CN108337226A - The detection method and embedded intelligent terminal of embedded intelligent terminal abnormal data - Google Patents
The detection method and embedded intelligent terminal of embedded intelligent terminal abnormal data Download PDFInfo
- Publication number
- CN108337226A CN108337226A CN201711375673.5A CN201711375673A CN108337226A CN 108337226 A CN108337226 A CN 108337226A CN 201711375673 A CN201711375673 A CN 201711375673A CN 108337226 A CN108337226 A CN 108337226A
- Authority
- CN
- China
- Prior art keywords
- clustering cluster
- cluster
- data
- testing data
- intelligent terminal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/26—Visual data mining; Browsing structured data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/28—Databases characterised by their database models, e.g. relational or object models
- G06F16/284—Relational databases
- G06F16/285—Clustering or classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/35—Clustering; Classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/35—Clustering; Classification
- G06F16/358—Browsing; Visualisation therefor
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
Abstract
The present invention provides a kind of detection method and embedded intelligent terminal of embedded intelligent terminal abnormal data, which includes：Testing data is received, testing data includes abnormal data；Determine the object in testing data, the k neighbor relationships between the k neighbours of each object and object；K neighbour's digraphs are constructed according to the k neighbor relationships between object；K dendrograms are constructed according to k neighbour's digraphs, and the clustering cluster in k dendrograms is marked；When the part clustering cluster in clustering cluster meets preset condition, the testing data in the clustering cluster of part is exported as abnormal data.This method can carry out small-scale Outlier mining, verification and measurement ratio is higher, and operational efficiency is higher, while reducing rate of false alarm using figure clustering method in the case of terminal device computing resource is limited to embedded intelligent terminal environment.
Description
Technical field
The present invention relates to the present invention relates to network safety filed more particularly to a kind of inspections of embedded intelligent terminal abnormal data
Survey method and embedded intelligent terminal.
Background technology
With the continuous development of Internet technology, network security has been increasingly becoming a hot topic, almost can all generate daily
New security threat.In face of such some scales gradually huge, Change of types multiterminal attacks, dug using machine learning or data
Pick technology is trained to ten hundreds of new type security threats and identification has been increasingly becoming main trend.
Under embedded environment, need to carry out abnormality detection some collected data, and Data Mining permitted
Multi-method only can just show advantage, such as neural network in the case of data scale is larger, limited for computing resource
Environment, the method for Data Mining seems more complicated, and verification and measurement ratio is relatively low.
It is an object of the present invention to the side that can be assisted in the case of terminal device computing resource is limited, using high in the clouds
Formula carries out small-scale Outlier mining by way of a kind of cluster based on figure in embedded intelligent terminal environment, examines
Measure abnormal data.Compared with Data Mining other algorithms, it is easy to implement, also shows higher verification and measurement ratio；Number of terminals
According to attribute type it is less, operation efficiency of algorithm it is higher；If having higher requirement to verification and measurement ratio, high in the clouds can be asked to have cooperateed with
At；It is needed when for abnormality detection in advance in addition, this method further improves the Outlier Detection Algorithm based on traditional K-Means
The problem of setting the number of cluster, improves clustering algorithm for the clustering result quality of the cluster of arbitrary shape, increases abnormal data
Verification and measurement ratio reduces rate of false alarm.
Invention content
The present invention provides a kind of embedded intelligent terminal abnormal deviation data examination method and embedded intelligent terminals, solve
Under computing resource limited environment, the low problem of anomaly data detection detection efficiency is carried out.
In a first aspect, providing a kind of detection method of embedded intelligent terminal abnormal data, which includes：
Testing data is received, testing data includes abnormal data；
Determine the object in testing data, the k neighbor relationships between the k neighbours of each object and object；
K neighbour's digraphs are constructed according to the k neighbor relationships between object；
K- dendrograms are constructed according to k neighbour's digraphs, and the clustering cluster in k- dendrograms is marked；
When the part clustering cluster in clustering cluster meets preset condition, the testing data in the clustering cluster of part is as abnormal number
According to output.
Optionally, in a mode in the cards, after the clustering cluster in k- dendrograms is marked；Detection
Method further includes：
When the part clustering cluster in clustering cluster meets preset condition, request message is sent to cloud server, request disappears
Breath calculates the testing data in the clustering cluster of part for cloud server, obtains abnormal data and exports.
Optionally, in a mode in the cards, cloud server carries out the testing data in the clustering cluster of part
It calculates, obtain abnormal data and exports, including：
The outlier factor of the testing data based on cluster in cloud server calculating section clustering cluster；
When the outlier factor of the testing data in the clustering cluster of part based on cluster meets predetermined threshold value, determine that part clusters
Testing data is exported as abnormal data in cluster.
Optionally, in a mode in the cards, k- dendrograms are constructed according to k neighbour's digraphs, including：
K- dendrograms are constructed according to the mutual neighborhoods of k- in k neighbour's digraphs.
Second aspect, provides a kind of embedded intelligent terminal, and embedded intelligent terminal includes memory and processor, with
And the computer program stored in memory, when processor calls the computer program in memory, processor executes following
Operation：
Testing data is received, testing data includes abnormal data；
Processing unit determines the object in testing data, the k neighbor relationships between the k neighbours of each object and object；
K neighbour's digraphs are constructed according to the k neighbor relationships between object；
K- dendrograms are constructed according to k neighbour's digraphs, and the clustering cluster in k- dendrograms is marked；
When the part clustering cluster in clustering cluster meets preset condition, the testing data in the clustering cluster of part is as abnormal number
According to output.
Optionally, in a mode in the cards, after the clustering cluster in k- dendrograms is marked；Processing
Device is additionally operable to execute：
When the part clustering cluster in clustering cluster meets preset condition, request message is sent to cloud server, request disappears
Breath calculates the testing data in the clustering cluster of part for cloud server, obtains abnormal data and exports.
Optionally, in a mode in the cards, cloud server carries out the testing data in the clustering cluster of part
It calculates, obtain abnormal data and exports, including：
The outlier factor of the testing data based on cluster in cloud server calculating section clustering cluster；
When the outlier factor of the testing data in the clustering cluster of part based on cluster meets predetermined threshold value, determine that part clusters
Testing data is exported as abnormal data in cluster.
Optionally, in a mode in the cards, k- dendrograms are constructed according to k neighbour's digraphs, including：
K- dendrograms are constructed according to the mutual neighborhoods of k- in k neighbour's digraphs.
The embedded intelligent terminal abnormal deviation data examination method and embedded intelligence provided using technical solution of the present invention is whole
End, can in the case of embedded type terminal equipment computing resource is limited, using high in the clouds assist by the way of, by one kind based on figure
The method of cluster carries out small-scale Outlier mining in embedded intelligent terminal environment, with other calculations of Data Mining
Method is compared, and is easy to implement, and higher verification and measurement ratio is also shown；The attribute type of terminal data is less, and operation efficiency of algorithm is higher.
In addition, cooperative mode auxiliary terminal in high in the clouds carries out secondary mark, the computation burden of terminal is alleviated, terminal is improved and calculates effect
Rate；By using the mode of figure cluster, improves the Outlier Detection Algorithm based on traditional K-Means and need to preset cluster
The problem of number, improves clustering result quality of the clustering algorithm for the cluster of arbitrary shape；Cluster is used after finishing and is marked twice
The mode of clustering cluster is improved simple clustered using figure and detects abnormal data precision, while also increasing the detection of abnormal data
Rate reduces rate of false alarm.
Description of the drawings
Fig. 1 is a kind of flow signal of embedded intelligent terminal abnormal deviation data examination method provided in an embodiment of the present invention
Figure；
Fig. 2 is a kind of structural schematic diagram of embedded intelligent terminal provided in an embodiment of the present invention；
Fig. 3 is a kind of system structure diagram provided in an embodiment of the present invention.
Specific implementation mode
An embodiment of the present invention provides a kind of embedded intelligent terminal abnormal deviation data examination method and embedded intelligent terminal,
It can be in the case of terminal device computing resource be limited, in such a way that high in the clouds assists, using figure clustering method to embedded
Intelligent terminal environment carries out small-scale Outlier mining, and verification and measurement ratio is higher；The attribute type of embedded intelligent terminal data
Less, operation efficiency of algorithm is higher.Secondary mark is carried out using high in the clouds cooperative mode auxiliary embedded intelligent terminal simultaneously, is mitigated
The computation burden of embedded intelligent terminal, improves embedded intelligent terminal computational efficiency.In addition, technology using the present invention
Scheme improves the problem of Outlier Detection Algorithm based on traditional K-Means needs to preset the number of cluster, improves different
The verification and measurement ratio of regular data, reduces rate of false alarm.
Technical scheme of the present invention is described below in conjunction with the accompanying drawings.
Fig. 1 is a kind of flow signal of embedded intelligent terminal abnormal deviation data examination method provided in an embodiment of the present invention
Figure.As shown in Figure 1, the detection method may comprise steps of：
S101, receives testing data, and testing data includes abnormal data.
Using the testing data comprising abnormal data as the input of embedded intelligent terminal.In embedded environment, acquisition
The data attribute arrived includes mainly two class of system resource and system mode, and system resource attribute may include：It is CPU occupation rates, interior
Occupancy, disk space, network transmitted traffic are deposited, network receives flow, bluetooth state, WIFI states, battery information etc.；System
System status attribute may include：Signal strength, number of processes, the number of applications of installation, the application program number being currently running
Amount etc..Each attribute can form a dimension of data to be collected, as long as dimension is more than 1, can use we
Method.
S102 determines the object in testing data, the k neighbor relationships between the k neighbours of each object and object.
S103 constructs k neighbour's digraphs according to the k neighbor relationships between object.
K neighbour's digraphs refer to, for a digraph G=(W, E), wherein W is the set W={ w of all the points in figure1,
w2,…wn, E is the set E={ e on all sides in figure1,e2,…,em, ei=<wp,wq>,wp,wq∈ W, wherein i=1,2,
3,…n；To each edge eiPresence, and if only if wqIt is wpK neighbours, eiDirection be wpIt is directed toward wq.These sides and point are constituted
K neighbour's digraphs.
S104 constructs k- dendrograms according to k neighbour's digraphs, and the clustering cluster in k- dendrograms is marked.
Optionally, in embodiments of the present invention, k- dendrograms are constructed according to the mutual neighborhoods of k- in k neighbour's digraphs.
The mutual neighborhoods of k- in digraph refer to：For digraph G, if any two points w in GpAnd wq, there are side epq
=<wp,wq>And eqp=<wq,wp>, i.e. wpIt is wqK neighbours, and wqIt is wpK neighbours, then wpAnd wqFor the mutual neighborhoods of k-.
K- dendrograms refer to, by nodal set W=W={ w1,w2,…wn, and side collection E={ e1,e2,…,emConstitute nothing
To figure G ', wherein ei=<wp,wq>,wp,wq∈ W, wherein i=1,2,3 ... n.Any limit eiPresence, and if only if wpAnd wq
For the mutual neighborhoods of k-.In the k- dendrograms of formation, the node that the subgraph of connection includes is relatively close, clustering, and mutual
Between the node of disconnected subgraph distance relatively far away from, to form different clusters.These clusters are properly termed as nature clustering cluster.
These are clustered naturally and carries out first time label, that is, nature clustering cluster is subjected to big clustering cluster and small clustering cluster
The differentiation of cluster.In embodiments of the present invention, big clustering cluster and small clustering cluster are referred to as big cluster, tuftlet, to large and small clustering cluster
Classification can realize in the following way：
Such as one threshold value λ of setting, data amount check in clustering cluster is more than to the cluster of λ n, it is believed that be big cluster, do not wrapped in big cluster
Containing abnormal data, and then it is considered to include the tuftlet of abnormal data on the contrary, and gives big cluster and tuftlet to do separator respectively.
The differentiation of big cluster and tuftlet is as follows：Assuming that the number of abnormal data is much smaller than the number of normal data in data set,
If C is the clustering of a data set, i.e. C={ C1,C2..., Ck, wherein k indicates the number of the clustering cluster divided, and |
C1|≥|C2|≥…≥|Ck|.The number of data set is | C |.Two parameter alphas and β are set, then C can be divided into following two class：
(C1|+|C2|+…+|Cb|)≥α*|C| (1)
|Cb|/Cb+1≥β (2)
Wherein 1<b<k.Formula (1) formula is used for determining big cluster and the boundary value b of tuftlet, and formula (2) formula ensures in big cluster
Data amount check be much larger than tuftlet (i.e. β ＞ 1).For the big cluster LC of data amount check in clustering cluster, LC={ Ci| i≤b } not comprising different
Regular data, and tuftlet SC={ Cji| j≤b }, upper separator is done respectively to big cluster and tuftlet；
S105, when the part clustering cluster in clustering cluster meets preset condition, the testing data conduct in the clustering cluster of part
Abnormal data exports.
Here part clustering cluster refers to that the tuftlet in S104, the condition of satisfaction are to be divided according to big cluster tuftlet, divides
For the condition of tuftlet.
In embodiments of the present invention, it when having higher precision demand to first time label result, needs that high in the clouds is asked to carry out two
Secondary label.
Optionally, in a mode in the cards, after the clustering cluster in k- dendrograms is marked；The inspection
Survey method further includes：
S106 sends request message to cloud server, asks when the part clustering cluster in clustering cluster meets preset condition
It asks message to be calculated the testing data in the clustering cluster of part for cloud server, obtain abnormal data and exports.
Optionally, in a mode in the cards, cloud server carries out the testing data in the clustering cluster of part
It calculates, obtain abnormal data and exports, including：
S107, the outlier factor of the testing data based on cluster in cloud server calculating section clustering cluster.
S108, when the outlier factor of the testing data in the clustering cluster of part based on cluster meets predetermined threshold value, determining section
Testing data in clustering cluster is divided to be exported as abnormal data.
After cloud server receives the request of embedded intelligent terminal, the point in each tuftlet is calculated, is counted
The outlier factor (CBLOF) based on cluster for calculating them is then grouped into this point from him most when this point is more than some threshold value δ
In close big cluster.So operation is multiple, until not having a little be grouped into big cluster.CBLOF refers to：For some
Cluster CiIn point t, wherein
Wherein, distance (t, | Ci|) refer to t to cluster CiThe distance between, min (distance (t, | Cj|)) refer to this
Point t and the big cluster the distance between nearest from it.The calculating of distance can be calculated with common Similarity Algorithm in cluster.
In embodiments of the present invention, when the point after carrying out multi-pass operation is not grouped into corresponding big cluster, then it is assumed that this
A little points are abnormal data, and are exported.
Based on embedded intelligent terminal abnormal deviation data examination method provided by the invention, in embedded intelligent terminal equipment meter
Calculate resource it is limited in the case of, using high in the clouds assist by the way of, using figure clustering method to embedded intelligent terminal environment carry out
Small-scale Outlier mining, verification and measurement ratio are higher；The attribute type of terminal data is less, and operational efficiency is higher；High in the clouds cooperates with
Mode assists terminal to carry out secondary mark, alleviates the computation burden of terminal, improves terminal computational efficiency；The method improve
Outlier Detection Algorithm based on traditional K-Means needs the problem of presetting the number of cluster, improves the inspection of abnormal data
Survey rate, reduces rate of false alarm.
Fig. 2 is a kind of structural schematic diagram of embedded intelligent terminal provided in an embodiment of the present invention.As shown in Fig. 2, the intelligence
Energy terminal may include processor and memory, and the program of storage on a memory, when processor calls in memory
When program, processor executes：
Testing data is received, testing data includes abnormal data；
Processing unit determines the object in testing data, the k neighbor relationships between the k neighbours of each object and object；
K neighbour's digraphs are constructed according to the k neighbor relationships between object；
K- dendrograms are constructed according to k neighbour's digraphs, and the clustering cluster in k- dendrograms is marked；
When the part clustering cluster in clustering cluster meets predetermined threshold value, the testing data in the clustering cluster of part is as abnormal number
According to output.
Optionally, in a mode in the cards, after the clustering cluster in k- dendrograms is marked；Processing
Device is additionally operable to execute：
When the part clustering cluster in clustering cluster meets the first predetermined threshold value, request message is sent to cloud server, is asked
It asks message to be calculated the testing data in the clustering cluster of part for cloud server, obtain abnormal data and exports.
Optionally, in a mode in the cards, cloud server carries out the testing data in the clustering cluster of part
It calculates, obtain abnormal data and exports, including：
The outlier factor of the testing data based on cluster in cloud server calculating section clustering cluster；
When the outlier factor of the testing data in the clustering cluster of part based on cluster meets the second predetermined threshold value, part is determined
Testing data is exported as abnormal data in clustering cluster.
Optionally, in a mode in the cards, k- dendrograms are constructed according to k neighbour's digraphs, including：
K- dendrograms are constructed according to the mutual neighborhoods of k- in k neighbour's digraphs.
Embedded intelligent terminal provided in an embodiment of the present invention can perform the side performed by embedded intelligent terminal in Fig. 1
Method/step, for succinct description, details are not described herein.
The embodiment of the present invention additionally provides a kind of system, as shown in figure 3, system includes embedded intelligent terminal and cloud service
Device, embedded intelligent terminal and Cloud Server are used to complete each method/step in Fig. 1, specifically describe shown in Figure 1
Method/step, for succinct description, details are not described herein.
Professional should further appreciate that, described in conjunction with the examples disclosed in the embodiments of the present disclosure
Unit and algorithm steps, can be realized with electronic hardware, computer software, or a combination of the two, hard in order to clearly demonstrate
The interchangeability of part and software generally describes each exemplary composition and step according to function in the above description.
These functions are implemented in hardware or software actually, depend on the specific application and design constraint of technical solution.
Professional technician can use different methods to achieve the described function each specific application, but this realization
It should not be considered as beyond the scope of the present invention.
The step of method described in conjunction with the examples disclosed in this document or algorithm, can use hardware, processor to execute
The combination of software module or the two is implemented.Software module can be placed in random access memory (RAM), memory, read-only memory
(ROM), electrically programmable ROM, electrically erasable ROM, register, hard disk, moveable magnetic disc, CD-ROM or technical field
In any other form of storage medium well known to interior.
Above-described specific implementation mode has carried out further the purpose of the present invention, technical solution and advantageous effect
It is described in detail, it should be understood that the foregoing is merely the specific implementation mode of the present invention, is not intended to limit the present invention
Protection domain, all within the spirits and principles of the present invention, any modification, equivalent substitution, improvement and etc. done should all include
Within protection scope of the present invention.
Claims (8)
1. a kind of detection method of embedded intelligent terminal abnormal data, which is characterized in that the detection method includes：
Testing data is received, the testing data includes abnormal data；
Determine the object in the testing data, the k neighbor relationships between the k neighbours and the object of each object；
K neighbour's digraphs are constructed according to the k neighbor relationships between the object；
K- dendrograms are constructed according to the k neighbours digraph, and the clustering cluster in the k- dendrograms is marked；
When the part clustering cluster in the clustering cluster meets preset condition, the testing data in the part clustering cluster is as different
Regular data exports.
2. detection method according to claim 1, which is characterized in that the clustering cluster in the k- dendrograms into
After line flag；The detection method further includes：
When the part clustering cluster in the clustering cluster meets preset condition, request message is sent to cloud server, it is described to ask
Message is asked to be calculated the testing data in the part clustering cluster for the cloud server, acquisition abnormal data is simultaneously defeated
Go out.
3. detection method according to claim 2, which is characterized in that the cloud server is in the part clustering cluster
Testing data calculated, obtain abnormal data simultaneously export, including：
The cloud server calculates the outlier factor of the testing data based on cluster in the part clustering cluster；
When the outlier factor of the testing data in the part clustering cluster based on cluster meets predetermined threshold value, described in determination
Testing data described in the clustering cluster of part is exported as abnormal data.
4. detection method according to any one of claims 1 to 3, which is characterized in that described according to the k neighbours digraph
K- dendrograms are constructed, including：
K- dendrograms are constructed according to the mutual neighborhoods of k- in the k neighbours digraph.
5. a kind of embedded intelligent terminal, which is characterized in that the embedded intelligent terminal includes memory and processor, and
The computer program stored in memory, when processor calls the computer program in the memory, the processor is held
The following operation of row：
Testing data is received, the testing data includes abnormal data；
Processing unit determines the object in the testing data, the k neighbours between the k neighbours and the object of each object
Relationship；
K neighbour's digraphs are constructed according to the k neighbor relationships between the object；
K- dendrograms are constructed according to the k neighbours digraph, and the clustering cluster in the k- dendrograms is marked；
When the part clustering cluster in the clustering cluster meets preset condition, the testing data in the part clustering cluster is as different
Regular data exports.
6. embedded intelligent terminal according to claim 5, which is characterized in that described to poly- in the k- dendrograms
After class cluster is marked；The processor is additionally operable to execute：
When the part clustering cluster in the clustering cluster meets preset condition, request message is sent to cloud server, it is described to ask
Message is asked to be calculated the testing data in the part clustering cluster for the cloud server, acquisition abnormal data is simultaneously defeated
Go out.
7. embedded intelligent terminal according to claim 6, which is characterized in that the cloud server is poly- to the part
Testing data in class cluster is calculated, and is obtained abnormal data and is exported, including：
The cloud server calculates the outlier factor of the testing data based on cluster in the part clustering cluster；
When the outlier factor of the testing data in the part clustering cluster based on cluster meets predetermined threshold value, described in determination
Testing data described in the clustering cluster of part is exported as abnormal data.
8. according to claim 5 to 7 any one of them embedded intelligent terminal, which is characterized in that described according to the k neighbours
Digraph constructs k- dendrograms, including：
K- dendrograms are constructed according to the mutual neighborhoods of k- in the k neighbours digraph.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711375673.5A CN108337226A (en) | 2017-12-19 | 2017-12-19 | The detection method and embedded intelligent terminal of embedded intelligent terminal abnormal data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711375673.5A CN108337226A (en) | 2017-12-19 | 2017-12-19 | The detection method and embedded intelligent terminal of embedded intelligent terminal abnormal data |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN108337226A true CN108337226A (en) | 2018-07-27 |
Family
ID=62922540
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711375673.5A Pending CN108337226A (en) | 2017-12-19 | 2017-12-19 | The detection method and embedded intelligent terminal of embedded intelligent terminal abnormal data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108337226A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109753991A (en) * | 2018-12-06 | 2019-05-14 | 中科恒运股份有限公司 | Abnormal deviation data examination method and device |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104217015A (en) * | 2014-09-22 | 2014-12-17 | 西安理工大学 | Hierarchical clustering method based on mutual shared nearest neighbors |
| CN105512206A (en) * | 2015-11-27 | 2016-04-20 | 河海大学 | Outlier detection method based on clustering |
| CN105550244A (en) * | 2015-12-07 | 2016-05-04 | 武汉大学 | Adaptive clustering method |
| CN105787520A (en) * | 2016-03-25 | 2016-07-20 | 中国农业大学 | Cluster and outlier discovery algorithm based on natural shared nearest neighbor search |
| CN106683024A (en) * | 2016-12-31 | 2017-05-17 | 中国科学技术大学 | Motor vehicle exhaust remote measuring equipment laying out method based on similarity of emission source intensity |
| US20170161815A1 (en) * | 2014-06-26 | 2017-06-08 | International Business Machines Corporation | Complex service network ranking and clustering |
-
2017
- 2017-12-19 CN CN201711375673.5A patent/CN108337226A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170161815A1 (en) * | 2014-06-26 | 2017-06-08 | International Business Machines Corporation | Complex service network ranking and clustering |
| CN104217015A (en) * | 2014-09-22 | 2014-12-17 | 西安理工大学 | Hierarchical clustering method based on mutual shared nearest neighbors |
| CN105512206A (en) * | 2015-11-27 | 2016-04-20 | 河海大学 | Outlier detection method based on clustering |
| CN105550244A (en) * | 2015-12-07 | 2016-05-04 | 武汉大学 | Adaptive clustering method |
| CN105787520A (en) * | 2016-03-25 | 2016-07-20 | 中国农业大学 | Cluster and outlier discovery algorithm based on natural shared nearest neighbor search |
| CN106683024A (en) * | 2016-12-31 | 2017-05-17 | 中国科学技术大学 | Motor vehicle exhaust remote measuring equipment laying out method based on similarity of emission source intensity |
Non-Patent Citations (1)
| Title |
|---|
| 应德全等: "一种基于图论的聚类算法NeiMu", 《计算机工程与应用》 * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109753991A (en) * | 2018-12-06 | 2019-05-14 | 中科恒运股份有限公司 | Abnormal deviation data examination method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109088869B (en) | APT attack detection method and device | |
| CN109859054B (en) | Network community mining method and device, computer equipment and storage medium | |
| US20180181749A1 (en) | Cyber security | |
| CN104811344B (en) | Network dynamic business monitoring method and device | |
| CN110445801B (en) | Situation sensing method and system of Internet of things | |
| CN103077347A (en) | Combined type intrusion detecting method on basis of data fusion of improved core vector machine | |
| CN102291392A (en) | Hybrid intrusion detection method based on bagging algorithm | |
| Jithish et al. | Distributed anomaly detection in smart grids: a federated learning-based approach | |
| CN109274692A (en) | A kind of identification block chain network is done evil the method and device of node | |
| CN108154256A (en) | The determining method and device of forecasting risk value, storage medium | |
| Hussain et al. | A novel unsupervised feature‐based approach for electricity theft detection using robust PCA and outlier removal clustering algorithm | |
| Zuo et al. | Power information network intrusion detection based on data mining algorithm | |
| Chen et al. | Detection of false data injection attacks on power systems using graph edge-conditioned convolutional networks | |
| CN110598128B (en) | Community detection method for large-scale network for resisting Sybil attack | |
| CN114707834A (en) | Alarm reminding method and device and storage medium | |
| Deshpande | Layered Intrusion Detection System Model for The Attack Detection with The Multi-Class Ensemble Classifier | |
| Mohamed et al. | Data mining-based cyber-physical attack detection tool for attack-resilient adaptive protective relays | |
| CN108337226A (en) | The detection method and embedded intelligent terminal of embedded intelligent terminal abnormal data | |
| CN107274025B (en) | System and method for realizing intelligent identification and management of power consumption mode | |
| Jena et al. | An ensemble classifier based scheme for detection of false data attacks aiming at disruption of electricity market operation | |
| CN105721467A (en) | Social network Sybil group detection method | |
| Man et al. | An alert aggregation algorithm based on iterative self-organization | |
| CN107454084B (en) | Nearest neighbor intrusion detection algorithm based on hybrid zone | |
| Ullah et al. | Measurable challenges in smart grid cybersecurity enhancement: A brief review | |
| Su et al. | Detection ddos of attacks based on federated learning with digital twin network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20180727 |
|
| RJ01 | Rejection of invention patent application after publication |