A multi-level
anomaly detection method based on
exponential smoothing, sliding window distribution statistics and an integrated learning model comprises the following steps of a statistic detection stage, an integrated learning training stage and an integrated learning classification stage, wherein in the statistic detection stage, a, a key
feature set is determined according to the application scene; b, for discrete characteristics, a model is built through a sliding window distribution
histogram, and a model is built through
exponential smoothing for continuous characteristics; c, the observation features of all key features are input periodically; d, the process is ended. In the integrated learning training stage, a, a training
data set is formed by marked normal and abnormal examples; b, a
random forest classification model is trained. The method provides a general framework for
anomaly detection problems comprising
time sequence characteristics and complex behavior patterns and is suitable for online permanent detection, the
random forest model is used in the integrated learning stage to achieve the advantages of parallelization and high generalization ability, and the method can be applied to multiple scenes like business violation detection in the telecom industry,
credit card fraud detection in the financial industry and
network attack detection.