The invention discloses a switch data
anomaly detection method based on a vector autoregression model, and relates to the technical field of communication
processing. Aiming at the defects of an existing
anomaly detection method, the adopted technical scheme comprises the steps of obtaining operation behavior data of a login user in a switch in real time, and storing the operation behavior data ina
data set; performing
graph mapping on the operation behavior data contained in the
data set, and converting the operation behavior data into a symbolic graph; for the symbolic graph, introducing analgorithm with a vector autoregression model to carry out
anomaly detection, and carrying out analysis by utilizing a
Granger causality; according to an analysis result, identifying abnormal points in the symbolic graph, and determining that the operation of the user belongs to an
attack behavior; and locking the user, feeding a locking result back to the switch control part, and enabling the switch control part to cancel the operation authority of the user and take
countermeasure. According to the method, improper behaviors of operation can be discovered in advance, wrong identification of normal users is avoided, and security holes in the
industrial Internet are filled in a targeted manner.