Safety Monitoring Method and System Based on Clustering Processing

Abstract

This invention discloses a security monitoring method and system based on clustering. The method includes data acquisition, candidate anomaly identification, candidate anomaly accumulation, dynamic updating of user baselines, elimination of outdated patterns, and indicator monitoring and early warning. This invention belongs to the field of security monitoring, specifically referring to a security monitoring method and system based on clustering. This scheme assesses anomalies by the relative proportion of normal samples in their local neighborhoods, avoiding misjudgments; it introduces data correlation to filter isolated noise in user data transmission; it introduces temporal continuity to reduce misjudgments caused by short-term interference; it introduces a candidate anomaly buffer to avoid false triggering caused by occasional interference; it introduces a dual-mode dynamic update mechanism to ensure that the data baseline is always synchronized with the actual user data status; it introduces an outdated judgment mechanism combining sample size growth rate with a relative threshold, and uses a smoothing function evaluation mechanism in the form of logistic regression to reduce missed detection of new clusters or accidental deletion of old clusters; thereby improving the security monitoring effect.

Description

Technical Field

[0001] This invention relates to the field of safety monitoring technology, specifically to a safety monitoring method and system based on clustering processing. Background Technology

[0002] Security monitoring methods are technical means to identify data anomalies or security risks by collecting and analyzing user usage status data; their core is to promptly capture potential security vulnerabilities in user data. However, general security monitoring methods often neglect the correlation and temporal continuity between user data, can only detect single-point anomalies, are sensitive to instantaneous noise and fluctuations, and are prone to false alarms, resulting in poor monitoring accuracy. Furthermore, general security monitoring methods suffer from bloated benchmark libraries, which interfere with the accuracy of anomaly detection for new data. They also struggle to adapt to dynamically changing user data scenarios for identifying new scenarios and deleting old patterns, leading to poor monitoring performance. Summary of the Invention

[0003] To address the above issues and overcome the shortcomings of existing technologies, this invention provides a security monitoring method and system based on clustering. Addressing the problems of general security monitoring methods neglecting the correlation and temporal continuity between user data, only detecting single-point anomalies, being sensitive to instantaneous noise and fluctuations, and prone to false alarms, thus leading to poor monitoring accuracy, this solution evaluates anomalies by assessing the relative proportion of normal samples in a local neighborhood. This adapts to the differences in normal parameter ranges during different user usage periods, avoiding misjudgments caused by changes in absolute parameter values. It introduces data correlation to filter isolated noise in user data transmission; it introduces temporal continuity to distinguish between short-term fluctuations and true anomalies of continuous trends in user data, reducing misjudgments caused by short-term interference; and it introduces a candidate anomaly buffer to avoid false triggers caused by occasional interference. These improvements enhance monitoring accuracy. Existing security monitoring methods suffer from problems such as bloated benchmark libraries, which interfere with the accuracy of anomaly detection for new data. Furthermore, they struggle to adapt to dynamically changing user data scenarios when identifying new scenarios and deleting old patterns, leading to poor monitoring performance. This solution introduces a dual-mode dynamic update mechanism. When no update is triggered, core points are updated through weighted averaging, with contribution factors dynamically adjusted according to the proportion of new data. This adapts to both gradual changes in user habits and the identification of sudden new user scenarios, ensuring the data benchmark remains synchronized with the actual user data status. An outdated judgment mechanism combining sample size growth rate and relative thresholds is introduced to avoid redundant data patterns interfering with anomaly detection for new data. A smoothing function evaluation mechanism in the form of logistic regression is employed to adapt to differences in pattern stability under different user data scenarios, reducing missed detections of new data patterns or accidental deletion of old data patterns, thereby improving security monitoring effectiveness.

[0004] The technical solution adopted by this invention is as follows: The security monitoring method based on clustering processing provided by this invention includes the following steps:

[0005] Step S1: Data Acquisition;

[0006] Step S2: Candidate anomaly identification;

[0007] Step S3: Accumulation of candidate anomalies;

[0008] Step S4: Dynamic update of user baseline;

[0009] Step S5: Eliminate outdated patterns;

[0010] Step S6: Indicator monitoring and early warning.

[0011] Furthermore, in step S1, the data acquisition involves collecting historical normal usage data of the user; performing normalization processing; and using DBSCAN to construct a user baseline cluster.

[0012] Furthermore, in step S2, the candidate anomaly identification is based on the real-time user usage dataset. t is the time identifier of the current data collection; determine whether each sample is a candidate anomaly; the candidate anomaly judgment condition is expressed as: ; It is real-time data collected; yes of The number of samples belonging to the existing user benchmark cluster within the fluctuation domain; yes of Total number of samples within the fluctuation range; It is a safety threshold; a candidate anomaly screening mechanism based on spatiotemporal correlation is introduced, defining the spatial correlation of candidate anomaly samples. , represented as: ; It is a preliminary indication of anomalies in the sample; K is the number of samples in the spatial neighborhood; It is a set of samples in the data neighborhood; These are samples from the data neighborhood; the temporal continuity T(·) of the samples is calculated to quantify the persistence of anomalies on the time axis, and is expressed as: L is the measurement window; u is the time window index; yes The u-th sample collected from the corresponding user; define the candidate anomaly indicator function. , represented as: ; It is the spatiotemporal correlation threshold.

[0013] Furthermore, in step S3, the candidate anomaly accumulation involves storing the real-time identified candidate anomalies into a candidate anomaly buffer. ; and These are the candidate exception buffers before and after the update; an accumulation threshold is set, and when the accumulated exception percentage exceeds the accumulation threshold, the user benchmark database is triggered to update; the accumulated exception percentage = the number of accumulated candidate exceptions / the total amount of data up to now.

[0014] Furthermore, in step S4, the dynamic update of the user benchmark is to update the core points of the user benchmark cluster when the user benchmark library update is not triggered. A weighted average update strategy is introduced, and the core point update is represented as follows: ; yes Belongs to the cluster The core set of points; It is the core point of the j-th cluster before the update; It is the core point of the j-th cluster after the update; It is the updated cluster The core set of points; It is a contribution factor. When a user benchmark library update is triggered, a new user benchmark is created, DBSCAN is applied to the cumulative anomaly pool, and if a new density cluster is formed, a candidate new cluster is created and the cumulative anomaly pool is cleared.

[0015] Furthermore, in step S5, the elimination of outdated patterns involves introducing an outdated pattern judgment mechanism based on the sample size growth rate. A pattern is considered outdated only if no new data is added within the time window T. The outdated judgment condition is expressed as follows: If satisfied, then It was determined to be a candidate outdated cluster; It is the j-th user reference cluster at time tT; This is the number of user-based baseline clusters.

[0016] Furthermore, in step S6, the indicator monitoring and early warning involves evaluating the monitoring performance of candidate clusters and calculating the data fit of new candidate clusters. , represented as: ; ; It is a candidate new cluster; It is a stability index; used to calculate the effectiveness of eliminating candidate outdated clusters. , represented as: ; ; It is a candidate obsolete cluster; It is a growth index; set adaptation threshold and old cluster threshold respectively. If the adaptation degree of candidate new cluster data is higher than the adaptation threshold, it is retained; if the elimination effectiveness of candidate outdated clusters is lower than the old cluster threshold, it is deleted; real-time output of candidate anomalies as a first-level warning. If the candidate new clusters obtained by the user benchmark library update due to accumulated anomalies are retained, output of a second-level warning.

[0017] The security monitoring system based on clustering processing provided by this invention includes a data acquisition module, a candidate anomaly identification module, a candidate anomaly accumulation module, a user baseline dynamic update module, an outdated pattern elimination module, and an indicator monitoring and early warning module.

[0018] The data acquisition module collects historical normal usage data from users and uses DBSCAN to construct a user baseline cluster.

[0019] The candidate anomaly identification module judges candidate anomalies based on user benchmark clusters in real-time data, and introduces spatial correlation, temporal continuity and anomaly indicator function to filter candidate anomalies;

[0020] The candidate anomaly accumulation module stores candidate anomalies in a buffer. When the percentage of accumulated anomalies exceeds a set threshold, it triggers an update of the user benchmark library.

[0021] When the user baseline dynamic update module does not trigger an update, it updates the core points using a weighted average. When an update is triggered, it applies DBSCAN to the accumulated anomaly pool to create a new cluster.

[0022] The outdated pattern elimination module determines and deletes outdated user baseline clusters based on the sample size growth rate and relative threshold within the time window;

[0023] The indicator monitoring and early warning module calculates the data fit of candidate new clusters and the effectiveness of eliminating candidate outdated clusters, and outputs an early warning after threshold judgment.

[0024] The beneficial effects achieved by the present invention using the above solution are as follows:

[0025] (1) In view of the problems that general security monitoring methods ignore the correlation and time continuity between user data, can only detect single-point anomalies, are sensitive to instantaneous noise and fluctuations, are prone to false alarms, and thus have poor monitoring accuracy, this solution evaluates anomalies by the relative proportion of normal samples in the local neighborhood, adapts to the differences in normal parameter ranges of users at different usage periods, and avoids misjudgment caused by changes in absolute parameter values; introduces data correlation to filter isolated noise in user data transmission; introduces time continuity to distinguish between short-term fluctuations and true anomalies of continuous trends in user data, and reduces misjudgment caused by short-term interference; introduces a candidate anomaly buffer to avoid false triggering caused by occasional interference; and thus improves monitoring accuracy.

[0026] (2) To address the problems of bloated benchmark libraries in general security monitoring methods, which interfere with the accuracy of anomaly detection for new data and make it difficult to adapt to dynamically changing user data scenarios for identifying new scenarios and deleting old patterns, thus leading to poor monitoring results, this solution introduces a dual-mode dynamic update mechanism. When no update is triggered, the core points are updated by weighted average, and the contribution factor is dynamically adjusted according to the proportion of new data. This not only adapts to the slow changes in user habits but also identifies sudden new user scenarios, ensuring that the data benchmark is always synchronized with the actual user data status. An outdated judgment mechanism combining the sample size growth rate with a relative threshold is introduced to avoid redundant data patterns interfering with the anomaly detection of new data. A smooth function evaluation mechanism in the form of logistic regression is adopted to adapt to the differences in pattern stability under different user data scenarios, reducing the missed detection of new data patterns or the accidental deletion of old data patterns, thereby improving the security monitoring effect. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating the security monitoring method based on clustering provided by the present invention.

[0028] Figure 2 This is a schematic diagram of the safety monitoring system based on clustering processing provided by the present invention.

[0029] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0030] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0031] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0032] Example 1, see Figure 1 The present invention provides a security monitoring method based on clustering, which includes the following steps:

[0033] Step S1: Data collection, collect historical normal usage data of users, and use DBSCAN to build user baseline clusters;

[0034] Step S2: Candidate anomaly identification. Based on the user's baseline cluster, real-time data is used to identify candidate anomalies. Spatial correlation, temporal continuity, and anomaly indicator functions are introduced to filter candidate anomalies.

[0035] Step S3: Accumulate candidate anomalies. Store candidate anomalies in a buffer. When the proportion of accumulated anomalies exceeds a set threshold, trigger an update to the user benchmark library.

[0036] Step S4: User baseline dynamic update. When no update is triggered, the core point is updated using weighted average. When an update is triggered, DBSCAN is applied to the accumulated anomaly pool to create a new cluster.

[0037] Step S5: Eliminate outdated patterns. Based on the sample size growth rate and relative threshold within the time window, identify and delete outdated user benchmark clusters.

[0038] Step S6: Monitor and warn indicators, calculate the data fit of candidate new clusters and the effectiveness of eliminating candidate outdated clusters, and output warnings after threshold judgment.

[0039] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, data collection involves collecting historical normal usage data of users. The historical normal usage data of China Unicom users includes call duration, call frequency, data usage, SMS sending volume, package usage, login location, login device, and consumption amount. The data is then normalized using maximum and minimum normalization. DBSCAN is used to construct a user baseline cluster as a typical normal usage scenario for users.

[0040] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S2, candidate anomaly identification is performed on the real-time user usage dataset. t is the time identifier of the current data collection; to determine whether each sample is a candidate anomaly, the corresponding parameter deviating from the existing user baseline is used; the candidate anomaly judgment condition is expressed as: ; It is real-time data collected; yes of The number of samples belonging to the existing user benchmark cluster within the fluctuation domain; yes of Total number of samples within the fluctuation range; The fluctuation domain is centered on the sample. The set of neighbors with a radius corresponds to the normal fluctuation range of user data. It is a safety threshold; a candidate anomaly screening mechanism based on spatiotemporal correlation is introduced, defining the spatial correlation of candidate anomaly samples. The number of simultaneous anomalies is measured and represented as: ; It is a preliminary indication of anomalies in the sample, with 1 indicating anomaly and 0 indicating normality; K is the number of samples in the spatial neighborhood. It is a set of samples in the data neighborhood, taken from... Data on the N users with the most calls; It is a sample from the data neighborhood; it filters isolated outlier samples and strengthens collaborative outlier samples; it calculates the temporal continuity T(·) of the samples to quantify the persistence of outliers on the time axis, expressed as: L is the measurement window; u is the time window index; yes The u-th sample collected from the corresponding user; temporal continuity reflects the user's own abnormal persistence trend; define candidate anomaly indicator functions. , represented as: ; It is a spatiotemporal correlation threshold; based on the characteristic that normal data should be densely distributed, anomalies are judged by the proportion of normal points in the fluctuation domain, avoiding the limitations of a single threshold, so as to cope with the different normal data of users at different usage periods.

[0041] Example 4, see Figure 1 This embodiment is based on the above embodiment. In step S3, candidate anomaly accumulation involves storing the candidate anomalies identified in real time into a candidate anomaly buffer. ; and These are the candidate exception buffers before and after the update; the candidate exception buffers are initially empty; an accumulation threshold is set, and when the accumulated exception percentage exceeds the accumulation threshold, the user baseline database is triggered to update; the accumulated exception percentage = the accumulated number of candidate exceptions / the total amount of data up to now;

[0042] To avoid misjudgments caused by instantaneous network fluctuations or data transmission noise, an accumulated candidate anomaly pool is introduced. The data scenario benchmark library is only updated when the number of anomaly samples accumulates to a certain proportion, thus avoiding false triggering of a single anomaly.

[0043] By performing the above operations, this solution addresses the problems of general security monitoring methods, which neglect the correlation and temporal continuity of user data, can only detect single-point anomalies, are sensitive to instantaneous noise and fluctuations, are prone to false alarms, and thus have poor monitoring accuracy. Instead, it assesses anomalies by evaluating the relative proportion of normal samples in a local neighborhood, adapting to the differences in normal parameter ranges during different user usage periods to avoid misjudgments caused by changes in absolute parameter values. It introduces data correlation to filter isolated noise in user data transmission; it introduces temporal continuity to distinguish between short-term fluctuations and true anomalies in continuous trends of user data, reducing misjudgments caused by short-term interference; and it introduces a candidate anomaly buffer to avoid false triggers caused by occasional interference, thereby improving monitoring accuracy.

[0044] Example 5, see Figure 1 This embodiment is based on the above embodiment. In step S4, the user benchmark dynamic update introduces a dual-mode dynamic update mechanism. Based on the trigger condition judgment result, the user benchmark library is updated in two cases. When the user benchmark library update is not triggered, the core points of the user benchmark cluster are updated. The core points correspond to typical usage states. A weighted average update strategy is introduced. When the proportion of new data is larger, it will be given higher weight during the update. The core point update is represented as follows: ; yes Belongs to the cluster The core point set that satisfies the DBSCAN core point conditions corresponds to the core point performance during stable operation of the reactor. It is the core point of the j-th cluster before the update, and was not introduced. hour; It is the core point of the j-th cluster after the update; It is the updated cluster The core set of points; It is a contribution factor. When a user benchmark library update is triggered, a new user benchmark is created, DBSCAN is applied to the cumulative anomaly pool, and if a new density cluster is formed, a candidate new cluster is created and the cumulative anomaly pool is cleared.

[0045] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S5, the elimination of outdated patterns is to avoid interference from outdated patterns with new data. An outdated pattern judgment mechanism based on the sample size growth rate is introduced. Only when no new data is added within the time window T will the pattern be considered outdated. The outdated judgment condition is expressed as follows: If satisfied, then It was determined to be a candidate outdated cluster; It is the j-th user reference cluster at time tT; This refers to the number of user baseline clusters; patterns based on sample size growth rate are considered outdated, and those with no new data added for a long period are considered redundant; relative thresholds. It adapts to changes in the number of clusters; the more clusters there are, the lower the allowed growth rate, thus avoiding excessive retention; and it prevents outdated patterns from interfering with the detection of new anomalies.

[0046] Example 7, see Figure 1 This embodiment is based on the above embodiment. In step S6, the indicator monitoring and early warning is to evaluate the monitoring performance of candidate clusters and calculate the data fit of candidate new clusters. , is represented as: ; ; It is a candidate new cluster; It is a stability index; a logistic regression function is introduced to smoothly map the proportion of new model samples to (0,1), avoiding rigid judgments caused by traditional fixed thresholds, and considering time dynamics, reflecting the requirement that the new model is relatively sufficient and stable. The closer the value is to 1, the more sufficient the new model samples are and the more reasonable the creation is; the effectiveness of eliminating candidate outdated clusters is calculated. , is represented as: ; ; It is a candidate obsolete cluster; It is a growth index; the closer the value is to 1, the more outdated the pattern is and the more reasonable the elimination is; separate adaptation thresholds and old cluster thresholds are set. If the adaptation degree of the candidate new cluster data is higher than the adaptation threshold, it is retained; if the elimination effectiveness of the candidate outdated cluster is lower than the old cluster threshold, it is deleted; real-time output of candidate anomalies as a first-level warning, and SMS and email warnings are sent to users. If the accumulated anomalies trigger the update of the user's baseline database and the resulting candidate new cluster is retained, a second-level warning is output to the administrator; the second-level warning is the final prompt to confirm the new pattern after the anomaly has accumulated.

[0047] By performing the above operations, this solution addresses the problems of bloated benchmark libraries in general security monitoring methods, which interfere with the accuracy of anomaly detection for new data. Furthermore, it addresses the difficulty in adapting to dynamically changing user data scenarios for identifying new scenarios and deleting old patterns, leading to poor monitoring results. This solution introduces a dual-mode dynamic update mechanism. When no update is triggered, core points are updated through weighted average, with contribution factors dynamically adjusted according to the proportion of new data. This adapts to both slow changes in user habits and the identification of sudden new user scenarios, ensuring the data benchmark remains synchronized with the actual user data status. An outdated judgment mechanism combining sample size growth rate and relative thresholds is introduced to avoid redundant data patterns interfering with anomaly detection for new data. A smoothing function evaluation mechanism in the form of logistic regression is employed to adapt to differences in pattern stability under different user data scenarios, reducing missed detections of new data patterns or accidental deletion of old data patterns, thereby improving security monitoring effectiveness.

[0048] Example 8, see Figure 2Based on the above embodiments, the security monitoring system based on clustering processing provided by the present invention includes a data acquisition module, a candidate anomaly identification module, a candidate anomaly accumulation module, a user baseline dynamic update module, an outdated pattern elimination module, and an indicator monitoring and early warning module.

[0049] The data acquisition module collects historical normal usage data from users and uses DBSCAN to construct a user baseline cluster.

[0050] The candidate anomaly identification module judges candidate anomalies based on user benchmark clusters in real-time data, and introduces spatial correlation, temporal continuity and anomaly indicator function to filter candidate anomalies;

[0051] The candidate anomaly accumulation module stores candidate anomalies in a buffer. When the percentage of accumulated anomalies exceeds a set threshold, it triggers an update of the user benchmark library.

[0052] When the user baseline dynamic update module does not trigger an update, it updates the core points using a weighted average. When an update is triggered, it applies DBSCAN to the accumulated anomaly pool to create a new cluster.

[0053] The outdated pattern elimination module determines and deletes outdated user baseline clusters based on the sample size growth rate and relative threshold within the time window;

[0054] The indicator monitoring and early warning module calculates the data fit of candidate new clusters and the effectiveness of eliminating candidate outdated clusters, and outputs an early warning after threshold judgment.

[0055] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0056] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

[0057] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A security monitoring method based on clustering, characterized in that: The method includes the following steps: Step S1: Data collection, collect historical normal usage data of users, and use DBSCAN to build user baseline clusters; Step S2: Candidate anomaly identification. Based on the user's baseline cluster, real-time data is used to identify candidate anomalies. Spatial correlation, temporal continuity, and anomaly indicator functions are introduced to filter candidate anomalies. Step S3: Accumulate candidate anomalies. Store candidate anomalies in a buffer. When the proportion of accumulated anomalies exceeds a set threshold, trigger an update to the user benchmark library. Step S4: User baseline dynamic update. When no update is triggered, the core point is updated using weighted average. When an update is triggered, DBSCAN is applied to the accumulated anomaly pool to create a new cluster. Step S5: Eliminate outdated patterns. Based on the sample size growth rate and relative threshold within the time window, identify and delete outdated user benchmark clusters. Step S6: Indicator monitoring and early warning, calculate the data fit of candidate new clusters and the effectiveness of eliminating candidate outdated clusters, and output early warning after threshold judgment; Step S2 includes: introducing a candidate anomaly screening mechanism based on spatiotemporal correlation, and defining the spatial correlation of candidate anomaly samples. , is represented as: ; It is a preliminary indication of anomalies in the sample; K is the number of samples in the spatial neighborhood, and k is the index of the neighborhood sample; It is a set of samples in the data neighborhood; These are samples from the data neighborhood; the temporal continuity T(·) of the samples is calculated to quantify the persistence of anomalies on the time axis, and is expressed as: L is the measurement window; u is the time window index; t is the time identifier of the current data collection. It is real-time data The u-th sample collected from the corresponding user; define the candidate anomaly indicator function. , is represented as: ; It is the spatiotemporal correlation threshold.

2. The security monitoring method based on clustering processing according to claim 1, characterized in that: In step S2, the candidate anomaly identification is based on the real-time user usage dataset. Determine whether each sample is a candidate anomaly; The criteria for judging candidate anomalies are expressed as follows: ; It is real-time data collected; yes of The number of samples belonging to the existing user benchmark cluster within the fluctuation domain; yes of Total number of samples within the fluctuation range; It is a safety threshold.

3. The security monitoring method based on clustering processing according to claim 2, characterized in that: In step S3, the candidate anomaly accumulation involves storing the real-time identified candidate anomalies into a candidate anomaly buffer. ; and These are the candidate exception buffers before and after the update; an accumulation threshold is set, and when the accumulated exception percentage exceeds the accumulation threshold, the user benchmark database is triggered to update; the accumulated exception percentage = the number of accumulated candidate exceptions / the total amount of data up to now.

4. The security monitoring method based on clustering processing according to claim 3, characterized in that: In step S4, the dynamic update of the user benchmark is to update the core points of the user benchmark cluster when the user benchmark library update is not triggered. A weighted average update strategy is introduced, and the core point update is represented as follows: ; yes Belongs to the cluster The core set of points; It is the core point of the j-th cluster before the update; It is the core point of the j-th cluster after the update; It is the updated cluster The core set of points; It is a contribution factor. ; When a user benchmark library update is triggered, a new user benchmark is created, DBSCAN is applied to the cumulative anomaly pool, and if a new density cluster is formed, a candidate new cluster is created and the cumulative anomaly pool is cleared.

5. The security monitoring method based on clustering processing according to claim 4, characterized in that: In step S5, the elimination of outdated patterns involves introducing an outdated pattern judgment mechanism based on the sample size growth rate. A pattern is considered outdated only if no new data is added within the time window T. The outdated judgment condition is expressed as follows: If satisfied, then It was determined to be a candidate outdated cluster; It is the j-th user reference cluster at time tT; This is the number of user-based baseline clusters.

6. The security monitoring method based on clustering processing according to claim 5, characterized in that: In step S6, the indicator monitoring and early warning system evaluates the monitoring performance of candidate clusters and calculates the data fit of new candidate clusters. , is represented as: ; ; It is a candidate new cluster; It is a stability index; Calculate the effectiveness of eliminating candidate outdated clusters , is represented as: ; ; It is a candidate obsolete cluster; It is a growth index; set adaptation threshold and old cluster threshold respectively. If the adaptation degree of candidate new cluster data is higher than the adaptation threshold, it is retained; if the elimination effectiveness of candidate outdated clusters is lower than the old cluster threshold, it is deleted; real-time output of candidate anomalies as a first-level warning. If the candidate new clusters obtained by the user benchmark library update due to accumulated anomalies are retained, output of a second-level warning.

7. A cluster-based security monitoring system, used to implement the cluster-based security monitoring method as described in any one of claims 1-6, characterized in that: It includes a data acquisition module, a candidate anomaly identification module, a candidate anomaly accumulation module, a user benchmark dynamic update module, an outdated pattern elimination module, and an indicator monitoring and early warning module; The data acquisition module collects historical normal usage data from users and uses DBSCAN to construct a user baseline cluster. The candidate anomaly identification module judges candidate anomalies based on user benchmark clusters in real-time data, and introduces spatial correlation, temporal continuity and anomaly indicator function to filter candidate anomalies; The candidate anomaly accumulation module stores candidate anomalies in a buffer. When the percentage of accumulated anomalies exceeds a set threshold, it triggers an update of the user benchmark library. When the user baseline dynamic update module does not trigger an update, it updates the core points using a weighted average. When an update is triggered, it applies DBSCAN to the accumulated anomaly pool to create a new cluster. The outdated pattern elimination module determines and deletes outdated user baseline clusters based on the sample size growth rate and relative threshold within the time window; The indicator monitoring and early warning module calculates the data fit of candidate new clusters and the effectiveness of eliminating candidate outdated clusters, and outputs an early warning after threshold judgment.

Images