of normal data points, reduce subsequent calculation pressure, and lay the foundation for the subsequent model to perform accurate classification detection.

[0039] Step 103: Call the KNN model to classify the suspected abnormal data points to obtain abnormal data points.

[0040] After calling the isolation forest model in step 102 to quickly screen out a large number of suspected abnormal data points from a large amount of network traffic data to be detected, the embodiment of the present invention calls the KNN model to further verify the suspected abnormal data points to achieve accurate classification of the suspected abnormal data points. The following is a detailed description.

[0041] First, determine the value of K in the KNN model. The K value refers to the number of neighboring points in the model. The selection of the K value can greatly affect the classification effect. The following is a detailed explanation.

[0042] For each suspected abnormal data point to be classified, the similarity between the suspected abnormal data point to be classified and other data points is calculated. The similarity is the normalized Euclidean distance weighted by information entropy. The smaller the normalized Euclidean distance, the higher the similarity. Therefore, K suspected abnormal data points with the smallest normalized Euclidean distance are selected from other data points, that is, the K neighbors with the closest Euclidean distance to the suspected abnormal data point to be classified are found. Then, according to the principle of minority obeys majority, if the category of the suspected abnormal data point to be classified is the category with the smallest number of categories among the K suspected abnormal data points, the suspected abnormal data point to be classified is determined to be an abnormal data point. This abnormal data point is the abnormal data point identified by both the isolation forest model and the KNN model.

[0043] like Figure 2 As shown in the figure, the isolation forest model screens out a large number of suspected abnormal data points, and the KNN model can be constructed to further screen and verify the possible abnormal data set. By performing the distance calculation of the neighboring points, the data points are eventually marked as abnormal data points by both the isolation forest and KNN. These abnormal data can be used as negative samples for KNN model training.

[0044] In the process of KNN model classification, if the category of the suspected abnormal data point to be classified is the category with the largest number of categories among the K suspected abnormal data points, it means that the suspected abnormal data point to be classified is not necessarily an abnormal data point, and it also means that the recognition results of the isolation forest model and the KNN model are inconsistent, and there may be a possibility of false alarm. In this case, the suspected abnormal data point to be classified needs to be further manually reviewed, or it can be screened again through the isolation forest model or other classification algorithms.

[0045] The classification effect of the KNN model also depends on the value of K in the KNN model. The value of K is determined by cross-validation, that is, the value of K in the KNN model is obtained after training with samples of suspected abnormal data points. The samples of suspected abnormal data points are obtained by screening from network traffic data samples by calling the pre-trained isolation forest model, and the training method of the isolation forest model also adopts the incremental learning method.

[0046] The training process can also be pre-training, by collecting historical network traffic data samples (including positive samples and negative samples, negative samples can be abnormal data points obtained by historical classification of the KNN model), and then calling the pre-trained isolation forest model to screen the network traffic data samples one by one, and obtain suspected abnormal data point samples to train the KNN model, and predict the most appropriate K value through cross-validation. Similarly, such a KNN model cannot adapt to changes in the network environment, because network traffic data is constantly updated, and abnormal network attack patterns are also updated, so the pre-trained model has limitations.

[0047] Based on this, the training method of the KNN model in the embodiment of the present invention also adopts the incremental learning method. By regularly updating the network traffic data sample set, the KNN model is incrementally learned, and the model is continuously updated and optimized so that it can adapt to changes in the network environment. After each new network traffic data is added to identify abnormal data points, the abnormal data points are used to train the model in time, and the value of K in the model is regularly updated to optimize the model performance.

[0048] In the embodiment of the present invention, based on the initial detection of the isolation forest model, the KNN model is used as an auxiliary refinement tool, which can accurately classify the abnormal points after preliminary screening. Through the complementarity of the two models, the probability of false positives and false negatives is reduced, and the accuracy of the detection results is further improved.

[0049] The isolation forest model and the KNN model can be trained separately or simultaneously. The two training methods have their own advantages and disadvantages. The difficulty of separate training is relatively low, but the fitting process of the two models is poor and cannot be accurately connected. The difficulty of simultaneous training is relatively high, but it can be seamlessly connected and the training effect is good. In the embodiment of the present invention, it is intended to create a two-stage detection method of an isolation forest model and a KNN model to realize network security anomaly detection. Because the two isolation forest models and the KNN model are strictly serially connected, they cannot be separated and detected independently, otherwise the detection accuracy will be seriously affected. Therefore, the embodiment of the present invention chooses to train the isolation forest model and the KNN model at the same time, and still adopts the incremental learning method to regularly update the network traffic data sample set, and then train the isolation forest model and the KNN model at the same time, and update the number of isolated trees and the K value at the same time, and train the two models as a whole to improve the classification detection accuracy of the two-stage model.

[0050] Step 104: Perform an abnormal analysis on the data features of the abnormal data points to determine the abnormal categories and abnormal behaviors of the abnormal data points.

[0051] After two-stage detection using the isolation forest model and the KNN model, abnormal data points are screened out from the network traffic data to be detected, and anomaly analysis is performed on the data features of the abnormal data points to determine the abnormal categories and abnormal behaviors of the abnormal data points.

[0052] First, extract the data features of these abnormal data points, such as network IP address, network port number, network protocol type, network traffic size, request frequency, etc. Then perform anomaly analysis on these data features to determine which type of data features are abnormal, and then determine the abnormal category and abnormal behavior. For example, if the network traffic size and request frequency are abnormal, it may be traffic abnormality or request abnormality, and the abnormal behavior may be a DDoS attack. If the network port number is abnormal, it may be a port abnormality, and the abnormal behavior may be a port scan.

[0053] When abnormal categories and abnormal behaviors are determined, the automatic protection system can be notified or an alarm can be automatically triggered directly, and manual investigation or response can be carried out.

[0054] The embodiment of the present invention adopts a two-stage detection mechanism of an isolation forest model and a KNN model, and performs preliminary detection on network traffic data through an isolation forest. The isolation forest has a low computational complexity, is suitable for processing large-scale network data, and can quickly identify anomalies in the data, greatly improving the detection efficiency. The KNN model is then used as an auxiliary precision tool to accurately classify the anomalies after preliminary screening. The two models complement each other, further improving the accuracy of the detection results and reducing the probability of false positives and false negatives. In addition, this method is suitable for a variety of different types of network traffic data without relying on a large amount of labeled data, and can be widely used in different network security scenarios with high generalization capabilities.

[0055] The following is a description of the network security anomaly detection device based on isolation forest and KNN provided by the present invention. The network security anomaly detection device based on isolation forest and KNN described below and the network security anomaly detection method based on isolation forest and KNN described above can be referenced to each other.

[0056] like Figure 3 As shown, the network security anomaly detection device based on isolation forest and KNN includes: an acquisition module 301, a detection module 302, a classification module 303, and a determination module 304. Among them, the acquisition module 301 is used to acquire the network traffic data to be detected; the detection module 302 is used to call the isolation forest model to perform preliminary detection on the pre-processed network traffic data to obtain suspected abnormal data points; the classification module 303 is used to call the KNN model to classify the suspected abnormal data points to obtain abnormal data points; the determination module 304 is used to perform abnormal analysis on the data features of the abnormal data points to determine the abnormal category and abnormal behavior of the abnormal data points.

[0057] It should be noted that the beneficial effects of the network security anomaly detection device based on isolation forest and KNN here and the network security anomaly detection method based on isolation forest and KNN mentioned above can correspond to each other, so the beneficial effects of the network security anomaly detection device based on isolation forest and KNN are not repeated here.

[0058] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the network security anomaly detection method based on the isolation forest and KNN, the method comprising: obtaining the network traffic data to be detected; calling the isolation forest model to perform preliminary detection on the pre-processed network traffic data to obtain suspected abnormal data points; calling the KNN model to classify the suspected abnormal data points to obtain abnormal data points; performing abnormal analysis on the data features of the abnormal data points to determine the abnormal category and abnormal behavior of the abnormal data points.

[0059] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0060] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network security anomaly detection method based on isolation forest and KNN provided by the above methods. The method includes: obtaining network traffic data to be detected; calling the isolation forest model to perform preliminary detection on the pre-processed network traffic data to obtain suspected abnormal data points; calling the KNN model to classify the suspected abnormal data points to obtain abnormal data points; performing abnormal analysis on the data features of the abnormal data points to determine the abnormal category and abnormal behavior of the abnormal data points.

[0061] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the network security anomaly detection method based on isolation forest and KNN provided by the above-mentioned methods, the method comprising: obtaining network traffic data to be detected; calling the isolation forest model to perform preliminary detection on the preprocessed network traffic data to obtain suspected abnormal data points; calling the KNN model to classify the suspected abnormal data points to obtain abnormal data points; performing abnormal analysis on the data features of the abnormal data points to determine the abnormal category and abnormal behavior of the abnormal data points.

[0062] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0063] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0064] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security anomaly detection method based on isolation forest and KNN, characterized in that: The method comprises: Obtain the network traffic data to be detected; Calling the isolation forest model to perform preliminary detection on the preprocessed network traffic data to obtain suspected abnormal data points; Calling the KNN model to classify the suspected abnormal data points to obtain abnormal data points; Anomaly analysis is performed on the data features of the abnormal data points to determine the abnormal category and abnormal behavior of the abnormal data points.

2. The network security anomaly detection method based on isolation forest and KNN according to claim 1 is characterized in that: The calling of the isolation forest model to perform preliminary detection on the pre-processed network traffic data to obtain suspected abnormal data points includes: Multiple isolated trees in the isolation forest model are used to make decisions for each data point to be detected in the preprocessed network traffic data, and the corresponding isolation score is obtained; When the isolation score is greater than a preset score threshold, the data point to be detected is determined as a suspected abnormal data point.

3. The network security anomaly detection method based on isolation forest and KNN according to claim 1 is characterized in that: The calling of the KNN model to classify the suspected abnormal data points to obtain abnormal data points includes: Determine the value of K in the KNN model; For each suspected abnormal data point to be classified, calculate the similarity between the suspected abnormal data point to be classified and other data points, where the similarity is a normalized Euclidean distance weighted by information entropy; Select K suspected abnormal data points with the smallest normalized Euclidean distance from other data points; If the category of the suspected abnormal data point to be classified is the category with the smallest category quantity ratio among the K suspected abnormal data points, then the suspected abnormal data point to be classified is determined to be an abnormal data point.

4. The network security anomaly detection method based on isolation forest and KNN according to claim 1 is characterized in that: The number of isolated trees in the isolation forest model is obtained after training with network traffic data samples, and the training method of the isolation forest model adopts an incremental learning method.

5. The network security anomaly detection method based on isolation forest and KNN according to claim 3 is characterized in that: The value of K in the KNN model is obtained by training with samples of suspected abnormal data points, and the samples of suspected abnormal data points are screened from network traffic data samples by calling a pre-trained isolation forest model. The training method of the isolation forest model adopts an incremental learning method.

6. The network security anomaly detection method based on isolation forest and KNN according to claim 1 is characterized in that: After obtaining the network traffic data to be detected, the method further includes: Extracting data features of the network traffic data to be detected; Performing a preprocessing operation on the network traffic data to be detected according to the data characteristics to obtain preprocessed network traffic data; The data features include at least one of the following: Network IP address; Network port number; Network protocol type; Network traffic volume; Request frequency; The performing of a preprocessing operation on the network traffic data to be detected according to the data characteristics comprises: When the network traffic data to be detected meets one of the following screening conditions, the network traffic data to be detected is screened out: There are missing values ​​in the data features; there are outliers in the data features; the data format of the data features is incorrect; there is noise in the data features.

7. A network security anomaly detection device based on isolation forest and KNN, characterized in that: The device comprises: An acquisition module, used to acquire network traffic data to be detected; A detection module, used for calling an isolation forest model to perform preliminary detection on the preprocessed network traffic data to obtain suspected abnormal data points; A classification module is used to call the KNN model to classify the suspected abnormal data points to obtain abnormal data points; The determination module is used to perform anomaly analysis on the data features of the abnormal data points to determine the abnormal category and abnormal behavior of the abnormal data points.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the network security anomaly detection method based on isolation forest and KNN as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network security anomaly detection method based on isolation forest and KNN as claimed in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the network security anomaly detection method based on isolation forest and KNN as claimed in any one of claims 1 to 6 is implemented.

Images