CN103618651B - It is a kind of based on comentropy and the network anomaly detection method and system of sliding window - Google Patents
It is a kind of based on comentropy and the network anomaly detection method and system of sliding window Download PDFInfo
- Publication number
- CN103618651B CN103618651B CN201310676371.7A CN201310676371A CN103618651B CN 103618651 B CN103618651 B CN 103618651B CN 201310676371 A CN201310676371 A CN 201310676371A CN 103618651 B CN103618651 B CN 103618651B
- Authority
- CN
- China
- Prior art keywords
- entropy
- time window
- window
- time
- comentropy
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses a kind of based on comentropy and the network anomaly detection method and system of sliding window, the method comprises the steps：Define the sliding distance of time window size and time window；According to sliding window, the progressive entropy and entropy ratio for calculating each time window successively is set；If the entropy for calculating time window is less than given threshold value or entropy ratio is more than given threshold value, the situation of rule before then judging to have data mutation in this time window or do not meet, generation Network Abnormal, entropy model and sliding window technique are introduced Network Abnormal and are pinpointed the problems by the present invention, Network Abnormal can be found quickly, simplified model to a certain extent and can quickly be found Network Abnormal.
Description
Technical field
The present invention relates to a kind of network anomaly detection method and system, more particularly to a kind of to be based on comentropy and sliding window
The network anomaly detection method and system of mouth.
Background technology
The method that the method for Network anomaly detection is mainly based upon statistics at present, wherein mainly including following five kinds：1) threshold
Value detection technique.For example, detect the number of times of password mistake at short notice.2) average and standard deviation modelling technique.By meter
The average and standard deviation of parameter are calculated, confidence interval is set, shows there is exception when observation exceedes the scope of confidence interval.
3) set up multivariate model.Its detection is noted abnormalities based on carrying out correlation analysiss to two or more parameters.4) Ma Er can
Husband's model.Using each different type of audit event as a state variable, state is described using a state-transition matrix
Change, the less state matrix transfer of probability are probably abnormal generation point.5) time series models.Consider that a series of observations occur
Order, the time of advent and value to be noting abnormalities.
But above-mentioned network anomaly detection method respectively has as a drawback that：The model of first method is relatively simple, so
And which cannot detect more Deviant Behavior types；For second method, due to confidence interval need it is artificial by experience
Arrange, it is therefore desirable to which the failure of more number of times and experience are generating believable confidence interval；The third method model is complicated, and
As a result can have and have a greater change as parameter is different；Send out method for 4th kind and be applied to situation of the variable for continuous parameter, for
It is sampled as centrifugal pump and obtains situation obtaining effective result；The result of fifth method depends on the size that time window is arranged.
The content of the invention
To overcome the shortcomings of that above-mentioned prior art is present, the purpose of the present invention is to provide one kind based on comentropy and slip
The network anomaly detection method and system of window, finds to ask by entropy model and sliding window technique are introduced Network Abnormal
Topic, can find Network Abnormal quickly, simplify model to a certain extent and can quickly find Network Abnormal.
It is that up to above and other purpose, the present invention proposes a kind of based on comentropy and the Network anomaly detection side of sliding window
Method, comprises the steps：
Step one, defines the sliding distance of time window size and time window；
Step 2, arranges the progressive entropy and entropy ratio for calculating each time window successively according to sliding window；
Step 3, if the entropy for calculating the time window for obtaining is less than given threshold value or entropy ratio is more than given threshold value,
Before judging to have data mutation in this time window or do not meet, there is Network Abnormal in the situation of rule.
Further, step 2 also comprises the steps：
Step 2.1, calculates the bit number x of Each point in time in time windowiWith normalized value zi；
Step 2.2, according to bit number xiWith normalized value ziCalculate z on each time pointiProbability p (zi)；
Step 2.3, according to z on each time pointiProbability p (zi) time window is calculated in ziOn entropy and entropy ratio.
Further, in step 2.1, the bit number x of Each point in time in time window is calculated according to equation belowiWith
Normalized value zi：
xi=bi-bi-1；
WhenWhen；
WhenWhen,
Wherein biFor the desired value at time point i (i=k, k+1 ..., k+n) place,
Further, in step 2.2, z on each time point is calculated according to equation belowiProbability p (zi)：
WhereinFor average,For variance.
Further, in step 2.3, time window TW is calculated according to equation belowkIn ziOn entropy E (TWk)：
Further, in step 2.3, the entropy ratio of m-th time window be the entropy of front s window meansigma methodss divided by
The entropy of m-th time window.
Further, the desired value is selected from the interfaces classes in router administration information bank.
To reach above-mentioned purpose, the present invention also provides a kind of Network anomaly detection system based on comentropy and sliding window
System, at least includes：
Time window setup module, for defining the sliding distance p of time window size n and time window；
Entropy and entropy ratio calculation module, according to sliding window arrange the progressive entropy for calculating each time window successively and
Entropy ratio；
Judge module, according to the entropy or entropy ratio and the comparative result of given threshold value that calculate the time window for obtaining, sentences
It is disconnected whether Network Abnormal to occur.
Further, if the entropy for calculating the time window for obtaining is less than given threshold value or entropy ratio is more than given threshold value,
Before then the judge module judges to have data mutation in this time window or do not meet, there is network different in the situation of rule
Often.
Further, the entropy and entropy ratio calculation module calculate the bit number x of Each point in time in time window firsti
With normalized value zi, then according to obtain Each point in time bit number xiWith normalized value ziCalculate z on each time pointi's
Probability p (zi), finally according to ziProbability p (zi) time window is calculated in ziOn entropy and entropy ratio.
Compared with prior art, a kind of network anomaly detection method based on comentropy and sliding window of the present invention is by inciting somebody to action
Entropy model and sliding window technique introduce Network Abnormal and pinpoint the problems, and can find Network Abnormal quickly, in certain journey
Model is simplified on degree and Network Abnormal can be quickly found.
Description of the drawings
Fig. 1 is the MIB interface classes record sectional drawing of certain catenet supply equipment business in present pre-ferred embodiments；
Fig. 2 be present pre-ferred embodiments in set gradually equal-sized time window schematic diagram；
Fig. 3 is the setting schematic diagram of sliding time window in present pre-ferred embodiments；
The step of Fig. 4 is a kind of network anomaly detection method based on comentropy and sliding window of present invention flow chart；
Fig. 5 is a kind of system architecture diagram of the Network anomaly detection system based on comentropy and sliding window of the present invention
Fig. 6 is that the entropy for carrying out 9 windows of abnormality detection with ifInOctets variables in 1 of testing of the present invention is illustrated
Figure；
Fig. 7 is IfInOctets the and IfInDiscards index ASSOCIATE STATISTICS for testing router gw2 mouths in 2 of the present invention
Schematic diagram；
Fig. 8 is the entropy and entropy ratio schematic diagram of testing each time window in 4320-4560 minutes in 2 of the present invention.
Specific embodiment
Below by way of specific instantiation and embodiments of the present invention are described with reference to the drawings, those skilled in the art can
The further advantage and effect of the present invention are understood easily by content disclosed in the present specification.The present invention also can be different by other
Instantiation implemented or applied, the every details in this specification also can based on different viewpoints with application, without departing substantially from
Various modifications and change are carried out under the spirit of the present invention.
Before the present invention is introduced, first for selected by the present invention and the data source and theory basis of collection is Jie
Continue：
(1) selection and collection of data source
Router administration information bank (Management Information Base, abbreviation MIB) is with 11 class object numbers
According to, including system essential information such as system classes or with protocol-dependent information such as IP classes and TCP classes etc., due to these data it is non-
Numeric type and too strong with network application dependency, is not suitable as the abnormality detection of universality.
In the present invention, choose router administration information bank MIB in interfaces classes be index set, the type mark
Be network interface information, it is such as by quantity of packet of interface etc., unrelated with specific agreement, therefore this kind of data refer to
Mark with using unrelated universality, it is adaptable to as the abnormality detection of the router of universality.Interfaces classes are main
It is including 12 kinds of numeric type variable indexs, as shown in table 1 below：
Interfaces classes leading indicator list in table 1.MIB
| Object indications | ASN.1 is encoded | Data type | Object factory |
| ifInOctets | 1.3.6.1.2.1.2.2.1.10 | Counter32 | The total bit number that interface is received |
| ifInUcastPkts | 1.3.6.1.2.1.2.2.1.11 | Counter32 | The unicast packet number that interface is received |
| ifInNUcastPkts | 1.3.6.1.2.1.2.2.1.12 | Counter32 | The non unicasting packets number that interface is received |
| ifInDiscards | 1.3.6.1.2.1.2.2.1.13 | Counter32 | The bag number that interface is received and abandoned |
| ifInErrors | 1.3.6.1.2.1.2.2.1.14 | Counter32 | The error bag number that interface is received |
| ifInUnknownProtos | 1.3.6.1.2.1.2.2.1.15 | Counter32 | The unknown protocol bag number that interface is received |
| ifOutOctcts | 1.3.6.1.2.1.2.2.1.16 | Counter32 | The total bit number that interface sends out |
| ifOutUcastPkts | 1.3.6.1.2.1.2.2.1.17 | Counter32 | The unicast packet number that interface sends out |
| ifOutNUcastPkts | 1.3.6.1.2.1.2.2.1.18 | Counter32 | The non unicasting packets number that interface sends out |
| ifOutDiscards | 1.3.6.1.2.1.2.2.1.19 | Counter32 | The bag number of the need transmission that interface is abandoned |
| ifOutErrors | 1.3.6.1.2.1.2.2.1.20 | Counter32 | The error bag number that interface cannot be transmitted |
| ifOutQLcn | 1.3.6.1.2.1.2.2.1.21 | Unsigned32 | The length that transmission bag is lined up |
In present pre-ferred embodiments, data source picks up from the real-time MIB data of certain catenet equipment supplier offer
Record, all can be updated to MIB per 2 minutes in router.For example, Fig. 1 is interfaces classes record sectional drawing in MIB, by
Fig. 1 understands that the total bit number (ifInOctets indexs) that August Monday 11: 44 on the 4th tap mouth is received is 828590480, is connect
The bag number (ifInDiscards indexs) that mouth is received and abandoned is then 0.
(2) technology path
As a example by carrying out Network anomaly detection in the ifInOctets indexs in MIB, if time window TWkRepresent from when
Between point k to time point k+n (wherein window size be n, time point unit be minute) time period, time point i (i=k, k+
1 ..., k+n) the ifInOctets desired values (i.e. the total bit number that interface is received at time point i) at place are bi, then interface when
Between the bit numbers that receive of point i be
xi=bi-bi-1. (1)
For measure time window TWkInterior reception bit xiUncertainty, can be embodied by its comentropy.Normalization xi,
Order
When
Or
When
WhereinAssume that ziCertain probability distribution, such as normal distribution are approximately obeyed, z is calculatedi's
Distribution probability
WhereinFor average,For variance.Then time window TWkIn variable ziOn
Entropy be calculated as
Due to p (zi) interval for (0,1], therefore log (p (zi))≤0 and with p (zi) monotonic increase, then E (TWk)
With p (zi) monotonic increase.Therefore, if the bit number that window interior is received occurs abnormal, ziMeet the probability drop of normal distribution
Low, entropy diminishes.Vice versa.
In order to preferably reflect the change of network reception bit in nearly a period of time, can be by calculating for the previous period
The ratio of the mean entropy and current window entropy of (such as front s time window) defines m-th window reflecting the change of current entropy
Entropy ratio be front s window entropy meansigma methodss divided by m-th window entropy, i.e.,：
If entropy ratio ER (TWm) Network Abnormal is there occurs in given threshold value, this time window.
In the setting of time window, there is two ways：The first is to choose equal-sized window (TW successively1,
TW2,…TWm), calculate the entropy or entropy ratio of each window, such as Fig. 2；Another mode, then using sliding window technique, after
One time window is previous time window forward slip p (p<N) individual time point is formed and (the first side is as p=n
Formula).Such as Fig. 3.
The step of Fig. 4 is a kind of network anomaly detection method based on comentropy and sliding window of present invention flow chart.Such as
Shown in Fig. 4, the present invention is a kind of based on comentropy and the network anomaly detection method of sliding window, comprises the steps：
Step 401, defines the sliding distance p of time window size n and time window.
Step 402, arranges the progressive entropy and entropy ratio for calculating each time window successively according to sliding window.At this
In bright preferred embodiment, step 402 further includes following steps：
(1) according to aforementioned formula (1), (2) and (3) calculate the bit number x of Each point in time in time windowiAnd normalization
Value zi；
(2) z on each time point is calculated according to aforementioned formula (4)iProbability p (zi)；
(3) time window is calculated in z according to aforementioned formula (5), (6)iOn entropy and entropy ratio.
Step 403, judges abnormal：If the entropy for calculating time window is less than given threshold value or entropy ratio more than given threshold
Value, that is, the situation of rule before judging to have data mutation in this time window or do not meet, it is possible to occur abnormal.
Fig. 5 is a kind of system architecture diagram of the Network anomaly detection system based on comentropy and sliding window of the present invention.Such as
Shown in Fig. 5, a kind of Network anomaly detection system based on comentropy and sliding window of the present invention is at least arranged including time window
Module 501, entropy and entropy ratio calculation module 502 and judge module 503.
Wherein time window setup module 501 is used for the sliding distance p for defining time window size n and time window；Entropy
Value arranges the successively progressive entropy and entropy ratio that calculate each time window according to sliding window with entropy ratio calculation module 502,
Specifically, entropy and entropy ratio calculation module 502 calculate the bit number x of Each point in time in time window firstiAnd normalizing
Change value zi(according to formula (1), (2), (3)), then according to obtain Each point in time bit number xiWith normalized value ziCalculate
Z on each time pointiProbability p (zi) (according to formula (4), finally according to ziProbability p (zi) time window is calculated in ziOn entropy
Value and entropy ratio (according to formula (5), (6))；Judge module 503 is then according to the entropy or entropy ratio for calculating the time window for obtaining
With the comparative result of given threshold value, judge whether Network Abnormal, if the entropy of the time window for obtaining is calculated less than given
Threshold value or entropy ratio are more than given threshold value, that is, the situation of rule before judging to have data mutation in this time window or do not meet
Occur, it is possible to occur abnormal.
Hereinafter the beneficial effect of the present invention will accordingly be verified by several experiments.
Experiment 1.
Tested with the ifInOctets indexs in MIB database, according to above-mentioned algorithm, tested 9 time windows
Interior entropy, wherein abscissa are the time (unit is minute), and vertical coordinate is that z (t) represents ifInOctets desired values, each window
Entropy calculates such as Fig. 6.
From fig. 6 it can be seen that where curve is gentler, entropy is less, abnormal to be more likely to occur, vice versa.
Experiment 2.
Integrated survey index IfInOctets (being represented with x (t)) and index IfInDiscards (being represented with y (t)), wherein
IfInOctets indicates the total bit number that interface is received, and IfInDiscards indicates the bag number that interface is received and abandoned, if z (t)
=x (t)+α y (t), wherein α=3000 are weight.Fig. 7 is the statistical Butut in router gw2 interfaces to these data.
For Fig. 7 (c), if window size is 10, sliding distance is 10, calculates 4320-4560 minutes each window using algorithm
Mouth entropy and entropy ratio are shown in Fig. 8.
In fig. 8, the first row data are the entropy of each time window, the entropy ratio of second behavior each time window, this
In we using current window entropy and the mean entropy of 12 windows (i.e. 2 hours) before ratio.As can be seen that time window
The entropy and entropy ratio of [4410,4420] is respectively 2.7659e-008 and 6.2034, the entropy of time window [4430,4440]
1.4009e-008 and 9.0558 is respectively with entropy ratio, time window [4440,4450] entropy and entropy ratio are respectively
1.7876e-008 and 5.7915, all far beyond the threshold value for setting in a program.Therefore system judges：At 4410 points extremely
4450 points (with the window of circles mark) detects Network Abnormal in this 40 minutes.It is obvious that this data exception is from Fig. 7
In (c) can also manual observation obtain.
In sum, a kind of network anomaly detection method based on comentropy and sliding window of the present invention is by by comentropy
Model and sliding window technique introduce Network Abnormal and pinpoint the problems, and can find Network Abnormal quickly, to a certain extent letter
Change model and can quickly find Network Abnormal.
The principle and its effect of above-described embodiment only illustrative present invention, it is of the invention not for limiting.Any
Art personnel under the spirit and the scope without prejudice to the present invention can be modified to above-described embodiment and are changed.Therefore,
The scope of the present invention, should be as listed by claims.
Claims (8)
1. a kind of based on comentropy and the network anomaly detection method of sliding window, comprise the steps：
Step one, defines the sliding distance of time window size and time window；
Step 2, arranges the progressive entropy and entropy ratio for calculating each time window successively according to sliding window；
Step 3, if the entropy for calculating the time window for obtaining is less than given threshold value or entropy ratio is more than given threshold value, judges
Before having data mutation in this time window or not meeting, there is Network Abnormal in the situation of rule；
Wherein, the step 2 also comprises the steps：
Step 2.1, calculates the bit number x of Each point in time in time windowiAnd its normalized value zi；
Step 2.2, according to bit number xiWith normalized value ziCalculate z on each time pointiProbability p (zi)；
Step 2.3, according to z on each time pointiProbability p (zi) time window is calculated in ziOn entropy and entropy ratio.
2. as claimed in claim 1 a kind of based on comentropy and the network anomaly detection method of sliding window, it is characterised in that
In step 2.1, the bit number x of Each point in time in time window is calculated according to equation belowiWith normalized value zi：
xi=bi-bi-1；
WhenWhen；
WhenWhen,
Wherein biFor the desired value at time point i (i=k, k+1 ..., k+n) place,
3. as claimed in claim 2 a kind of based on comentropy and the network anomaly detection method of sliding window, it is characterised in that
In step 2.2, z on each time point is calculated according to equation belowiProbability p (zi)：
WhereinFor average,For variance.
4. as claimed in claim 3 a kind of based on comentropy and the network anomaly detection method of sliding window, it is characterised in that
In step 2.3, time window TW is calculated according to equation belowkIn ziOn entropy E (TWk)：
5. as claimed in claim 4 a kind of based on comentropy and the network anomaly detection method of sliding window, it is characterised in that
In step 2.3, the entropy ratio of m-th time window is the meansigma methodss of the entropy of front s window divided by m-th time window
Entropy.
6. as claimed in claim 5 a kind of based on comentropy and the network anomaly detection method of sliding window, it is characterised in that：
The desired value is selected from the interfaces classes in router administration information bank.
7. a kind of Network anomaly detection system based on comentropy and sliding window, at least includes：
Time window setup module, for defining the sliding distance p of time window size n and time window；
Entropy and entropy ratio calculation module, arrange the progressive entropy and entropy ratio for calculating each time window successively according to sliding window
Value；
Judge module, according to the entropy or entropy ratio and the comparative result of given threshold value that calculate the time window for obtaining, judgement is
No generation Network Abnormal；
Wherein, the entropy and entropy ratio calculation module calculate the bit number x of Each point in time in time window firstiAnd normalization
Value zi, then according to obtain Each point in time bit number xiWith normalized value ziCalculate z on each time pointiProbability p (zi),
Finally according to ziProbability p (zi) time window is calculated in ziOn entropy and entropy ratio.
8. a kind of Network anomaly detection system based on comentropy and sliding window as claimed in claim 7, it is characterised in that：
If the entropy for calculating the time window for obtaining is less than given threshold value or entropy ratio is more than given threshold value, the judge module judges this
Before having data mutation in time window or not meeting, there is Network Abnormal in the situation of rule.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310676371.7A CN103618651B (en) | 2013-12-11 | 2013-12-11 | It is a kind of based on comentropy and the network anomaly detection method and system of sliding window |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310676371.7A CN103618651B (en) | 2013-12-11 | 2013-12-11 | It is a kind of based on comentropy and the network anomaly detection method and system of sliding window |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103618651A CN103618651A (en) | 2014-03-05 |
| CN103618651B true CN103618651B (en) | 2017-03-29 |
Family
ID=50169355
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310676371.7A Expired - Fee Related CN103618651B (en) | 2013-12-11 | 2013-12-11 | It is a kind of based on comentropy and the network anomaly detection method and system of sliding window |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103618651B (en) |
Families Citing this family (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103945442A (en) * | 2014-05-07 | 2014-07-23 | 东南大学 | System anomaly detection method based on linear prediction principle in mobile communication system |
| CN104618175A (en) * | 2014-12-19 | 2015-05-13 | 上海电机学院 | Network abnormity detection method |
| CN104539489B (en) * | 2015-01-21 | 2017-12-29 | 清华大学 | Network flow abnormal detecting method based on adjustable segmentation Shannon entropys |
| CN104539488B (en) * | 2015-01-21 | 2017-12-29 | 清华大学 | Network flow abnormal detecting method based on adjustable segmentation Tsallis entropys |
| US10505819B2 (en) * | 2015-06-04 | 2019-12-10 | Cisco Technology, Inc. | Method and apparatus for computing cell density based rareness for use in anomaly detection |
| CN105429977B (en) * | 2015-11-13 | 2018-08-07 | 武汉邮电科学研究院 | Deep packet inspection device abnormal flow monitoring method based on comentropy measurement |
| CN105373620A (en) * | 2015-12-04 | 2016-03-02 | 中国电力科学研究院 | Mass battery data exception detection method and system for large-scale battery energy storage power stations |
| GB2557199B (en) * | 2016-11-30 | 2020-11-04 | Lidco Group Plc | Haemodynamic monitor with improved filtering |
| CN110798463B (en) * | 2019-10-25 | 2022-01-18 | 广州大学 | Network covert channel detection method and device based on information entropy |
| CN111818037A (en) * | 2020-07-02 | 2020-10-23 | 上海工业控制安全创新科技有限公司 | Vehicle-mounted network flow abnormity detection defense method and system based on information entropy |
| CN112131274B (en) * | 2020-09-22 | 2024-01-19 | 平安科技（深圳）有限公司 | Method, device, equipment and readable storage medium for detecting abnormal points of time sequence |
| CN112583808B (en) * | 2020-12-08 | 2022-01-07 | 国网湖南省电力有限公司 | Abnormal flow detection method for Internet of things equipment |
| CN113660237B (en) * | 2021-08-10 | 2023-04-07 | 和中通信科技有限公司 | Industrial Internet data flow abnormity detection method based on dynamic sliding window, memory and processor |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102014031A (en) * | 2010-12-31 | 2011-04-13 | 湖南神州祥网科技有限公司 | Method and system for network flow anomaly detection |
| CN103281293A (en) * | 2013-03-22 | 2013-09-04 | 南京江宁台湾农民创业园发展有限公司 | Network flow rate abnormity detection method based on multi-dimension layering relative entropy |
-
2013
- 2013-12-11 CN CN201310676371.7A patent/CN103618651B/en not_active Expired - Fee Related
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102014031A (en) * | 2010-12-31 | 2011-04-13 | 湖南神州祥网科技有限公司 | Method and system for network flow anomaly detection |
| CN103281293A (en) * | 2013-03-22 | 2013-09-04 | 南京江宁台湾农民创业园发展有限公司 | Network flow rate abnormity detection method based on multi-dimension layering relative entropy |
Non-Patent Citations (1)
| Title |
|---|
| 基于信息熵理论的教育网异常流量发现;陈锶奇，王娟;《计算机应用研究》;20100430;第27卷(第4期);第1434-1436页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103618651A (en) | 2014-03-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103618651B (en) | It is a kind of based on comentropy and the network anomaly detection method and system of sliding window | |
| CN101645884B (en) | Multi-measure network abnormity detection method based on relative entropy theory | |
| CN102802158B (en) | Method for detecting network anomaly of wireless sensor based on trust evaluation | |
| CN104573881B (en) | A kind of military service equipment residual life adaptive forecasting method based on degraded data modeling | |
| CN107092654A (en) | Based on Change in Mean detect alarm normally with abnormal deviation data examination method and device | |
| CN105357228A (en) | Burst traffic detection method based on dynamic threshold | |
| CN104537034A (en) | Electric-transmission-and-transformation-equipment state monitoring data cleaning method based on time series analysis | |
| CN104038928A (en) | Method for calculating trust values of wireless Mesh network nodes | |
| CN103793854A (en) | Multiple combination optimization overhead transmission line operation risk informatization assessment method | |
| CN104299169B (en) | A kind of sewage disposal system information security online risk analysis method and system | |
| CN109861825B (en) | Internal attack detection method based on weighting rule and consistency in CPS system | |
| CN101938711B (en) | For the method and apparatus that rubbish message detects | |
| CN116896481B (en) | Internet of things-based network security data risk assessment system | |
| CN106375339A (en) | Attack mode detection method based on event slide window | |
| CN113762525B (en) | Federal learning model training method with differential privacy protection | |
| Tian | Inferences on the mean of zero‐inflated lognormal data: the generalized variable approach | |
| CN109039882A (en) | A kind of completely hall fastener type steel pipe scaffold safety monitoring system and method | |
| CN116541678B (en) | Pressure monitoring method and device for gas station safety pipeline | |
| CN110544168A (en) | weak supervision internet financial anti-fraud method based on generation countermeasure network | |
| Saghir et al. | A flexible and generalized exponentially weighted moving average control chart for count data | |
| CN110001713A (en) | The method and device of the detection of meter shaft magnetic head health degree and early warning based on AHP | |
| Pan et al. | Developing new multivariate process capability indices for autocorrelated data | |
| CN108345711A (en) | Based on event driven EMU robust sensor intermittent fault detection method | |
| CN115935407A (en) | Adaptive differential privacy protection method for federal learning | |
| CN113934536A (en) | Data acquisition method facing edge calculation |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20170329 Termination date: 20191211 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |