Safety monitoring method and system based on clustering processing

Abstract

The invention discloses a safety monitoring method and system based on clustering processing. The method comprises the steps of data collection, candidate anomaly recognition, candidate anomaly accumulation, user reference dynamic updating, outdated mode elimination and index monitoring and early warning. The invention belongs to the field of safety monitoring, and particularly relates to a safety monitoring method and system based on clustering processing, according to the scheme, abnormity is evaluated through the relative proportion of a normal sample in a local neighborhood, and misjudgment is avoided; data correlation is introduced to filter isolated noise in user data transmission; time continuity is introduced to reduce misjudgment caused by short-term interference; a candidate abnormal buffer area is introduced, so that false triggering caused by accidental interference is avoided; a dual-mode dynamic updating mechanism is introduced, so that a data reference is always synchronous with an actual user data state; introducing an outdated judgment mechanism in which a sample size growth rate is combined with a relative threshold value, and adopting a smooth function evaluation mechanism in a logistic regression form to reduce missed judgment of a new cluster or mistaken deletion of an old cluster; and the safety monitoring effect is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of security monitoring, and in particular to a security monitoring method and system based on clustering processing. Background Art

[0002] Security monitoring methods are technical means of collecting and analyzing usage data from China Unicom users to identify data anomalies or security risks. Their core goal is to promptly capture potential security risks in user data. However, typical security monitoring methods ignore the correlations and temporal continuity between user data, can only detect single-point anomalies, are sensitive to transient noise and fluctuations, and are prone to false alarms, resulting in poor monitoring accuracy. These methods also suffer from bloated benchmark libraries, which interfere with the accuracy of anomaly detection for new data. They also struggle to adapt to dynamically changing user data scenarios when identifying new scenarios and deleting old patterns, leading to poor monitoring effectiveness. Summary of the Invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a security monitoring method and system based on clustering processing. In view of the problem that general security monitoring methods ignore the correlation and time continuity between user data, can only detect single-point anomalies, are sensitive to instantaneous noise and fluctuations, and are prone to false alarms, which leads to poor monitoring accuracy, this solution evaluates anomalies by the relative proportion of normal samples in the local neighborhood, adapts to the differences in normal parameter ranges of users in different usage periods, and avoids misjudgments caused by changes in absolute parameter values; introduces data correlation to filter isolated noise in user data transmission; introduces time continuity to distinguish between true anomalies of short-term fluctuations and continuous trends in user data, and reduces misjudgments caused by short-term interference; introduces a candidate anomaly buffer to avoid false triggering caused by occasional interference; thereby improving monitoring accuracy; in view of general The security monitoring method has the problem of bloated benchmark library, which interferes with the accuracy of anomaly detection of new data. The identification of new scenarios and deletion of old patterns are difficult to adapt to dynamically changing user data scenarios, which leads to poor monitoring effect. This solution introduces a dual-mode dynamic update mechanism. When the update is not triggered, the core points are updated through weighted average, and the contribution factor is dynamically adjusted with the proportion of new data; it can adapt to the slow changes in user usage habits and identify sudden new usage scenarios of users, so that the data benchmark is always synchronized with the actual user data status; it introduces an outdated judgment mechanism that combines the sample size growth rate with the relative threshold to avoid redundant data patterns interfering with the anomaly detection of new data; it adopts a smoothing function evaluation mechanism in the form of logistic regression to adapt to the differences in pattern stability under different user data scenarios, reduce the missed judgment of new data patterns or the mistaken deletion of old data patterns, and thus improve the security monitoring effect.

[0004] The technical solution adopted by the present invention is as follows: The present invention provides a safety monitoring method based on clustering processing, which includes the following steps:

[0005] Step S1: data collection;

[0006] Step S2: candidate anomaly identification;

[0007] Step S3: candidate anomaly accumulation;

[0008] Step S4: user reference dynamic update;

[0009] Step S5: obsolete mode elimination;

[0010] Step S6: index monitoring and early warning.

[0011] Further, in step S1, the data collection is to collect user historical normal use data; and to perform normalization processing; and to use DBSCAN to construct a user reference cluster.

[0012] Further, in step S2, the candidate anomaly identification is to collect a real-time user use data set , t is the time mark of the current collected data; to determine whether each sample is a candidate anomaly; and the candidate anomaly judgment condition is expressed as: ; is the collected real-time data; is the number of samples belonging to the existing user reference cluster within the fluctuation domain of ; is the total number of samples within the fluctuation domain of ; is a safety threshold; a candidate anomaly screening mechanism with spatiotemporal correlation is introduced, and the spatial correlation degree of the candidate anomaly sample is defined , which is expressed as: ; is a preliminary anomaly indication of the sample; K is the number of spatial neighborhood samples; is a data neighborhood sample set; is a data neighborhood sample; the time continuity T(·) of the sample is calculated, which quantifies the duration of the anomaly on the time axis, and is expressed as: ; L is a measurement window; u is a time window index; is the sample collected for the u-th time corresponding to the user; the candidate anomaly indication function is defined, which is expressed as: ; is a spatiotemporal correlation threshold.

[0013] Further, in step S3, the candidate anomaly accumulation is to store the real-time identified candidate anomaly into a candidate anomaly buffer ; and They are the candidate anomaly buffers before and after the update respectively; set the accumulation threshold, and when the cumulative anomaly ratio exceeds the accumulation threshold, the user benchmark library update is triggered; the cumulative anomaly ratio = the cumulative number of candidate anomalies / the total data volume to date.

[0014] Furthermore, in step S4, the user benchmark dynamic update is to update the core points of the user benchmark cluster when the user benchmark library update is not triggered, and a weighted average update strategy is introduced. The core point update is expressed as: ; yes Belong to cluster The core point set of is the core point of the jth cluster before updating; is the core point of the jth cluster after update; is the updated cluster The core point set of is the contribution factor, ;When the user benchmark library update is triggered, a new user benchmark is created, and DBSCAN is applied to the accumulated anomaly pool. If a new density cluster is formed, a candidate new cluster is created and the accumulated anomaly pool is cleared.

[0015] Furthermore, in step S5, the obsolete pattern elimination is to introduce an obsolete pattern judgment mechanism based on the sample size growth rate. The pattern is considered obsolete only when no new data is added within the time window T. The obsolete judgment condition is expressed as: If satisfied, then Determined as a candidate outdated cluster; is the jth user benchmark cluster at time tT; is the number of user benchmark clusters.

[0016] Furthermore, in step S6, the indicator monitoring and early warning is to evaluate the monitoring performance of the candidate cluster and calculate the data adaptability of the candidate new cluster. , expressed as: ; ; is a candidate new cluster; is the stability index; calculates the effectiveness of eliminating candidate obsolete clusters , expressed as: ; ; is a candidate outdated cluster; is the growth index; the adaptation threshold and old cluster threshold are set respectively. If the data adaptation of the candidate new cluster is higher than the adaptation threshold, it is retained; if the elimination effectiveness of the candidate obsolete cluster is lower than the old cluster threshold, it is deleted; the real-time output of candidate anomalies is a first-level warning. If the cumulative anomalies trigger the update of the user benchmark library and the candidate new cluster is retained, a second-level warning is output.

[0017] The application provides a security monitoring system based on clustering processing, which comprises a data acquisition module, a candidate anomaly identification module, a candidate anomaly accumulation module, a user reference dynamic updating module, an obsolete mode elimination module and an index monitoring and early warning module.

[0018] The data acquisition module acquires user historical normal use data, and uses DBSCAN to construct a user reference cluster.

[0019] The candidate anomaly identification module judges candidate anomalies based on the user reference cluster, and introduces spatial correlation, time continuity and an anomaly indication function to screen the candidate anomalies.

[0020] The candidate anomaly accumulation module stores the candidate anomalies in a buffer area, and triggers user reference library updating when the anomaly accumulation proportion exceeds a set threshold.

[0021] The user reference dynamic updating module uses weighted average updating core points when updating is not triggered, and applies DBSCAN to create new clusters for the accumulated anomaly pool when updating is triggered.

[0022] The obsolete mode elimination module judges and deletes obsolete user reference clusters based on the sample quantity growth rate and the relative threshold in a time window.

[0023] The index monitoring and early warning module calculates candidate new cluster data adaptation degree and candidate obsolete cluster elimination effectiveness, and outputs early warning after threshold judgment.

[0024] The application has the following beneficial effects by adopting the above scheme:

[0025] (1) The scheme can solve the problem that general security monitoring methods ignore the correlation and time continuity between user data, can only detect single-point anomalies, are sensitive to transient noise and fluctuations, are prone to false positives, and thus result in poor monitoring accuracy. The scheme evaluates anomalies by the relative proportion of normal samples in a local neighborhood, adapts to the normal parameter range difference of different use periods of users, avoids misjudgment caused by parameter absolute value changes, introduces data correlation to filter isolated noise in user data transmission, introduces time continuity to distinguish short-term fluctuations and real anomalies of user data, reduces misjudgment caused by short-term interference, introduces a candidate anomaly buffer area to avoid mistriggering caused by occasional interference, and thus improves monitoring accuracy.

[0026] (2) In view of the problem that the general security monitoring method has a bloated benchmark library, which interferes with the accuracy of anomaly detection of new data, and is difficult to adapt to the dynamically changing user data scenarios for the identification of new scenarios and the deletion of old patterns, thus leading to poor monitoring effects, this solution introduces a dual-mode dynamic update mechanism. When the update is not triggered, the core points are updated by weighted average, and the contribution factor is dynamically adjusted with the proportion of new data; it can adapt to the slow changes in user usage habits and identify sudden new usage scenarios of users, so that the data benchmark is always synchronized with the actual user data status; it introduces an outdated judgment mechanism that combines the sample size growth rate with the relative threshold to avoid redundant data patterns interfering with the anomaly detection of new data; it adopts a smoothing function evaluation mechanism in the form of logistic regression to adapt to the differences in pattern stability under different user data scenarios, reduce the omission of new data patterns or the mistaken deletion of old data patterns, and thus improve the security monitoring effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A schematic diagram of the process of the clustering-based security monitoring method provided by the present invention;

[0028] Figure 2 This is a schematic diagram of the safety monitoring system based on clustering processing provided by the present invention.

[0029] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0031] In the description of the present invention, it should be understood that terms such as "up", "down", "front", "back", "left", "right", "top", "bottom", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0032] Example 1, see Figure 1 The present invention provides a clustering-based security monitoring method, which includes the following steps:

[0033] Step S1: Data collection: collect historical normal usage data of users and use DBSCAN to build user benchmark clusters;

[0034] Step S2: Candidate anomaly identification: determine candidate anomalies based on user benchmark clusters for real-time data, and introduce spatial correlation, temporal continuity, and anomaly indicator functions to screen candidate anomalies.

[0035] Step S3: Candidate anomalies are accumulated and stored in a buffer. When the accumulated anomaly percentage exceeds a set threshold, the user benchmark library is updated.

[0036] Step S4: Dynamic update of user benchmarks. When no update is triggered, the core points are updated using weighted average. When an update is triggered, DBSCAN is applied to the accumulated anomaly pool to create new clusters.

[0037] Step S5: Eliminate outdated patterns, based on the sample size growth rate and relative threshold within the time window, determine and delete outdated user benchmark clusters;

[0038] Step S6: indicator monitoring and early warning, calculate the data adaptability of candidate new clusters and the effectiveness of eliminating candidate obsolete clusters, and output an early warning after threshold judgment.

[0039] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, data collection is to collect the user's historical normal usage data. The historical normal usage data of China Unicom users includes call duration, call frequency, traffic usage, SMS sending volume, package usage, login location, login device, and consumption amount; and normalization is performed using maximum and minimum normalization; DBSCAN is used to construct a user benchmark cluster as the user's typical normal usage scenario.

[0040] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S2, candidate anomaly identification is to collect real-time user usage data sets. , t is the time mark of the current data collection; each sample is judged to be a candidate anomaly, corresponding to the parameter that deviates from the existing user benchmark; the candidate anomaly judgment condition is expressed as: ; It is the real-time data collected; yes of The number of samples belonging to the existing user benchmark cluster within the fluctuation domain; yes of The total number of samples in the fluctuation domain; The fluctuation domain is centered on the sample. The neighbor set with a radius of 1 corresponds to the normal fluctuation range of user usage data; is the safety threshold; introduce the candidate anomaly screening mechanism of spatiotemporal correlation and define the spatial correlation of candidate anomaly samples , measures the number of simultaneous anomalies and is expressed as: ; is the initial abnormality indicator of the sample, 1 is abnormal and 0 is normal; K is the number of spatial neighborhood samples; is a data neighborhood sample set, taken from Data of the N users with the most calls; is a data neighborhood sample; filter out isolated abnormal samples and strengthen collaborative abnormal samples; calculate the temporal continuity of the sample T(·) and quantify the persistence of the abnormality on the time axis, which is expressed as: ; L is the measurement window; u is the time window index; yes The sample collected for the uth time for the user; the time continuity reflects the abnormal continuous trend of the user himself; define the candidate abnormal indicator function , expressed as: ; It is the spatiotemporal correlation threshold. Based on the characteristic that normal data should be densely distributed, the anomaly is judged by the proportion of normal points in the fluctuation domain, avoiding the limitations of a single threshold and coping with the different normal data of users in different usage periods.

[0041] Example 4, see Figure 1 This embodiment is based on the above embodiment. In step S3, candidate anomaly accumulation is to store the candidate anomalies identified in real time into the candidate anomaly buffer. ; and The candidate anomaly buffers are the one before and after the update. The candidate anomaly buffer is initially empty. An accumulation threshold is set. When the accumulated anomaly percentage exceeds the accumulation threshold, the user benchmark database is updated. The accumulated anomaly percentage = the accumulated candidate anomaly number / the total data volume to date.

[0042] In order to avoid misjudgments caused by instantaneous network fluctuations or data transmission noise, a cumulative candidate anomaly pool is introduced. Only when the abnormal samples accumulate to a certain proportion will the data scenario benchmark library be updated to avoid single abnormality false triggering.

[0043] By performing the above operations, we can address the problem that general security monitoring methods ignore the correlation and time continuity between user data, can only detect single-point anomalies, are sensitive to instantaneous noise and fluctuations, and are prone to false alarms, which in turn leads to poor monitoring accuracy. This solution evaluates anomalies by the relative proportion of normal samples in the local neighborhood, adapts to the differences in normal parameter ranges during different user usage periods, and avoids misjudgments caused by changes in the absolute values ​​of parameters; introduces data correlation to filter out isolated noise in user data transmission; introduces time continuity to distinguish between true anomalies of short-term fluctuations in user data and continuous trends, reducing misjudgments caused by short-term interference; introduces a candidate anomaly buffer to avoid false triggers caused by occasional interference, thereby improving monitoring accuracy.

[0044] Example 5, see Figure 1 This embodiment is based on the above embodiment. In step S4, the dynamic update of the user benchmark introduces a dual-mode dynamic update mechanism. According to the trigger condition judgment result, the user benchmark library is updated in two cases. When the user benchmark library update is not triggered, the core points of the user benchmark cluster are updated. The core points correspond to typical usage states. A weighted average update strategy is introduced. When the proportion of new data is larger, a higher weight will be given during the update. The core point update is expressed as: ; yes Belong to cluster The core point set of , satisfies the DBSCAN core point conditions, corresponding to the core point performance of the reactor during stable operation; is the core point of the jth cluster before the update, not introduced hour; is the core point of the jth cluster after update; is the updated cluster The core point set of is the contribution factor, ;When the user benchmark library update is triggered, a new user benchmark is created, and DBSCAN is applied to the accumulated anomaly pool. If a new density cluster is formed, a candidate new cluster is created and the accumulated anomaly pool is cleared.

[0045] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S5, the obsolete pattern is eliminated to avoid the interference of the obsolete pattern on the new data. An obsolete pattern judgment mechanism based on the sample size growth rate is introduced. The pattern is considered obsolete only when no new data is added within the time window T. The obsolete judgment condition is expressed as: If satisfied, then Determined as a candidate outdated cluster; is the jth user benchmark cluster at time tT; is the number of user benchmark clusters; outdated is judged based on the sample size growth rate, and the pattern without new data added for a long time is considered redundant; relative threshold Adapt to changes in the number of clusters. The more clusters there are, the lower the growth rate is allowed to avoid over-retention; prevent outdated patterns from interfering with new anomaly detection.

[0046] Example 7, see Figure 1 This embodiment is based on the above embodiment. In step S6, the indicator monitoring warning is to evaluate the monitoring performance of the candidate cluster and calculate the data adaptability of the candidate new cluster. , expressed as: ; ; is a candidate new cluster; is the stability index; a function in the form of logistic regression is introduced to smoothly map the proportion of new pattern samples to (0,1), avoiding the rigid judgment caused by the traditional fixed threshold and taking into account the temporal dynamics, reflecting the requirement that the new pattern is relatively sufficient and stable. The closer the value is to 1, the more sufficient the new pattern samples are and the more reasonable the creation is; the effectiveness of eliminating candidate outdated clusters is calculated. , expressed as: ; ; is a candidate outdated cluster; is a growth index; the closer the value is to 1, the more outdated the model is and the more reasonable it is to eliminate it; the adaptation threshold and the old cluster threshold are set separately. If the adaptability of the candidate new cluster data is higher than the adaptation threshold, it is retained; if the elimination effectiveness of the candidate outdated cluster is lower than the old cluster threshold, it is deleted; the real-time output of candidate anomalies is a first-level warning, and SMS and email warnings are sent to users. If the accumulated anomalies trigger the update of the user benchmark library and the obtained candidate new cluster is retained, a second-level warning is output to the management personnel; the second-level warning is the final prompt to confirm the new model after the accumulation of anomalies.

[0047] By performing the above operations, we can address the problem that general security monitoring methods have bloated benchmark libraries, which interfere with the accuracy of anomaly detection of new data, and are difficult to adapt to dynamically changing user data scenarios for the identification of new scenarios and the deletion of old patterns, which in turn leads to poor monitoring effects. This solution introduces a dual-mode dynamic update mechanism. When no update is triggered, the core points are updated through weighted average, and the contribution factor is dynamically adjusted with the proportion of new data. It can adapt to the slow changes in user usage habits and identify sudden new usage scenarios of users, so that the data benchmark is always synchronized with the actual user data status. It introduces an obsolete judgment mechanism that combines the sample size growth rate with the relative threshold to avoid redundant data patterns interfering with the anomaly detection of new data. It adopts a smoothing function evaluation mechanism in the form of logistic regression to adapt to the differences in pattern stability under different user data scenarios, reduce the omission of new data patterns or the mistaken deletion of old data patterns, and thus improve the security monitoring effect.

[0048] Example 8, see Figure 2The embodiment is based on the above-mentioned embodiment, and the application provides a security monitoring system based on clustering processing, which comprises a data acquisition module, a candidate anomaly identification module, a candidate anomaly accumulation module, a user reference dynamic updating module, an obsolete mode elimination module and an index monitoring and early warning module.

[0049] The data acquisition module acquires user historical normal use data, and uses DBSCAN to construct a user reference cluster.

[0050] The candidate anomaly identification module judges candidate anomalies based on the user reference cluster for real-time data, and introduces spatial correlation degree, time continuity and an anomaly indication function to screen the candidate anomalies.

[0051] The candidate anomaly accumulation module stores the candidate anomalies in a buffer area, and triggers user reference library updating when the anomaly accumulation proportion exceeds a set threshold.

[0052] The user reference dynamic updating module uses weighted average to update core points when updating is not triggered, and applies DBSCAN to create new clusters for the accumulated anomaly pool when updating is triggered.

[0053] The obsolete mode elimination module judges and deletes obsolete user reference clusters based on sample quantity growth rate and a relative threshold in a time window.

[0054] The index monitoring and early warning module calculates candidate new cluster data adaptation degree and candidate obsolete cluster elimination effectiveness, and outputs early warning after threshold judgment.

[0055] It should be noted that, in this document, the relationship terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment.

[0056] Although the embodiments of the application have been shown and described, it can be understood by those of ordinary skill in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the application.

[0057] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. A security monitoring method based on clustering processing, characterized by: The method comprises the following steps: Step S1: Data collection: collect historical normal usage data of users and use DBSCAN to build user benchmark clusters; Step S2: Candidate anomaly identification: determine candidate anomalies based on user benchmark clusters for real-time data, and introduce spatial correlation, temporal continuity, and anomaly indicator functions to screen candidate anomalies. Step S3: Candidate anomalies are accumulated and stored in a buffer. When the accumulated anomaly percentage exceeds a set threshold, the user benchmark library is updated. Step S4: Dynamic update of user benchmarks. When no update is triggered, the core points are updated using weighted average. When an update is triggered, DBSCAN is applied to the accumulated anomaly pool to create new clusters. Step S5: Eliminate outdated patterns, based on the sample size growth rate and relative threshold within the time window, determine and delete outdated user benchmark clusters; Step S6: indicator monitoring and early warning, calculating the data adaptability of candidate new clusters and the effectiveness of eliminating candidate obsolete clusters, and outputting early warnings after threshold judgment; In step S2, it includes: introducing a candidate anomaly screening mechanism based on spatiotemporal correlation, defining the spatial correlation of candidate anomaly samples , expressed as: ; is the initial abnormal indication of the sample; K is the number of spatial neighborhood samples, and k is the neighborhood sample index; is a set of data neighborhood samples; is a data neighborhood sample; the temporal continuity T(·) of the sample is calculated to quantify the persistence of the anomaly on the time axis, which is expressed as: ; L is the measurement window; u is the time window index; t is the time mark of the current data collection; It is real-time data Corresponding to the user's u-th collected sample; define the candidate anomaly indicator function , expressed as: ; is the spatiotemporal correlation threshold.

2. The clustering-based security monitoring method according to claim 1, characterized in that: In step S2, the candidate anomaly identification is to collect real-time user usage data sets ; Determine whether each sample is a candidate anomaly; The candidate abnormality judgment conditions are expressed as: ; It is the real-time data collected; yes of The number of samples belonging to the existing user benchmark cluster within the fluctuation domain; yes of The total number of samples in the fluctuation domain; is the safety threshold.

3. The clustering-based security monitoring method according to claim 2, characterized in that: In step S3, the candidate anomaly accumulation is to store the candidate anomalies identified in real time into the candidate anomaly buffer. ; and They are the candidate anomaly buffers before and after the update respectively; set the accumulation threshold, and when the cumulative anomaly ratio exceeds the accumulation threshold, the user benchmark library update is triggered; the cumulative anomaly ratio = the cumulative number of candidate anomalies / the total data volume to date.

4. The clustering-based security monitoring method according to claim 3, wherein: In step S4, the user benchmark dynamic update is to update the core points of the user benchmark cluster when the user benchmark library update is not triggered. A weighted average update strategy is introduced. The core point update is expressed as: ; yes Belong to cluster The core point set of is the core point of the jth cluster before updating; is the core point of the jth cluster after update; is the updated cluster The core point set of is the contribution factor, ; When the user benchmark library update is triggered, a new user benchmark is created and DBSCAN is applied to the accumulated anomaly pool. If a new density cluster is formed, a candidate new cluster is created and the accumulated anomaly pool is cleared.

5. The clustering-based security monitoring method according to claim 4, characterized in that: In step S5, the obsolete pattern elimination is to introduce an obsolete pattern judgment mechanism based on the sample size growth rate. The pattern will be considered obsolete only when no new data is added within the time window T. The obsolete judgment condition is expressed as: If satisfied, then Determined as a candidate outdated cluster; is the jth user benchmark cluster at time tT; is the number of user benchmark clusters.

6. The clustering-based security monitoring method according to claim 5, characterized in that: In step S6, the indicator monitoring and early warning is to evaluate the monitoring performance of the candidate cluster and calculate the data adaptability of the candidate new cluster , expressed as: ; ; is a candidate new cluster; is the stability index; Calculate the elimination effectiveness of candidate obsolete clusters , expressed as: ; ; is a candidate outdated cluster; is the growth index; the adaptation threshold and old cluster threshold are set respectively. If the data adaptation of the candidate new cluster is higher than the adaptation threshold, it is retained; if the elimination effectiveness of the candidate obsolete cluster is lower than the old cluster threshold, it is deleted; the real-time output of candidate anomalies is a first-level warning. If the cumulative anomalies trigger the update of the user benchmark library and the candidate new cluster is retained, a second-level warning is output.

7. A clustering-based safety monitoring system, configured to implement the clustering-based safety monitoring method according to any one of claims 1 to 6, characterized in that: It includes data collection module, candidate anomaly identification module, candidate anomaly accumulation module, user benchmark dynamic update module, outdated mode elimination module and indicator monitoring and early warning module; The data collection module collects historical normal usage data of users and uses DBSCAN to build user benchmark clusters; The candidate anomaly identification module judges candidate anomalies based on user benchmark clusters in real-time data and introduces spatial correlation, temporal continuity and anomaly indicator function to screen candidate anomalies; The candidate anomaly accumulation module stores the candidate anomalies in a buffer, and when the accumulated anomaly ratio exceeds a set threshold, it triggers an update of the user benchmark library; The user benchmark dynamic update module updates the core points using weighted average when no update is triggered, and applies DBSCAN to the accumulated anomaly pool to create a new cluster when an update is triggered; The obsolete pattern elimination module determines and deletes obsolete user benchmark clusters based on the sample size growth rate and relative threshold within the time window; The indicator monitoring and early warning module calculates the data adaptability of candidate new clusters and the effectiveness of eliminating candidate obsolete clusters, and outputs an early warning after threshold judgment.

Images