57 results about "Primary clustering" patented technology

The invention discloses a POI (Point Of Interest) labeling method and device. The method comprises the steps of receiving multiple POI data uploaded by multiple users; carrying out primary clustering on the multiple POI data according to position information by employing a clustering algorithm to generate multiple clustering areas; carrying out secondary clustering on the multiple clustering areas respectively according to names of POIs to generate multiple clustering result sets; and labeling position areas in which the POIs exist according to the multiple clustering result sets. According to the method, by employing mass POI position and attribute information uploaded by the users, the POIs are dug out quickly and accurately, so the cost of manpower and material resources is saved, the POI update speed is improved, and the POI labeling efficiency is improved.

The invention discloses a message analysis-based protocol format automatic inferring method, which is a method used for analyzing the input and output messages of a protocol entity so as to infer the specific format of the protocol messages. The method comprises the following steps of: firstly, according to the displayable attribute of characters, segmenting the obtained network message in bytes, and carrying out primary clustering based on a format sequence presented by segmentation; secondly, carrying out multi-sequence comparison on the message samples with similar structure by taking the segment as a unit, realizing alignment and length unification of message segments, thereby mastering the basic structure of the message segments and obtaining the whole structure of the message; and finally, carrying out a semantic inferring phase, based on the structure of the message, according to the value and the change features of each field in the sample, following the identification strategies of various semantics, and using the semantic inferring flow of interval field, data field, serial number field, length field and format identifier field. The accuracy and the efficiency of semantic inferring are improved.

The invention discloses a network topology identification method based on flow analysis, relating to the technical field of large-scale IP network topology probe. The method comprises the following steps: deploying measuring points on the backbone link of the network, analyzing the flow hop-count and the round-trip-time (RTT) and then carrying out primary clustering and secondary clustering, thus forming the network topology. The method solves the following technical problems in the prior art: a large amount of detection flow is generated, the burden of the nodes is increased, application is limited and the detection cycle is long. The identification result of the method is more accurate.

The invention discloses an efficient and reliable anomaly detection method for MMORPGs. The method comprises the steps of 1, mapping a player event to a ''player ID-timestamp-operation ID-parameter'' four-dimensional space by means of a tetrad, aggregating the full-scale events of all players, splitting a player sequence into rank sequences with upgrading as the time point for splitting, and conducting operation frequency statistics on the rank sequences; 2, conducting event frequency extraction on all users based on the same rank, and conducting normalization on each event frequency; 3, taking operation union sets of all players according to rank, and conducting equal-length extension on the operation of each player to obtain a numeric type vector; and 4, conducting column-based clustering, conducting dimensionality reduction on k events with the best clustering effect, conducting secondary clustering, dividing players into a plug-in cluster and multiple normal clusters, and conducting clustering on the clusters with the highest recall rate, so that detection is achieved. Corresponding detection devices include a log discretization module, a MeanShift module, a normalization module, a dimensionality reduction module, a primary clustering module and modules before the primary clustering module. The efficient and reliable anomaly detection method for MMORPGs is used for plug-in detection of MMORPGs.

The invention discloses a design method of a multi-dimension attribute data oriented multi-layered clustering fusion mechanism. The method comprises the following steps: 1) converting a data set into a matrix form, and preprocessing data; 2) according to data index attribute characteristics, extracting an optimal reference standard, and carrying out normalization processing on the data; 3) calculating a grey correlation degree, generating a similar matrix of the grey correlation degree, and then, carrying out grey correlation degree clustering to obtain a primary clustering result; 4) according to the primary clustering result in the step 3), adopting a rough set theory to establish a decision table system; 5) calculating an attribute significance information entropy of the decision system for each clustering member; 6) setting a weight for each clustering member; and 7) according to the calculated weight, adopting a probability method to calculate a probability of each data object in each class level to which the data object belongs, selecting the class level where the data object belongs to when the probability is highest to serve as the class level to which the data object belongs to, and obtaining a final clustering fusion result.

The invention provides a set characteristic vector-based quick clustering method and a set characteristic vector-based quick clustering device. The method comprises the following steps of: (1) converting input hybrid attribute data into a binary attribute; (2) sequencing according to an object sparsity index or a non-interference sequence index; (3) independently categorizing a first sequenced object to obtain a set characteristic vector of the first object, then sequentially scanning other objects to be clustered, and determining whether a presently scanned object is incorporated into an established category or an independently established new category by sizes of set difference and set difference upper limit b1 for incorporating the object into the established category; and (4) performing secondary clustering on a primary clustering result obtained by the step (3), and then removing an isolated point in the clustering result to obtain a final clustering result. According to the method and the device, a clustering process can be finished by only performing sequencing and scanning on the data once, the time required by clustering is greatly shortened while the clustering quality is considered, and the clustering result cannot be limited to influence of a data input sequence.

The invention discloses a method and equipment for clustering network flow. The method comprises the following steps of: acquiring global network flow; cutting the global network flow according to a single user to generate sample data; classifying network flow types of the flow according to the sample data; and selecting different characteristic combinations for clustering according to the flow types. The equipment comprises an acquiring unit, a sample data generating unit, a primary clustering unit and a secondary clustering unit. The method for clustering network flow has the advantages of high accuracy, high efficiency, wide flow identification range and capability of accurately mining application quantity in the network flow, and can be realized as network flow control equipment.

The invention discloses a pilot frequency distribution method for twice clustering and classifying of a large-scale MIMO (Multiple Input Multiple Output) system. The pilot frequency distribution method specifically comprises the following steps: step 1, L cell base stations respectively calculate large-scale fading factors of all users in a cell where the L cell base stations are located; step 2,the L cell base stations calculate a user primary clustering threshold value, and perform primary clustering classification on all users in the cell according to the user primary clustering thresholdvalue; 3, the L cell base stations calculate secondary clustering thresholds of the users; step 4, the L cell base stations classify all the user categories of the primary clustering edge category inthe cell again according to the secondary clustering threshold of the users; step 5, the L cell base stations sort the secondary clustering center type users; step 6, a pilot frequency set is divided;step 7, the pilot frequency is distributed. The method has the beneficial effects that the quality of service (Quality of Service. QoS) of edge group users is improved on the premise of reducing theperformance loss of central group users; and pilot pollution is effectively suppressed.

The invention relates to a distributed double-layer clustering analysis method based on feature index dimension reduction. The method belongs to the field of power system user response clustering algorithms, and comprises the following steps: S1, collecting intelligent electric meter data, transmitting the intelligent electric meter data to a nearest local site, decomposing a large number of loadcurves into a plurality of small-scale independent sub-data according to the sites to which the load curves belong, and further dividing the sites with more load curves; s2, carrying out data dimension reduction on the load data decomposed to each station, carrying out primary clustering by adopting a clustering algorithm with relatively low complexity, and clustering different customers in the region to obtain a clustering result; s3, forwarding clustering results (only uploading the clustering center without uploading all data) obtained from different local sites to a global data center forsecondary clustering, and obtaining a final clustering result; and S4, the global data center feeds back a global clustering result to each local site, and performs user power consumption behavior analysis.

A method and an apparatus for generating a superpixel cluster for an image or a sequence of images. A primary clustering unit generates a primary superpixel cluster using a fixed reference superpixel, whereas a secondary clustering unit generates two or more secondary superpixel clusters using a propagating reference superpixel. A combining unit then combines intersections between the primary superpixel cluster and the two or more secondary superpixel clusters to generate a final superpixel cluster.

Embodiments of the invention provide an unsupervised encrypted malicious flow detection method and apparatus, a device and a medium. The method comprises the following steps that a needed data featureset is collected based on network flow; a bipartite graph between a client and a server is built by utilizing the collected data feature set; primary clustering is carried out on client and server nodes through a graph segmentation method; vectorization processing is carried out on the client and server nodes in a relatively large connected sub-graph in the primary clustering; vectorized data isclustered again by using a DBScan algorithm; and malicious flow and nodes are judged by utilizing a clustering result after re-clustering. By utilizing a graph-based unsupervised learning model, encrypted flow can be directly detected without priori knowledge and a labeling sample set; different types of clusters are obtained by carrying out binary segmentation on the graph; a large cluster is converted into small clusters; and the malicious flow is identified by performing check through flow characteristics. The method is simple and easy to operate.

The invention discloses a direct-driven wind power plant dynamic equivalence method for subsynchronous oscillation analysis. The method comprises the following steps of 1, distinguishing a subsynchronous oscillation mode of each fan according to the environmental excitation response data; 2, performing clustering according to the subsynchronous oscillation frequency to obtain a fan primary clustering result; 3, performing further classification through comparison on the primary clustering result obtained in the step 2 according to subsynchronous oscillation damping to obtain the fan final clustering result; 4, performing equivalence on the fan parameter in the final clustering result obtained in the step 3 according to a weighing equivalence method; 5, performing equivalence on the networkparameter in the final clustering result obtained in the step 3 according to the principle that the voltage loss before and after the equivalence is unchanged; 6, obtaining an equivalent model according to the equivalent result of the step 4 and the step 5, and performing subsynchronous oscillation analysis. According to the invention, the weak damping subsynchronous oscillation mode of a wind power plant is well reserved; the method is applicable to the direct-driven wind power plant subsynchronous oscillation analysis; the data can be easily obtained; the online application can be realized.

The invention relates to a power battery sorting system and method. The power battery sorting system comprises charge and discharge equipment sets, edge computers and a cloud platform, on this basis,a time series distributed type clustering method is applied, a 'cloud-edge' collaborative manner is innovatively adopted, and traditional battery sorting systems and methods are innovated. The power battery sorting method comprises the steps that the calculation capacity of the edge computers is sufficiently utilized firstly to perform local defect product detection and primary clustering; then all local processing results are uploaded to the cloud end to perform global defect product fusion, division and edge-based clustering fusion; and then global processing results are finally downloaded to the edge computers to perform multi-factor collaborative grouping decision-making, and power battery optimization sorting is realized. By means of the power battery sorting system and method, the battery sorting accuracy can be improved, the time required for sorting is shortened, the life of a battery pack is prolonged, and the power battery sorting system and method have important practical significance for enterprises.

The invention discloses a large data classification method, device and equipment based on a hard clustering algorithm, wherein the method comprises the following steps of acquiring the data information, dividing the data information into N sample data; carrying out the initial hard clustering analysis for each sample data, and determining N*K1 initial clustering centers; based on the secondary hard clustering analysis of N*K1 primary clustering centers, identifying K2 secondary clustering centers; according to the K2 secondary clustering centers, dividing the data information into K2 classification items, and storing each classification item and corresponding data information in a database. Through the scheme, the accuracy of the obtained secondary clustering center is higher, so that theclassification effect based on the secondary clustering center is better, and each classification item obtained can have more distinctive characteristics, and accordingly users can better distinguishthe various classification items, and cannot be confused.

The invention provides a DDoS attack detection method based on an intelligent bee colony algorithm. Through fusion of a clustering algorithm and an intelligent bee colony algorithm, the DDoS attack detection accuracy is effectively improved. The fusion of the intelligent bee colony algorithm and the clustering algorithm can eliminate the defect that the clustering algorithm excessively relies on an original clustering center and thus improve the data flow clustering effect. The IP addresses of exceptional data flows clustered after improvement are statistically analyzed and the flow characteristic entropy H (x) of the IP addresses are calculated; if H (x) is greater than and equal to a discriminating factor RM (x) of a primary clustering data flow, it is judged that the data flows are DDoSattack data flows; otherwise, it is determined that the data flows are other exceptional data flows. The method has the advantages of less time consumption, high DDoS attack detection accuracy and low false alarm rate.

The invention discloses a text clustering method and device and relates to the technical field of computers. The text clustering method and device is invented for solving the problem of a poor large-scale text clustering effect. The text clustering method comprises the steps that primary clustering is conducted on a text set according to a predetermined text cluster number k to obtain k first-class text clusters, wherein k is a positive integer greater than 1; a target first-class text cluster is obtained, wherein the text number included by the target first-class text cluster is greater than k; secondary clustering is conducted on the target first-class text clusters according to the k. The text clustering method and device is mainly applied to the clustering process of large-scale text sets.

The invention discloses a data index establishment method and device, a data retrieval method and device, equipment and a storage medium. The method comprises: in a data index establishment process, firstly, according to data sets of different data size levels, selecting different segmented clustering models to perform primary clustering on the data samples in the data set to obtain different first-class clustering centers, performing secondary clustering by using a quantizer associated with the first-class clustering centers to obtain different second-class clustering centers, and obtaining an index table based on the different second-class clustering centers; and in the data retrieval process, performing image data retrieval by utilizing the index table obtained in the data index establishment process. According to the method, massive sample data is segmented and clustered for multiple times in advance, and indexes are established, so that the clustering effect and the precision of aclustering center are improved. Meanwhile, in the data retrieval process, high-precision and high-efficiency image data retrieval is realized based on a pre-established index.

The invention relates to normal and abnormal data partitioning method and system for a multivariable alarming system. The method comprises steps: the minimum duration and the minimum deviation are selected, and a variation direction combination relation matrix of variables under a normal condition is constructed; time sequences of variables in data collection are standardized to obtain a standardized matrix; a time dimension is added to the standardized data matrix, primary clustering is carried out in the time dimension, the influence that local mutation caused by strong noise is recognized as a local trend can be eliminated, and the noise can be effectively reduced; and clusters obtained through the primary clustering are merged to recognize adjacent similar data segments; and secondaryclustering is carried out in a variable dimension, and similar data segments at a far time interval can be recognized. The error report rate can be greatly reduced while a high calculation speed is kept. Compared with the traditional method, the method and the system have huge advantages in recognizing the stage and the variation trend of the system.

The embodiment of the invention provides an incremental clustering method and device, which are used for clustering newly added data points each time after primary clustering on the basis of obtaininga primary clustering result according to a density-based hierarchical clustering algorithm. The method comprises the steps that for newly-added data points, the maximum value of the class density ofall classes serves as the neighborhood radius, and the data points in the neighborhoods of the newly-added data points are acquired; and according to the class density of each class to which the datapoint in the neighborhood of the newly added data point belongs, determining the class to which the newly added data point belongs. The device comprises a neighborhood scanning module and an incremental clustering module. According to the incremental clustering method and device provided by the embodiment of the invention, incremental clustering is carried out on the basis of the density-variableclustering result.

The invention discloses a thermal power generating unit peak regulation capability prediction method, device and system. The method comprises the following steps of screening out a data set from historical data of thermal power generating unit operation; determining the optimal clustering number according to the BIC value; performing primary clustering on the data set based on a K-means algorithm;performing secondary clustering on the data set based on a GMM algorithm; and determining the class cluster with the highest similarity in all the class clusters according to the collected real-timedata, and taking the maximum value of the optimization parameter in the class cluster with the highest similarity and the minimum value of the optimization parameter in all the class clusters as prediction results. According to the method, the optimal clustering number of a sample set and the initial parameters of a GMM algorithm are determined through a BIC value and a K-means algorithm, the accuracy of solving the Gaussian distribution parameters by utilizing the EM algorithm is effectively improved, so that the accuracy of final prediction is improved; according to the thermal power generating unit peak load regulation capacity prediction method, device and system, online prediction can be carried out on the thermal power generating unit peak load regulation capacity, and a data basis can be provided for a power grid to compile a load scheduling strategy.