Network abnormal session detection method and system

Abstract

The invention relates to a network abnormal session detection method and system, and the method comprises the steps: marking a session as an existing session if a session starting moment is before a current independent window, otherwise, marking the session as a new session; acquiring features of existing sessions, comparing the features of the existing sessions with features of the same session in other independent windows in the joint window to which the current independent window belongs, and deleting the existing sessions from the current independent window if the features do not change and the sessions are non-abnormal and candidate abnormal sessions in the other independent windows in the joint window; determining an abnormal session and a candidate abnormal session of the current independent window according to the session local abnormal score; taking the joint window as an independent window, and calculating candidate abnormal sessions of the joint window; and obtaining a union set of candidate abnormal sessions of all independent windows in the joint window, and if one session in the union set is a candidate abnormal session or a candidate abnormal session of the joint window in a plurality of independent windows of the joint window, marking the session as an abnormal session.

Description

Technical Field

[0001] The present invention relates to the field of computer networks, and in particular to a method and system for detecting abnormal network sessions. Background Art

[0002] With the rapid development of technologies such as cloud computing, the Internet of Things (IoT), and 5G communications, the network environment has shown the characteristics of high concurrency, large scale, and heterogeneity, which has led to challenges for traditional anomaly detection methods based on rule matching and feature extraction. Existing anomaly detection methods mainly include rule-based intrusion detection such as Snort, statistical analysis-based methods such as time series statistics, anomaly detection based on machine learning, and the deep learning-based methods that have emerged in recent years. However, due to the attackers' constantly changing attack modes and the high-dimensional, strong time series and dynamic changes of traffic data, the existing methods still have shortcomings in detection accuracy, real-time, and computational complexity. For example, rule-based detection methods cannot effectively identify new attacks, statistical-based methods are insensitive to abnormal changes in traffic distribution, and machine learning-based methods are limited by the quality of labeled data and training costs. In recent years, a series of flow data anomaly detection methods have been proposed, including models based on kernel density estimation (KDE), local outlier factor (LOF), and deep learning. However, most methods use a sliding window model for anomaly detection. Although this method can dynamically update streaming data, it will cause a large number of data points to be repeatedly calculated due to data overlap between windows. In addition, for short-term high-frequency attacks and long-term hidden attacks, the existing anomaly detection methods do not perform well for simultaneous detection due to their different attack methods. Summary of the invention

[0003] In order to solve the above problem, a first aspect provides a method for detecting abnormal network sessions, the method comprising the following steps: Obtaining a network session within the existence time of the current independent window, if the start time of the session is before the current independent window, marking the session as an existing session, otherwise, marking the session as a new session; Obtain the features of an existing session and compare them with the features of the same session in other independent windows in the joint window to which the current independent window belongs. If the features have not changed and the session is not an abnormal session or a candidate abnormal session in other independent windows in the joint window, delete the existing session from the current independent window. Determine the abnormal session and candidate abnormal session of the current independent window based on the local abnormal score of the session. The joint window is regarded as an independent window, and candidate abnormal sessions of the joint window are calculated; the union of candidate abnormal sessions of all independent windows in the joint window is obtained, and if a session in the union is a candidate abnormal session in multiple independent windows of the joint window or a candidate abnormal session of the joint window, the session is marked as an abnormal session.

[0004] Optionally, the calculation process of the session local anomaly score is: According to the session features, the sessions of the independent window are mapped to the grid of the data space, the core points of each grid and the local density of each session are calculated, and the grid density corresponding to the independent window is calculated according to the local density of the session in the grid; the local anomaly score of the session is obtained based on the local density of the session and the grid density.

[0005] Optionally, determining the abnormal session and candidate abnormal session of the current independent window according to the local abnormal score of the session is specifically as follows: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The scores of the remaining sessions are calculated according to the grid density of the remaining sessions in the current independent window and the local anomaly scores of the remaining sessions. The remaining sessions are sorted in descending order according to the scores, and the first k sessions after sorting are used as candidate anomaly sessions.

[0006] Optionally, determining the abnormal session and candidate abnormal session of the current independent window according to the local abnormal score of the session is specifically as follows: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The score of the session is calculated according to the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained; If the score of the non-abnormal session is greater than the minimum value, the non-abnormal session is taken as a candidate abnormal session.

[0007] Optionally, the score is calculated as follows: A negative exponential function value of the grid density is calculated, and a weighted sum of the negative exponential function value and the local anomaly score is performed to obtain the score.

[0008] A second aspect provides a network abnormal session detection system, the system comprising the following modules: A data collection module, used to obtain the network session within the existence time of the current independent window, if the session start time is before the current independent window, the session is marked as an existing session, otherwise, the session is marked as a new session; A preliminary identification module is used to obtain the features of an existing session and compare them with the features of the same session in other independent windows in the joint window to which the current independent window belongs. If the features have not changed and the session is not an abnormal session or a candidate abnormal session in other independent windows in the joint window, the existing session is deleted from the current independent window; the abnormal session and candidate abnormal session of the current independent window are determined according to the local abnormal score of the session; The candidate anomaly identification module is used to treat the joint window as an independent window and calculate the candidate anomaly sessions of the joint window; obtain the union of all independent window candidate anomaly sessions in the joint window, and if a session in the union is a candidate anomaly session in multiple independent windows of the joint window or a candidate anomaly session of the joint window, mark the session as an abnormal session.

[0009] Optionally, the calculation process of the session local anomaly score is: According to the session features, the sessions of the independent window are mapped to the grid of the data space, the core points of each grid and the local density of each session are calculated, and the grid density corresponding to the independent window is calculated according to the local density of the session in the grid; the local anomaly score of the session is obtained based on the local density of the session and the grid density.

[0010] Optionally, determining the abnormal session and candidate abnormal session of the current independent window according to the local abnormal score of the session is specifically as follows: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The scores of the remaining sessions are calculated according to the grid density of the remaining sessions in the current independent window and the local anomaly scores of the remaining sessions. The remaining sessions are sorted in descending order according to the scores, and the first k sessions after sorting are used as candidate anomaly sessions.

[0011] Optionally, determining the abnormal session and candidate abnormal session of the current independent window according to the local abnormal score of the session is specifically as follows: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The score of the session is calculated according to the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained; If the score of the non-abnormal session is greater than the minimum value, the non-abnormal session is taken as a candidate abnormal session.

[0012] Optionally, the score is calculated as follows: A negative exponential function value of the grid density is calculated, and a weighted sum of the negative exponential function value and the local anomaly score is performed to obtain the score.

[0013] The network abnormal session detection method provided by the present invention checks the features of an existing session and compares it with the historical features of the same session in a joint window. If the session behavior has not changed and has not been marked as an abnormality or a candidate abnormality before, the session is deleted to avoid repeated calculations in each independent window. A single independent window may misjudge some short-term anomalies, but the joint window can observe the session behavior more comprehensively by performing stacking analysis across multiple independent windows. Moreover, short-term high-frequency attacks such as port scanning, because the attacks usually burst out in a short period of time, the local anomaly score will increase rapidly and will be confirmed in the independent window; long-term covert attacks such as data leakage and low-frequency DDoS, even if a single independent window cannot determine, can be stacked through the joint window to finally identify the anomaly, and it is also applicable to both short-term severe anomalies and long-term latent anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a flow chart of Embodiment 1; Figure 2 It is a schematic diagram of the relationship between the joint window and the independent window; Figure 3 A schematic diagram for determining anomalies from candidate anomalies; Figure 4 It is a structural schematic diagram of Embodiment 2; Figure 5 A schematic diagram of the structure of a computer device. DETAILED DESCRIPTION

[0015] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0016] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] Figure 1 A flow chart of the first embodiment is shown. Figure 1 The network abnormal session detection method shown includes the following steps: S1, obtaining a network session within the existence time of the current independent window, if the start time of the session is before the current independent window, marking the session as an existing session, otherwise, marking the session as a new session; All active network sessions are detected within the time range of the current independent window. If the start time of a session is earlier than the start time of the current independent window, it means that the session already existed in the previous window and is marked as an existing session. On the contrary, if the start time of a session is within the current independent window, it means that it is a new session and is marked as a new session. An independent window is a time period, and relative to a sliding window, there is no overlap between independent windows, that is, two adjacent independent windows do not overlap in time. For example, independent windows IW1 and IW2 are adjacent, then the end time of IW1 is the start time of IW2. In a more specific embodiment, each independent window is an interval that is open on the left and closed on the right, for example (10s, 80s]. The joint window mentioned below is composed of multiple independent windows, and the independent windows in a joint window are continuous in time. There is no overlap between two temporally adjacent joint windows. The relationship between independent windows and joint windows is as follows. Figure 2 shown.

[0018] S2, obtain the features of the existing session and compare them with the features of the same session in other independent windows in the joint window to which the current independent window belongs. If the features have not changed and the session is not an abnormal session or a candidate abnormal session in other independent windows in the joint window, delete the existing session from the current independent window; determine the abnormal session and candidate abnormal session of the current independent window according to the local abnormal score of the session; Existing sessions are sessions that have been started before the current independent window IW, and these sessions may continue across multiple independent windows. For these existing sessions, their key behavior features are extracted, such as the number of packets, traffic size, session duration, traffic direction, packet interval time, source IP and destination IP, etc. The joint window FW is a time interval composed of multiple independent windows. The existing sessions in the current IW are checked, and their features are compared with the features of the same sessions in other IWs in the FW. In one embodiment, the other IW is the IW before the current IW and belongs to the same FW as the current IW. If the features of the session have not changed, that is, the historical behavior is consistent, and the session is not a candidate abnormal session or an abnormal session in other IWs of the FW, that is, it is considered normal in the historical window, for example, the features of session A have not changed, and have never been marked as abnormal or candidate abnormal in the joint window, so it is deleted to reduce unnecessary calculations. The features of session C have changed, or it has been considered an abnormal or candidate abnormal session in the FW, so it needs to continue to be detected.

[0019] After the session is eliminated from the current independent window, anomaly detection is performed on the remaining sessions. In the anomaly detection, the local anomaly scores of the remaining sessions in the current independent window are first calculated, wherein the calculation process of the local anomaly score is: mapping the sessions of the independent window to the grid of the data space according to the session features, calculating the core points of each grid and the local density of each session, calculating the grid density corresponding to the independent window according to the local density of the session in the grid; and obtaining the local anomaly score of the session based on the local density of the session and the grid density.

[0020] The calculation of the local anomaly score first maps the sessions in the independent window to different grids in the data space through the characteristics of the session. Then, the core points are calculated in each grid, and the local density of each session in the grid is estimated. Next, the grid density, that is, the distribution of session density in the grid, is estimated by the local density of all sessions. Specifically, the density of each data point in the grid is estimated to form a grid density GD (Grid Density), and the grid density is recorded using grid density estimation points. The grid density is obtained using grid density estimation points (SDP, Summary Density Points). Finally, based on the local density of the session and the overall density of the grid, the local anomaly score of the session is calculated to measure whether the session is abnormal relative to the grid in which it is located. The core points, local density, grid density estimation, and session anomaly score calculation belong to the existing technology and will not be repeated here. The higher the local anomaly score, the more likely the session is abnormal under the current traffic pattern.

[0021] In an optional embodiment, determining the abnormal session and candidate abnormal session of the current independent window according to the local abnormal score of the session is specifically as follows: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; Get the maximum value of the anomaly score of each independent window session in the joint window, and calculate the average of these maximum values. Then, compare the local anomaly score of the session in the current independent window with the average value. If the local anomaly score of a session in the current independent window is greater than this average value, then this session is considered to be an abnormal session of the current independent window. Assuming that the joint window 1 contains multiple independent windows, for each independent window, find the maximum value of the anomaly scores of all sessions in it, calculate the average value of the maximum anomaly scores of all independent windows, and use this average value as the average anomaly score. For each session in the independent window, if its local anomaly score is greater than the average anomaly score calculated previously, then this session is an abnormal session.

[0022] The scores of the remaining sessions are calculated according to the grid density of the remaining sessions in the current independent window and the local anomaly scores of the remaining sessions. The remaining sessions are sorted in descending order according to the scores, and the first k sessions after sorting are used as candidate anomaly sessions.

[0023] After the abnormal session is determined, the score of the remaining sessions in the independent window is calculated. The score is calculated by combining the grid density of the remaining sessions and the local abnormality score of the remaining sessions. The higher the score, the higher the abnormality of the session. Then, the remaining sessions are sorted in descending order of score, and the first k sessions after sorting are selected as candidate abnormal sessions. k is a pre-set parameter, which is a positive integer, indicating how many candidate sessions are selected. These candidate abnormal sessions may be potential abnormal sessions, which will be further analyzed and processed later.

[0024] In another optional embodiment, determining the abnormal session and candidate abnormal session of the current independent window according to the local abnormality score of the session is specifically as follows: The maximum value of the local anomaly score of the session in each independent window in the joint window is obtained, and the average value of the maximum value is calculated. If the local anomaly score of the session in the current independent window is greater than the average value, the session is used as the abnormal session of the current independent window; as in the previous embodiment, the abnormal session of the independent window is first determined.

[0025] The score of the session is calculated according to the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained; If the score of the non-abnormal session is greater than the minimum value, the non-abnormal session is taken as a candidate abnormal session.

[0026] Get the minimum score of all abnormal sessions in the independent window. For a non-abnormal session in the independent window, if its score is greater than the minimum score of the abnormal session obtained previously, then the non-abnormal session is considered to be a candidate abnormal session. Suppose in an independent window, there are two abnormal sessions with scores of 9 and 8 respectively. Then the minimum score is 8. For a non-abnormal session in the independent window, if its score is greater than 8, then the non-abnormal session is considered to be a candidate abnormal session.

[0027] In an optional embodiment, the score calculation process is: Calculate the negative exponential function value of the grid density, and perform weighted summation of the negative exponential function value and the local anomaly score to obtain the score. Calculate the density of the grid where the session is located, and calculate a negative exponential function value for the grid density. The form of the negative exponential function is generally exp(-βx), where x is the grid density and β is an adjustment parameter. Since the negative exponential function is decreasing, the lower the grid density, the higher the negative exponential function value, and then the grid density is converted into an indicator related to the degree of abnormality. The lower the grid density, the higher the value of the indicator, indicating a greater possibility of abnormality. Perform weighted summation of the negative exponential function value calculated above and the local anomaly score of the session. The local anomaly score indicates the degree of abnormality of the session itself. The higher the score, the more abnormal the session. In this way, the influence of the grid density and the local anomaly score on the degree of abnormality of the session is comprehensively considered. The weight setting is adjusted according to the actual situation. For example, if the local anomaly score is considered to be more important, its weight can be set higher.

[0028] S3, treat the joint window as an independent window, calculate the candidate abnormal sessions of the joint window; obtain the union of all independent window candidate abnormal sessions in the joint window, and if a session in the union is a candidate abnormal session in multiple independent windows of the joint window or a candidate abnormal session of the joint window, mark the session as an abnormal session.

[0029] The entire joint window is considered as a single independent window, and then the previously described method is used to calculate the candidate abnormal sessions and abnormal sessions of the joint window, that is, the score is calculated based on the grid density and the local anomaly score, and the sessions with the highest scores are selected as candidate abnormal sessions. If a session is an abnormal session of the joint window, this session is taken as an abnormal session; if a session is a candidate abnormal session in the joint window, the set of candidate abnormal sessions of all independent windows in the joint window is obtained, and the intersection is taken with the candidate abnormal session of the joint window itself, and the session in the intersection is taken as an abnormal session. At the same time, if a session is a candidate abnormal session in multiple independent windows in the joint window, the session is also marked as an abnormal session.

[0030] For example, the joint window contains three independent windows, namely A, B, and C. The candidate abnormal session of the joint window is {X}, the candidate abnormal session of independent window A is {X, Z}, the candidate abnormal session of independent window B is {Y, W}, and the candidate abnormal session of independent window C is {W}. Session X is a candidate abnormal session in both independent window A and the joint window, so it is marked as an abnormal session. Session W is a candidate abnormal session in both independent windows B and C, so it is marked as an abnormal session. Session Y only exists in independent window B and is not considered an abnormal session. Session Z only exists in independent window A and is not considered an abnormal session. Figure 3 shown.

[0031] Figure 4 The second embodiment is shown. Figure 4 The network abnormal session detection system shown includes the following modules: The data collection module 401 is used to obtain the network session within the existence time of the current independent window. If the start time of the session is before the current independent window, the session is marked as an existing session, otherwise, the session is marked as a new session; The preliminary identification module 402 is used to obtain the features of the existing session and compare them with the features of the same session in other independent windows in the joint window to which the current independent window belongs. If the features have not changed and the session is not an abnormal session or a candidate abnormal session in other independent windows in the joint window, the existing session is deleted from the current independent window; the abnormal session and the candidate abnormal session of the current independent window are determined according to the local abnormality score of the session; The candidate anomaly identification module 403 is used to treat the joint window as an independent window and calculate the candidate abnormal sessions of the joint window; obtain the union of all independent window candidate abnormal sessions in the joint window, and if a session in the union is a candidate abnormal session in multiple independent windows of the joint window or a candidate abnormal session of the joint window, mark the session as an abnormal session.

[0032] Optionally, the calculation process of the session local anomaly score is: According to the session features, the sessions of the independent window are mapped to the grid of the data space, the core points of each grid and the local density of each session are calculated, and the grid density corresponding to the independent window is calculated according to the local density of the session in the grid; the local anomaly score of the session is obtained based on the local density of the session and the grid density.

[0033] Optionally, determining the abnormal session and candidate abnormal session of the current independent window according to the local abnormal score of the session is specifically as follows: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The scores of the remaining sessions are calculated according to the grid density of the remaining sessions in the current independent window and the local anomaly scores of the remaining sessions. The remaining sessions are sorted in descending order according to the scores, and the first k sessions after sorting are used as candidate anomaly sessions.

[0034] Optionally, determining the abnormal session and candidate abnormal session of the current independent window according to the local abnormal score of the session is specifically as follows: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The score of the session is calculated according to the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained; If the score of the non-abnormal session is greater than the minimum value, the non-abnormal session is taken as a candidate abnormal session.

[0035] Optionally, the score is calculated as follows: A negative exponential function value of the grid density is calculated, and a weighted sum of the negative exponential function value and the local anomaly score is performed to obtain the score.

[0036] Through the description of the above implementation methods, technicians in this field can clearly understand that each implementation method can be implemented by adding a necessary general hardware platform, and of course can also be implemented by a combination of hardware and software. Figure 5 A schematic diagram of the structure of a computer device, such as Figure 5 As shown, the computer-readable storage medium stores a computer program that can be run by a processor, and when the computer program is executed by the processor, the method described in Embodiment 1 is implemented. Based on such an understanding, the above technical solution can essentially or contribute to the prior art in the form of a computer product, and the present invention can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0037] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it, and other embodiments may also be used. Although the present invention has been described in detail with reference to the aforementioned embodiments, ordinary technicians in this field should understand that they can still modify the technical solutions recorded in the aforementioned embodiments, or replace some of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting abnormal network sessions, characterized in that: The method comprises the following steps: Obtaining a network session within the existence time of the current independent window, if the start time of the session is before the current independent window, marking the session as an existing session, otherwise, marking the session as a new session; Obtain the features of an existing session and compare them with the features of the same session in other independent windows in the joint window to which the current independent window belongs. If the features have not changed and the session is not an abnormal session or a candidate abnormal session in other independent windows in the joint window, delete the existing session from the current independent window. Determine the abnormal session and candidate abnormal session of the current independent window based on the local abnormal score of the session. The joint window is regarded as an independent window, and candidate abnormal sessions of the joint window are calculated; the union of candidate abnormal sessions of all independent windows in the joint window is obtained, and if a session in the union is a candidate abnormal session in multiple independent windows of the joint window or a candidate abnormal session of the joint window, the session is marked as an abnormal session.

2. The method according to claim 1, characterized in that The calculation process of the session local anomaly score is: According to the session features, the sessions of the independent window are mapped to the grid of the data space, the core points of each grid and the local density of each session are calculated, and the grid density corresponding to the independent window is calculated according to the local density of the session in the grid; the local anomaly score of the session is obtained based on the local density of the session and the grid density.

3. The method according to claim 1, characterized in that The abnormal session and candidate abnormal session of the current independent window are determined according to the local abnormal score of the session, specifically: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The scores of the remaining sessions are calculated according to the grid density of the remaining sessions in the current independent window and the local anomaly scores of the remaining sessions. The remaining sessions are sorted in descending order according to the scores, and the first k sessions after sorting are used as candidate anomaly sessions.

4. The method according to claim 1, characterized in that The abnormal session and candidate abnormal session of the current independent window are determined according to the local abnormal score of the session, specifically: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The score of the session is calculated according to the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained; If the score of the non-abnormal session is greater than the minimum value, the non-abnormal session is taken as a candidate abnormal session.

5. The method according to claim 3 or 4, characterized in that The score is calculated as follows: A negative exponential function value of the grid density is calculated, and a weighted sum of the negative exponential function value and the local anomaly score is performed to obtain the score.

6. A network abnormal session detection system, characterized in that: The system includes the following modules: A data collection module, used to obtain the network session within the existence time of the current independent window, if the session start time is before the current independent window, the session is marked as an existing session, otherwise, the session is marked as a new session; A preliminary identification module is used to obtain the features of an existing session and compare them with the features of the same session in other independent windows in the joint window to which the current independent window belongs. If the features have not changed and the session is not an abnormal session or a candidate abnormal session in other independent windows in the joint window, the existing session is deleted from the current independent window; the abnormal session and candidate abnormal session of the current independent window are determined according to the local abnormal score of the session; The candidate anomaly identification module is used to treat the joint window as an independent window and calculate the candidate anomaly sessions of the joint window; obtain the union of all independent window candidate anomaly sessions in the joint window, and if a session in the union is a candidate anomaly session in multiple independent windows of the joint window or a candidate anomaly session of the joint window, mark the session as an abnormal session.

7. The system according to claim 6, characterized in that The calculation process of the session local anomaly score is: According to the session features, the sessions of the independent window are mapped to the grid of the data space, the core points of each grid and the local density of each session are calculated, and the grid density corresponding to the independent window is calculated according to the local density of the session in the grid; the local anomaly score of the session is obtained based on the local density of the session and the grid density.

8. The system according to claim 6, characterized in that The abnormal session and candidate abnormal session of the current independent window are determined according to the local abnormal score of the session, specifically: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The scores of the remaining sessions are calculated according to the grid density of the remaining sessions in the current independent window and the local anomaly scores of the remaining sessions. The remaining sessions are sorted in descending order according to the scores, and the first k sessions after sorting are used as candidate anomaly sessions.

9. The system according to claim 6, characterized in that The abnormal session and candidate abnormal session of the current independent window are determined according to the local abnormal score of the session, specifically: Obtain the maximum value of the local anomaly score of the session in each independent window in the joint window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, take the session as the abnormal session of the current independent window; The score of the session is calculated according to the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained; If the score of the non-abnormal session is greater than the minimum value, the non-abnormal session is taken as a candidate abnormal session.

10. The system according to claim 8 or 9, characterized in that The score is calculated as follows: A negative exponential function value of the grid density is calculated, and a weighted sum of the negative exponential function value and the local anomaly score is performed to obtain the score.

Images