A network anomalous session detection method and system

Abstract

The application relates to a network abnormal session detection method and system. If a session starting moment is before a current independent window, the session is identified as an existing session; otherwise, the session is identified as a new session. Features of the existing session are obtained and compared with features of the same session in other independent windows of a joint window to which the current independent window belongs. If the features do not change and the session is a non-abnormal and candidate abnormal session in the other independent windows of the joint window, the existing session is deleted from the current independent window. Abnormal sessions and candidate abnormal sessions of the current independent window are determined according to session local abnormal scores. The joint window is regarded as an independent window, and candidate abnormal sessions of the joint window are calculated. A union set of candidate abnormal sessions of all independent windows in the joint window is obtained. If one session in the union set is a candidate abnormal session in multiple independent windows of the joint window or is a candidate abnormal session of the joint window, the session is marked as an abnormal session.

Description

Technical Field

[0001] This invention relates to the field of computer networks, specifically to a method and system for detecting abnormal network sessions. Background Technology

[0002] With the rapid development of technologies such as cloud computing, the Internet of Things (IoT), and 5G communication, network environments are characterized by high concurrency, large scale, and heterogeneity, posing challenges to traditional anomaly detection methods based on rule matching and feature extraction. Existing anomaly detection methods mainly include rule-based intrusion detection such as Snort, statistical analysis-based methods such as time-series statistics, machine learning-based anomaly detection, and, in recent years, deep learning-based methods. However, due to attackers constantly changing attack patterns and the high dimensionality, strong temporal sequence, and dynamic changes in traffic data, existing methods still have shortcomings in terms of detection accuracy, real-time performance, and computational complexity. For example, rule-based detection methods cannot effectively identify new types of attacks, statistical methods are insensitive to abnormal changes in traffic distribution, and machine learning-based methods are limited by the quality of labeled data and training costs. In recent years, a series of streaming data anomaly detection methods have been proposed, including those based on kernel density estimation (KDE), local outlier factor (LOF), and deep learning-based models. However, most methods use a sliding window model for anomaly detection. While this method can dynamically update streaming data, the overlap between windows leads to repeated calculations of a large number of data points. Furthermore, existing anomaly detection methods are not effective in detecting both short-term high-frequency attacks and long-term hidden attacks simultaneously, as the attack methods of the two are different. Summary of the Invention

[0003] To address the aforementioned issues, the first aspect provides a method for detecting abnormal network sessions, the method comprising the following steps:

[0004] Get the network sessions within the current independent window's existence time. If the session started before the current independent window, mark the session as an existing session; otherwise, mark the session as a new session.

[0005] Get the characteristics of existing sessions and compare them with the characteristics of the same session in other independent windows in the union window to which the current independent window belongs. If the characteristics have not changed and the session is not an abnormal or candidate abnormal session in other independent windows in the union window, delete the existing session from the current independent window; determine the abnormal session and candidate abnormal session in the current independent window based on the session local abnormality score.

[0006] Treat the joint window as an independent window and calculate the candidate abnormal sessions of the joint window; obtain the union of all candidate abnormal sessions of independent windows in the joint window. If a session in the union is a candidate abnormal session in multiple independent windows of the joint window or is a candidate abnormal session of the joint window, mark the session as an abnormal session.

[0007] Optionally, the calculation process for the session local anomaly score is as follows:

[0008] Based on session characteristics, sessions of independent windows are mapped to a grid in the data space. The core point of each grid and the local density of each session are calculated. The grid density corresponding to the independent window is calculated based on the local density of the sessions within the grid. The session local anomaly score is obtained based on the local density of the sessions and the grid density.

[0009] Optionally, determining the abnormal session and candidate abnormal session of the current independent window based on the session local anomaly score specifically involves:

[0010] Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window.

[0011] The score of the remaining sessions is calculated based on the grid density of the remaining sessions in the current independent window and the local anomaly score of the remaining sessions. The remaining sessions are then sorted in descending order of the scores, and the top k sessions after sorting are selected as candidate anomaly sessions.

[0012] Optionally, determining the abnormal session and candidate abnormal session of the current independent window based on the session local anomaly score specifically involves:

[0013] Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window.

[0014] The score of a session is calculated based on the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained.

[0015] If the score of a non-abnormal session is greater than the minimum value, then the non-abnormal session is considered as a candidate abnormal session.

[0016] Optionally, the score is calculated as follows:

[0017] Calculate the negative exponential function value of the grid density, and then perform a weighted summation of the negative exponential function value and the local anomaly score to obtain the score.

[0018] The second aspect provides a network abnormal session detection system, which includes the following modules:

[0019] The data acquisition module is used to acquire network sessions within the current independent window. If the session started before the current independent window, the session is marked as an existing session; otherwise, the session is marked as a new session.

[0020] The initial identification module is used to obtain the characteristics of existing sessions and compare them with the characteristics of the same session in other independent windows in the union window to which the current independent window belongs. If the characteristics have not changed and the session is not an abnormal or candidate abnormal session in other independent windows in the union window, the existing session is deleted from the current independent window; the abnormal session and candidate abnormal session in the current independent window are determined based on the local abnormality score of the session.

[0021] The candidate anomaly identification module is used to treat the joint window as an independent window, calculate the candidate abnormal sessions of the joint window, obtain the union of the candidate abnormal sessions of all independent windows in the joint window, and mark the session as an abnormal session if a session in the union is a candidate abnormal session in multiple independent windows of the joint window or a candidate abnormal session of the joint window.

[0022] Optionally, the calculation process for the session local anomaly score is as follows:

[0023] Based on session characteristics, sessions of independent windows are mapped to a grid in the data space. The core point of each grid and the local density of each session are calculated. The grid density corresponding to the independent window is calculated based on the local density of the sessions within the grid. The session local anomaly score is obtained based on the local density of the sessions and the grid density.

[0024] Optionally, determining the abnormal session and candidate abnormal session of the current independent window based on the session local anomaly score specifically involves:

[0025] Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window.

[0026] The score of the remaining sessions is calculated based on the grid density of the remaining sessions in the current independent window and the local anomaly score of the remaining sessions. The remaining sessions are then sorted in descending order of the scores, and the top k sessions after sorting are selected as candidate anomaly sessions.

[0027] Optionally, determining the abnormal session and candidate abnormal session of the current independent window based on the session local anomaly score specifically involves:

[0028] Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window.

[0029] The score of a session is calculated based on the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained.

[0030] If the score of a non-abnormal session is greater than the minimum value, then the non-abnormal session is considered as a candidate abnormal session.

[0031] Optionally, the score is calculated as follows:

[0032] Calculate the negative exponential function value of the grid density, and then perform a weighted summation of the negative exponential function value and the local anomaly score to obtain the score.

[0033] The network anomaly session detection method provided by this invention examines the characteristics of existing sessions and compares them with the historical characteristics of the same sessions within a combined window. If the session behavior remains unchanged and it was not previously marked as an anomaly or a candidate anomaly, the session is deleted, avoiding redundant calculations in each independent window. While a single independent window may misjudge some short-term anomalies, the combined window, through overlay analysis across multiple independent windows, provides a more comprehensive view of session behavior. Furthermore, short-term high-frequency attacks, such as port scanning, typically erupt rapidly within a short period, causing a rapid increase in local anomaly scores, thus confirming the anomaly within an independent window. Similarly, long-term covert attacks, such as data breaches and low-frequency DDoS attacks, can be identified through overlay analysis within a combined window, even if a single independent window cannot determine the anomaly. This method is applicable to both short-term, severe anomalies and long-term, latent anomalies. Attached Figure Description

[0034] Figure 1 This is a flowchart of Example 1;

[0035] Figure 2 This is a diagram illustrating the relationship between combined windows and independent windows;

[0036] Figure 3 A schematic diagram for identifying anomalies from candidate anomalies;

[0037] Figure 4 This is a schematic diagram of the structure of Example 2;

[0038] Figure 5 This is a schematic diagram of the structure of a computer device. Detailed Implementation

[0039] In this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] Figure 1 A flowchart of Embodiment 1 is shown. Figure 1 The network abnormal session detection method shown includes the following steps:

[0042] S1, obtain the network sessions within the current independent window's existence time. If the session started before the current independent window, mark the session as an existing session; otherwise, mark the session as a new session.

[0043] Within the current independent window's time frame, all active network sessions are detected. If a session's start time is earlier than the current independent window's start time, it indicates the session already existed in a previous window and is marked as an existing session. Conversely, if a session's start time is within the current independent window, it indicates a new session and is marked as a new session. An independent window is a time period, and unlike a sliding window, independent windows do not overlap; that is, two adjacent independent windows do not overlap in time. For example, if independent windows IW1 and IW2 are adjacent, then the end time of IW1 is the start time of IW2. In a more specific embodiment, each independent window is a left-open, right-closed interval, for example (10s, 80s). The combined window mentioned below consists of multiple independent windows, and the independent windows within a combined window are temporally continuous. Two temporally adjacent combined windows also do not overlap. The relationship between independent windows and combined windows is as follows: Figure 2 As shown.

[0044] S2, obtain the characteristics of existing sessions and compare them with the characteristics of the same session in other independent windows in the union window to which the current independent window belongs. If the characteristics have not changed and the session is not an abnormal or candidate abnormal session in other independent windows in the union window, delete the existing session from the current independent window; determine the abnormal session and candidate abnormal session in the current independent window based on the session local abnormality score.

[0045] Existing sessions are those that began before the current Independent Window (IW) and may continue across multiple independent windows. For these existing sessions, key behavioral characteristics are extracted, such as packet count, traffic size, session duration, traffic direction, packet interval, source IP, and destination IP. The Combined Window (FW) is a time interval composed of multiple independent windows. Existing sessions within the current IW are examined, and their characteristics are compared with the characteristics of the same session in other IWs within the FW. In one embodiment, the other IWs are those preceding the current IW and belonging to the same FW as the current IW. If the session's characteristics remain unchanged, i.e., its historical behavior is consistent, and the session is neither a candidate for anomalous session nor an anomalous session in other IWs of the FW, it is considered normal in the historical window. For example, session A's characteristics have not changed, and it has never been marked as anomalous or a candidate for anomalous in the combined window, therefore it is deleted, reducing unnecessary calculations. Session C's characteristics have changed, or it was previously considered an anomalous or candidate for anomalous session within the FW, therefore it needs further detection.

[0046] After removing sessions from the current independent window, anomaly detection is performed on the remaining sessions. In the anomaly detection, the local anomaly score of the remaining sessions in the current independent window is calculated first. The calculation process of the local anomaly score is as follows: the sessions in the independent window are mapped to a grid in the data space according to the session characteristics, the core point of each grid and the local density of each session are calculated, and the grid density corresponding to the independent window is calculated based on the local density of the sessions in the grid; the local anomaly score of the sessions is obtained based on the local density of the sessions and the grid density.

[0047] The calculation of local anomaly scores begins by mapping sessions within an independent window to different grids in the data space based on session characteristics. Then, core points are calculated within each grid, and the local density of each session within that grid is estimated. Next, the grid density is estimated using the local densities of all sessions, i.e., the distribution of session density within the grid. Specifically, the density estimates of each data point within the grid form the grid density (GD), and the grid density is recorded using the estimated grid density points (SDPs). Finally, based on the session's local density and the overall grid density, a local anomaly score is calculated to measure whether the session is anomalous relative to its grid. Core point, local density, grid density estimation, and session anomaly score calculation are existing technologies and will not be elaborated upon here. A higher local anomaly score indicates that the session is more likely to be anomalous under the current traffic pattern.

[0048] In an optional embodiment, determining the abnormal session and candidate abnormal session of the current independent window based on the session local anomaly score specifically involves:

[0049] Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window.

[0050] Obtain the maximum abnormality score for each independent window session within the union window, and calculate the average of these maximum scores. Then, compare the local abnormality score of the session in the current independent window with this average. If the local abnormality score of a session in the current independent window is greater than this average, then this session is considered an abnormal session in the current independent window. Assuming union window 1 contains multiple independent windows, for each independent window, find the maximum abnormality score of all sessions within it, calculate the average of the maximum abnormality scores of all independent windows, and use this average as the average abnormality score. For each session in an independent window, if its local abnormality score is greater than the previously calculated average abnormality score, then this session is an abnormal session.

[0051] The score of the remaining sessions is calculated based on the grid density of the remaining sessions in the current independent window and the local anomaly score of the remaining sessions. The remaining sessions are then sorted in descending order of the scores, and the top k sessions after sorting are selected as candidate anomaly sessions.

[0052] After identifying anomalous sessions, a score is calculated for the remaining sessions within each independent window. This score is calculated by combining the grid density of the remaining sessions and their local anomaly scores. A higher score indicates a greater degree of anomalousness. Then, the remaining sessions are sorted in descending order of score, and the top k sessions are selected as candidate anomalous sessions. Here, k is a pre-defined positive integer representing the number of candidate sessions to select. These candidate anomalous sessions may be potential anomalous sessions and will be further analyzed and processed.

[0053] In another optional embodiment, determining the abnormal session and candidate abnormal session of the current independent window based on the session local anomaly score specifically involves:

[0054] Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session of the current independent window; similar to the previous embodiment, the abnormal sessions of the independent windows are determined first.

[0055] The score of a session is calculated based on the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained.

[0056] If the score of a non-abnormal session is greater than the minimum value, then the non-abnormal session is considered as a candidate abnormal session.

[0057] The algorithm retrieves the minimum score of all abnormal sessions within a single window. For a non-abnormal session within the same window, if its score is greater than the minimum score of any abnormal session retrieved earlier, then that non-abnormal session is considered a candidate abnormal session. For example, in a single window, two abnormal sessions have scores of 9 and 8 respectively. The minimum score is 8. If a non-abnormal session in that window has a score greater than 8, then that non-abnormal session is considered a candidate abnormal session.

[0058] In an optional embodiment, the score is calculated as follows:

[0059] Calculate the negative exponential function value of the grid density, and then sum the negative exponential function value and the local anomaly score using weighted averages to obtain the score. Calculate the density of the grid containing the session, and then calculate a negative exponential function value for this grid density. The negative exponential function is generally in the form of exp(-βx), where x is the grid density and β is an adjustment parameter. Since the negative exponential function is decreasing, the lower the grid density, the higher the negative exponential function value. This converts the grid density into an index related to the degree of anomaly; the lower the grid density, the higher this index value, indicating a greater likelihood of anomaly. Sum the previously calculated negative exponential function value with the session's local anomaly score using weighted averages. The local anomaly score represents the degree of anomaly of the session itself; a higher score indicates a more anomalous session. This comprehensively considers the influence of grid density and local anomaly score on the degree of session anomaly. The weights can be adjusted according to the actual situation; for example, if the local anomaly score is considered more important, its weight can be set higher.

[0060] S3: Treat the joint window as an independent window and calculate the candidate abnormal sessions of the joint window; obtain the union of all candidate abnormal sessions of independent windows in the joint window. If a session in the union is a candidate abnormal session in multiple independent windows of the joint window or is a candidate abnormal session of the joint window, mark the session as an abnormal session.

[0061] The entire joint window is treated as a single, independent window. Then, using the previously described method—calculating scores based on grid density and local anomaly scores, and selecting the highest-scoring sessions as candidate anomaly sessions—the candidate anomaly sessions and the actual anomaly sessions for the joint window are calculated. If a session is an anomaly session within the joint window, it is designated as an anomaly session. If a session is a candidate anomaly session within the joint window, the set of candidate anomaly sessions from all independent windows within the joint window is obtained, and this set is intersected with the set of candidate anomaly sessions from the joint window itself. Sessions in this intersection are designated as anomaly sessions. Furthermore, if a session is a candidate anomaly session in multiple independent windows within the joint window, that session is also marked as an anomaly session.

[0062] For example, a combined window contains three independent windows, A, B, and C. The candidate abnormal sessions for the combined window are {X}, for independent window A are {X, Z}, for independent window B are {Y, W}, and for independent window C is {W}. Session X is a candidate abnormal session in both independent window A and the combined window, therefore it is marked as an abnormal session. Session W is a candidate abnormal session in both independent windows B and C, therefore it is marked as an abnormal session. Session Y exists only in independent window B and is not considered an abnormal session. Session Z exists only in independent window A and is not considered an abnormal session. Figure 3 As shown.

[0063] Figure 4 Example 2 is shown, as follows Figure 4 The network anomaly session detection system shown includes the following modules:

[0064] The data acquisition module 401 is used to acquire network sessions within the current independent window's existence time. If the session's start time is before the current independent window, the session is marked as an existing session; otherwise, the session is marked as a new session.

[0065] The preliminary identification module 402 is used to obtain the characteristics of existing sessions and compare them with the characteristics of the same session in other independent windows in the union window to which the current independent window belongs. If the characteristics have not changed and the session is not an abnormal or candidate abnormal session in other independent windows in the union window, the existing session is deleted from the current independent window; the abnormal session and candidate abnormal session in the current independent window are determined according to the local abnormality score of the session.

[0066] The candidate anomaly identification module 403 is used to treat the joint window as an independent window, calculate the candidate abnormal sessions of the joint window; obtain the union of the candidate abnormal sessions of all independent windows in the joint window; if a session in the union is a candidate abnormal session in multiple independent windows of the joint window or is a candidate abnormal session of the joint window, the session is marked as an abnormal session.

[0067] Optionally, the calculation process for the session local anomaly score is as follows:

[0068] Based on session characteristics, sessions of independent windows are mapped to a grid in the data space. The core point of each grid and the local density of each session are calculated. The grid density corresponding to the independent window is calculated based on the local density of the sessions within the grid. The session local anomaly score is obtained based on the local density of the sessions and the grid density.

[0069] Optionally, determining the abnormal session and candidate abnormal session of the current independent window based on the session local anomaly score specifically involves:

[0070] Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window.

[0071] The score of the remaining sessions is calculated based on the grid density of the remaining sessions in the current independent window and the local anomaly score of the remaining sessions. The remaining sessions are then sorted in descending order of the scores, and the top k sessions after sorting are selected as candidate anomaly sessions.

[0072] Optionally, determining the abnormal session and candidate abnormal session of the current independent window based on the session local anomaly score specifically involves:

[0073] Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window.

[0074] The score of a session is calculated based on the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained.

[0075] If the score of a non-abnormal session is greater than the minimum value, then the non-abnormal session is considered as a candidate abnormal session.

[0076] Optionally, the score is calculated as follows:

[0077] Calculate the negative exponential function value of the grid density, and then perform a weighted summation of the negative exponential function value and the local anomaly score to obtain the score.

[0078] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of a necessary general-purpose hardware platform, or by a combination of hardware and software. Figure 5 A schematic diagram of the structure of a computer device, such as Figure 5 As shown, a computer-readable storage medium stores a computer program that can be executed by a processor. When executed by the processor, the computer program implements the method described in Embodiment 1. Based on this understanding, the above technical solution, in essence or the part that contributes to the prior art, can be embodied in the form of a computer product. The present invention can take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-readable program code.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Other embodiments may also be used. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting abnormal network sessions, characterized in that, The method includes the following steps: Get the network sessions within the current independent window's existence time. If the session started before the current independent window, mark the session as an existing session; otherwise, mark the session as a new session. Get the characteristics of existing sessions and compare them with the characteristics of the same session in other independent windows in the union window to which the current independent window belongs. If the characteristics have not changed and the session is not an abnormal or candidate abnormal session in other independent windows in the union window, delete the existing session from the current independent window; determine the abnormal session and candidate abnormal session in the current independent window based on the session local abnormality score. Treat the joint window as an independent window and calculate the candidate abnormal sessions of the joint window; obtain the union of all candidate abnormal sessions of independent windows in the joint window. If a session in the union is a candidate abnormal session in multiple independent windows of the joint window or is a candidate abnormal session of the joint window, mark the session as an abnormal session.

2. The method as described in claim 1, characterized in that, The calculation process for the session local anomaly score is as follows: Based on session characteristics, sessions of independent windows are mapped to a grid in the data space. The core point of each grid and the local density of each session are calculated. The grid density corresponding to the independent window is calculated based on the local density of the sessions within the grid. The session local anomaly score is obtained based on the local density of the sessions and the grid density.

3. The method as described in claim 1, characterized in that, The process of determining the abnormal session and candidate abnormal session for the current independent window based on the session local anomaly score is as follows: Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window. The score of the remaining sessions is calculated based on the grid density of the remaining sessions in the current independent window and the local anomaly score of the remaining sessions. The remaining sessions are then sorted in descending order of the scores, and the top k sessions after sorting are selected as candidate anomaly sessions.

4. The method as described in claim 1, characterized in that, The process of determining the abnormal session and candidate abnormal session for the current independent window based on the session local anomaly score is as follows: Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window. The score of a session is calculated based on the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained. If the score of a non-abnormal session is greater than the minimum value, then the non-abnormal session is considered as a candidate abnormal session.

5. The method as described in claim 3 or 4, characterized in that, The calculation process for the score is as follows: Calculate the negative exponential function value of the grid density, and then perform a weighted summation of the negative exponential function value and the local anomaly score to obtain the score.

6. A network abnormal session detection system, characterized in that, The system includes the following modules: The data acquisition module is used to acquire network sessions within the current independent window. If the session started before the current independent window, the session is marked as an existing session; otherwise, the session is marked as a new session. The initial identification module is used to obtain the characteristics of existing sessions and compare them with the characteristics of the same session in other independent windows in the union window to which the current independent window belongs. If the characteristics have not changed and the session is not an abnormal or candidate abnormal session in other independent windows in the union window, the existing session is deleted from the current independent window; the abnormal session and candidate abnormal session in the current independent window are determined based on the local abnormality score of the session. The candidate anomaly identification module is used to treat the joint window as an independent window, calculate the candidate abnormal sessions of the joint window, obtain the union of the candidate abnormal sessions of all independent windows in the joint window, and mark the session as an abnormal session if a session in the union is a candidate abnormal session in multiple independent windows of the joint window or a candidate abnormal session of the joint window.

7. The system as described in claim 6, characterized in that, The calculation process for the session local anomaly score is as follows: Based on session characteristics, sessions of independent windows are mapped to a grid in the data space. The core point of each grid and the local density of each session are calculated. The grid density corresponding to the independent window is calculated based on the local density of the sessions within the grid. The session local anomaly score is obtained based on the local density of the sessions and the grid density.

8. The system as described in claim 6, characterized in that, The process of determining the abnormal session and candidate abnormal session for the current independent window based on the session local anomaly score is as follows: Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window. The score of the remaining sessions is calculated based on the grid density of the remaining sessions in the current independent window and the local anomaly score of the remaining sessions. The remaining sessions are then sorted in descending order of the scores, and the top k sessions after sorting are selected as candidate anomaly sessions.

9. The system as described in claim 6, characterized in that, The process of determining the abnormal session and candidate abnormal session for the current independent window based on the session local anomaly score is as follows: Obtain the maximum value of the local anomaly score of the session in each independent window of the combined window, calculate the average value of the maximum value, and if the local anomaly score of the session in the current independent window is greater than the average value, then the session is regarded as an abnormal session in the current independent window. The score of a session is calculated based on the grid density of the session in the current independent window and the local anomaly score of the session, and the minimum score of the abnormal session in the current independent window is obtained. If the score of a non-abnormal session is greater than the minimum value, then the non-abnormal session is considered as a candidate abnormal session.

10. The system as described in claim 8 or 9, characterized in that, The calculation process for the score is as follows: Calculate the negative exponential function value of the grid density, and then perform a weighted summation of the negative exponential function value and the local anomaly score to obtain the score.

Images