CN108683658B - Industrial control network flow abnormity identification method based on multi-RBM network construction reference model - Google Patents
Industrial control network flow abnormity identification method based on multi-RBM network construction reference model Download PDFInfo
- Publication number
- CN108683658B CN108683658B CN201810449297.8A CN201810449297A CN108683658B CN 108683658 B CN108683658 B CN 108683658B CN 201810449297 A CN201810449297 A CN 201810449297A CN 108683658 B CN108683658 B CN 108683658B
- Authority
- CN
- China
- Prior art keywords
- data
- rbm
- network
- model
- reference model
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 30
- 238000010276 construction Methods 0.000 title description 5
- 238000012549 training Methods 0.000 claims abstract description 35
- 230000002159 abnormal effect Effects 0.000 claims abstract description 32
- 238000001514 detection method Methods 0.000 claims abstract description 21
- 238000011156 evaluation Methods 0.000 claims abstract description 4
- 230000005856 abnormality Effects 0.000 claims description 14
- 230000005540 biological transmission Effects 0.000 claims description 14
- 238000012360 testing method Methods 0.000 claims description 14
- 238000000605 extraction Methods 0.000 claims description 5
- 230000000694 effects Effects 0.000 description 3
- 238000007781 pre-processing Methods 0.000 description 3
- 238000012545 processing Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 2
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 230000002349 favourable effect Effects 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 230000011218 segmentation Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
Abstract
A flow abnormity identification method of an industrial control network based on a reference model constructed by multiple RBM networks is characterized in that characteristics are extracted from the industrial control network and a training data set is generated, the reference model is trained to obtain an industrial control network normal reference model containing multiple RBM models and an abnormal data cluster in the training data set, and the industrial control network normal reference model is used for real-time network message evaluation to realize flow abnormity detection; the invention can finish whether dimension reduction and dimension reduction to be achieved by setting parameters in the interior, has better robustness, does not need to set the quantity to be clustered in advance, is finished by the correlation degree of the model, and better accords with the situation of practical application.
Description
Technical Field
The invention relates to a technology in the field of computers, in particular to a method for constructing a reference model based on a plurality of RBM networks and identifying network traffic abnormality according to the reference model.
Background
With the continuous change of attack means, the attack detection technology based on the known attack characteristics can not protect the network from the attack, and the attack detection on the network traffic is very necessary. The attack network flow packet is composed of massive flow data, and all activities and behaviors of the power grid terminal are recorded by the flow data. By analyzing and integrating these network traffic packets, features can be extracted therefrom to discover attacks. However, because the amount of network traffic is huge, real-time processing is required to be achieved to achieve attack identification, and the requirement on the efficiency of a detection algorithm is high. The traditional neural network learning method and most machine learning methods are often in the aspect of processing problems, and therefore, for a power grid network flow attack detection system, how to efficiently and accurately process the mass data is a great challenge.
Disclosure of Invention
The invention provides an industrial control network flow abnormity identification method based on a reference model constructed by multiple RBM networks, aiming at the defects of the prior art and the special conditions of the industrial control environment of a power grid, the reference model of the industrial control network flow is clustered by monitoring the quantity and time of the industrial control network flow, and various working states of industrial control equipment in the industrial control network are identified by the reference model, so that the abnormal state is found out.
The invention is realized by the following technical scheme:
the invention relates to an industrial control network flow abnormity identification method based on a reference model constructed by multiple RBM networks.
The training data set is subjected to feature extraction and merging according to the network characteristics of the industrial control network, and then training data in a data cluster form is divided in a time period.
The network characteristics of the industrial control network include but are not limited to: and copying the message from the bypass through a front-end collector or network equipment of the industrial control network.
The characteristic extraction is as follows: according to the protocol of industrial control network flow data transmission, characteristics such as time, quantity and types of message transmission are extracted for feature selection, redundant features in a data set are removed, and extracted message characteristics are obtained.
The merging means that: and merging the characteristics according to the quantity of the flow data in the merging time period Ta.
And the data clusters are divided into time periods by taking the flow transmission time of the industrial control network as a clustering time period Tb, and the data set is divided into each data cluster.
The reference model comprises at least one RBM network, the reference model completes the update of RBM network parameters by inputting any data cluster, randomly sets the initial parameters of the reference model, and completes the increase of the number of the RBM networks by receiving the data clusters with different rules.
The network parameters of the RBM network include, but are not limited to: learning rate alpha, iteration times n, the number of nodes of the visible layer and the hidden layer, a root mean square error threshold e, a merging time period Ta, a clustering time period Tb of a time cluster and the like, wherein: the learning rate alpha is the range of each change of the parameters after the RBM model is fed back, and the higher the learning rate is, the faster the convergence starting speed is, but the convergence to an accurate value is difficult to achieve; the iteration number n is the number of times that the RBM network is trained to converge, and in order to prevent the RBM model from being over-fitted, certain errors are allowed to exist; the number of nodes of the visible layer is determined by the characteristics of input data, the number of nodes of the hidden layer is related to dimensionality after dimensionality reduction and the required precision of convergence, and a reasonable set value is obtained through experiments generally; the root mean square error threshold e refers to the similarity degree between the input data and the existing RBM, the larger the root mean square error is, the smaller the similarity degree is, the fewer the clustered models are, but the larger the error is; the merging time period Ta refers to the merging of the quantity of single data extracted by the characteristics of the industrial control network in the time, and is used for representing the short-time flow transmission characteristics of a network segment; the clustering time period Tb of the time cluster refers to a time period in each RBM model, wherein data of a plurality of combined time periods are available, and the data represent the flow transmission mode of the network segments input and output in a period of time.
The training is as follows: inputting the data cluster into the initialized reference model, testing all RBM reference models in the reference model, calculating the reconstruction output of the data cluster in the reference model, calculating the square root error between the reconstruction output and the original data, improving the parameters of the training model or increasing the reference model according to the distance between the data cluster and each model until all training data sets are trained, and obtaining the normal reference model of the industrial control network containing a plurality of RBM models and the abnormal data cluster in the training data sets.
The distance between the models is characterized by, but not limited to, square root error.
The abnormal data cluster is as follows: and setting the abnormality degree of each data cluster according to the number of the data clusters in the RBM after clustering, wherein the larger the number of the data clusters in the RBM, the more the model conforms to the network segment transmission rule, the lower the abnormality degree of the corresponding data cluster is, and the message corresponding to the abnormal data cluster is abnormal data.
The abnormal degree is the percentage of abnormal data in the model and is determined by the number of data clusters in the RBM after clustering, the more the number of the data clusters in the RBM is, the lower the abnormal degree of the corresponding RBM is, and the abnormal state of the RBM is represented.
The adding of the reference model refers to: when the distance between the output data and the original data in the training process all exceeds a set threshold, the characteristics in the data cluster are not consistent with all existing RBM network modes, namely the data cluster belongs to a new mode type, so that an RBM network needs to be newly built, the data cluster is input into the RBM network for training and network parameter adjustment, and finally the newly built and initialized RBM network is added into a reference model.
The adjusting the network parameters comprises the following steps: and summarizing the RBM models meeting the preset abnormal degree detection threshold value, and then forming a multi-RBM model set, wherein the model set corresponds to a plurality of RBM models, the number of the RBM models is K, and each RBM model corresponds to own parameter and data cluster.
The original data are as follows: and (4) carrying out feature extraction on the data, wherein the data corresponds to original data which is called reconstructed output before being input into the RBM network.
The abnormal degree detection threshold is the error between the RBM model and the normal reference model, and the smaller the threshold is set, the smaller the error is, and the RBM is the normal reference model.
The parameter perfection of the training model refers to the following steps: when the distance between the output data and the original data is in the threshold range in the training process, selecting an RBM model set with the minimum distance, adding the original data corresponding to the data cluster into a training data set corresponding to a reference model, retraining an RBM network and updating model parameters.
When the data in the training data set of the model is excessive, part of redundant data is randomly abandoned according to the data quantity number of the data set in advance, a new data set is trained, and the corresponding reference model parameters are updated.
The real-time network message evaluation means that: after extracting and merging the characteristics of the network messages, dividing a detection data cluster in a data cluster form by time periods, inputting the detection data cluster into a normal reference model of the industrial control network, testing all RBM models in the detection data cluster, calculating the distance between output data of the detection data cluster and original data, and when the distance is greater than an abnormal degree error value, detecting the network message corresponding to the data cluster as an abnormal message.
Technical effects
Compared with the prior art, the invention has the technical effects that:
1) the running speed of real-time flow is improved, and when all flow of a certain set network of the power grid industrial control network enters one hour, the method can complete abnormal identification and parameter updating within one minute; the invention adopts the construction of the RBM network, whether dimension reduction and dimension reduction to be achieved can be completed by setting parameters inside, and because the invention can discard data with small correlation in the updating of the parameters, the invention can avoid redundancy while keeping the effectiveness of the data, thereby having lower requirements on hardware;
2) the reference model established by the RBM method has the characteristic of nonlinearity, so that the normal reference model of the industrial control network adopted by the invention has better robustness, and in addition, the RBM modeling can effectively avoid the influence of different working states on data, is favorable for mastering more normal working states, and further more accurately identifies abnormal states.
3) The invention adopts hierarchical clustering, does not need to set the quantity to be clustered in advance, is completed through the correlation degree of the models, and better meets the condition of practical application.
Drawings
FIG. 1 is a flow chart of the automatic construction of a normal reference model of an industrial control network according to the invention;
fig. 2 is a flowchart of an abnormal traffic detection method based on a normal reference model according to the present invention.
Detailed Description
The operation object of the embodiment is message data sampled by power consumption data of all network segments collected continuously every day, the embodiment adopts 15 days of data as construction data of a reference model based on data dataset in a certain set network segment, the data of the first 15 days in the message data is set as reference model training data train _ data, and the data of the last 8 days is test data test _ data.
As shown in fig. 1, the method for detecting an abnormality of a power consumption data acquisition flow in a power grid industrial control network according to this embodiment specifically includes the following steps:
initializing and setting parameters before detecting the method, wherein the data preprocessing comprises the following steps: determining the characteristics of data according to the afn and fn of the message transmission property in the communication protocol, extracting the characteristic types of all data to obtain 97 message characteristics, and converting the data according to the set 97 characteristics. And then merging the number of messages according to a sampling time interval of 10 minutes (Ta is set to 10mins, Tb is set to 1hour), setting one message transmission data every ten minutes, and if no data is transmitted in the ten minutes, all the data are 0, finally, performing min-max standardized normalization processing on the merged data, adjusting the value of each dimension of the data to [0,1] through simple scaling, and converting an applied function into: x is (x-min)/(max-min). The normalized features can be used as input for the K-RBM algorithm.
Meanwhile, RBM network parameters of the clustering model are set, the number of visible layer nodes in the RBM network is set to be 96, the model input to the RBM is 97-dimensional (the number of the visible layer nodes of the RBM model starts from 0), the number of hidden layer nodes is set to be 11, the learning rate alpha is 0.02, the iteration times of the RBM model are 1000 times, the root mean square error of the RBM model is 0.03, and the time cluster time period Tb is set to be 1 hour.
And setting the RBM abnormality degree after clustering as follows: when the proportion of the data clusters of the RBM model in all the data clusters is i%, the corresponding abnormality degree is 1-i%, the abnormality degree detection threshold value is 1%, and the abnormality degree detection error value is 5%.
As shown in fig. 1, the specific steps are as follows:
step 1) when the sample set of train _ data after the preprocessing is data { x1, x2 … xm }, each sample characteristic category xi { t1, t2 · t97}, then data is subjected to data segmentation according to a time cluster time period Tb, Ta is to ensure that a plurality of data segments are input by the RBM model at the same time, and the data segments represent the time transmission rule of flow data in Tb. The segmented data cluster can be regarded as data _ i (i is 1,2 … n), n segments of data clusters are formed, and then a reference model is established through iteration.
Step 2) training a first data cluster data _1, recording model parameters para _1 of a RBM model of the first data cluster, adding the RBM model into a model set R, recording the RBM model as R1, adding para _2 into a parameter set P, recording the parameter set P as P1, adding each data in the data cluster into a model data set D, recording the data as D1, and recording the number K of the models as 1.
And 3) extracting the data cluster data _ j, testing parameters of all RBM models in the parameter set P, and when the root mean square error e of the data after model y training and the original data is smaller than the root mean square error of the RBM models, setting the state parameter set sta _ y to true, otherwise, setting the state parameter set sta _ y to false, wherein y is any model in the model set. Verifying all the states, when all the states are false, indicating that the data cluster does not conform to all the existing models, when the number of the existing models is n, training data cluster data _ j, recording model parameters para _ j of a RBM model of the data cluster, adding the RBM model into a model set R, marking the RBM model as Rn +1, adding para _ j into a parameter set P, marking the RBM model as Pn +1, adding each data in the data cluster into a model data set D, marking the RBM model as Dn +1, and recording the number of the models as n + 1; and when the state is true, obtaining e _ d min (e), wherein d is a corresponding model, then adding data in data _ j into Dd, training Dd and updating a corresponding parameter Pd, adding a data cluster into the corresponding model, and when the number of the data cluster is more than 100, randomly discarding the data cluster j during training, and randomly selecting j, so that the data cluster during training is always kept at 100.
And 4) iterating all data, calculating and calculating the abnormality degree of each data cluster according to the abnormality degree method, extracting the RBM model which is larger than the abnormality degree threshold value and is considered to be abnormal, setting the RBM model which is smaller than the abnormality degree threshold value as a reference model, wherein the reference model may comprise a plurality of RBM models.
Step 5) as shown in fig. 2, testing the effectiveness of the application of the reference model in real-time data, reading a test set of test _ data after the preprocessing, wherein the test set is data _ test ═ { x1, x2 … xm }, each sample characteristic category xi ═ t1, t2 · · t97}, then segmenting the data _ test into data clusters according to a time cluster time period Tb, reading data in the data clusters accordingly, testing parameters of all RBM models in the normal reference model, and if similar models exist, the data clusters conform to the normal reference model, and the sub-message is also a normal message conforming to the data transmission rule; when the square root error smaller than the abnormal detection error degree does not exist, the message is indicated as an abnormal message
In this embodiment, in order to verify the performance and effectiveness of the reference model constructed by multiple RBM models, the method of the present invention is widely analyzed and evaluated at the dataset of the power grid industrial control network, and by using the method, abnormal flows and flows that do not conform to the normal network transmission rule in the power grid industrial control network can be found, and the specific accuracy is verified by the specific implementation environment of the power grid.
The foregoing embodiments may be modified in many different ways by those skilled in the art without departing from the spirit and scope of the invention, which is defined by the appended claims and all changes that come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.
Claims (10)
1. A flow abnormity identification method of an industrial control network based on a reference model constructed by multiple RBM networks is characterized in that characteristics are extracted from the industrial control network and a training data set is generated, the reference model is trained to obtain an industrial control network normal reference model containing multiple RBM models and an abnormal data cluster in the training data set, and the industrial control network normal reference model is used for real-time network message evaluation to realize flow abnormity detection;
the reference model comprises at least one RBM network, the reference model completes the update of RBM network parameters by inputting any data cluster, randomly sets the initial parameters of the reference model, and completes the increase of the number of the RBM networks by receiving the data clusters with different rules;
the network parameters of the RBM network comprise: the method comprises the following steps of learning rate alpha, iteration times n, the number of nodes of a visible layer and a hidden layer, a root mean square error threshold value e, a merging time period Ta and a clustering time period Tb of a time cluster.
2. The method of claim 1, wherein the training comprises: inputting the data cluster into the initialized reference model, testing all RBM reference models in the reference model, calculating the reconstruction output of the data cluster in the reference model, calculating the square root error between the reconstruction output and the original data, improving the parameters of the training model or increasing the reference model according to the distance between the data cluster and each model until all training data sets are trained, and obtaining the normal reference model of the industrial control network containing a plurality of RBM models and the abnormal data cluster in the training data sets.
3. The method of claim 1, wherein the training data set is segmented into training data in the form of data clusters according to time segments after feature extraction and merging according to network characteristics of the industrial control network.
4. The method of claim 3, wherein the feature extraction is: according to the protocol of industrial control network flow data transmission, characteristics such as time, quantity and types of message transmission are extracted for feature selection, redundant features in a data set are removed, and extracted message characteristics are obtained.
5. The method according to claim 1 or 2, wherein the abnormality degree of each data cluster is set according to the number of the data clusters in the RBM after clustering, and the more the number of the data clusters in the RBM, the more the model conforms to the network segment transmission rule, the lower the abnormality degree of the corresponding data cluster is, and the message corresponding to the abnormal data cluster is abnormal data;
the abnormal degree is the percentage of abnormal data in the model and is determined by the number of data clusters in the RBM after clustering, the more the number of the data clusters in the RBM is, the lower the abnormal degree of the corresponding RBM is, and the abnormal state of the RBM is represented.
6. The method of claim 2, wherein the adding the reference model comprises: when the distance between the output data and the original data in the training process all exceeds a set threshold, the characteristics in the data cluster are not consistent with all existing RBM network modes, namely the data cluster belongs to a new mode type, so that an RBM network needs to be newly built, the data cluster is input into the RBM network for training and network parameter adjustment, and finally the newly built and initialized RBM network is added into a reference model.
7. The method of claim 6, wherein said adjusting network parameters comprises: and summarizing the RBM models meeting the preset abnormal degree detection threshold value, and then forming a multi-RBM model set, wherein the model set corresponds to a plurality of RBM models, the number of the RBM models is K, and each RBM model corresponds to own parameter and data cluster.
8. The method of claim 2, wherein the training model parameter refinement is: when the distance between the output data and the original data is in the threshold range in the training process, selecting an RBM model set with the minimum distance, adding the original data corresponding to the data cluster into a training data set corresponding to a reference model, retraining an RBM network and updating model parameters.
9. The method according to claim 8, wherein when the data in the training data set of the model is excessive, part of the redundant data is randomly discarded according to the data amount of the data set in advance, a new data set is trained, and the corresponding reference model parameters are updated.
10. The method of claim 1, wherein the real-time network message evaluation comprises: after extracting and merging the characteristics of the network messages, dividing a detection data cluster in a data cluster form by time periods, inputting the detection data cluster into a normal reference model of the industrial control network, testing all RBM models in the detection data cluster, calculating the distance between output data of the detection data cluster and original data, and when the distance is greater than an abnormal degree error value, detecting the network message corresponding to the data cluster as an abnormal message.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810449297.8A CN108683658B (en) | 2018-05-11 | 2018-05-11 | Industrial control network flow abnormity identification method based on multi-RBM network construction reference model |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810449297.8A CN108683658B (en) | 2018-05-11 | 2018-05-11 | Industrial control network flow abnormity identification method based on multi-RBM network construction reference model |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108683658A CN108683658A (en) | 2018-10-19 |
| CN108683658B true CN108683658B (en) | 2020-11-03 |
Family
ID=63805500
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810449297.8A Active CN108683658B (en) | 2018-05-11 | 2018-05-11 | Industrial control network flow abnormity identification method based on multi-RBM network construction reference model |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108683658B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110098959B (en) * | 2019-04-23 | 2021-11-16 | 广东技术师范大学 | Industrial control protocol interactive behavior modeling method, device, system and storage medium |
| CN111832647A (en) * | 2020-07-10 | 2020-10-27 | 上海交通大学 | Abnormal flow detection system and method |
| CN114666075B (en) * | 2020-12-08 | 2023-04-07 | 上海交通大学 | Distributed network anomaly detection method and system based on depth feature coarse coding |
| CN113343587A (en) * | 2021-07-01 | 2021-09-03 | 国网湖南省电力有限公司 | Flow abnormity detection method for electric power industrial control network |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106453416A (en) * | 2016-12-01 | 2017-02-22 | 广东技术师范学院 | Detection method of distributed attack intrusion based on deep belief network |
| CN107241358A (en) * | 2017-08-02 | 2017-10-10 | 重庆邮电大学 | A kind of smart home intrusion detection method based on deep learning |
| US20180032862A1 (en) * | 2016-07-29 | 2018-02-01 | Splunk, Inc. | Automated anomaly detection for event-based system |
| CN107679859A (en) * | 2017-07-18 | 2018-02-09 | 中国银联股份有限公司 | A kind of Risk Identification Method and system based on Transfer Depth study |
-
2018
- 2018-05-11 CN CN201810449297.8A patent/CN108683658B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180032862A1 (en) * | 2016-07-29 | 2018-02-01 | Splunk, Inc. | Automated anomaly detection for event-based system |
| CN106453416A (en) * | 2016-12-01 | 2017-02-22 | 广东技术师范学院 | Detection method of distributed attack intrusion based on deep belief network |
| CN107679859A (en) * | 2017-07-18 | 2018-02-09 | 中国银联股份有限公司 | A kind of Risk Identification Method and system based on Transfer Depth study |
| CN107241358A (en) * | 2017-08-02 | 2017-10-10 | 重庆邮电大学 | A kind of smart home intrusion detection method based on deep learning |
Non-Patent Citations (1)
| Title |
|---|
| 基于深度信念网络的入侵检测算法研究;逯玉婧;《中国优秀硕士学位论文全文数据库(电子期刊)》;20160815;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108683658A (en) | 2018-10-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108683658B (en) | Industrial control network flow abnormity identification method based on multi-RBM network construction reference model | |
| CN111459700B (en) | Equipment fault diagnosis method, diagnosis device, diagnosis equipment and storage medium | |
| WO2018076571A1 (en) | Method and system for detecting abnormal value in lte network | |
| WO2017076154A1 (en) | Method and apparatus for predicting network event and establishing network event prediction model | |
| CN108985380B (en) | Point switch fault identification method based on cluster integration | |
| CN111798312A (en) | Financial transaction system abnormity identification method based on isolated forest algorithm | |
| CN105095238A (en) | Decision tree generation method used for detecting fraudulent trade | |
| WO2019172848A1 (en) | Method and apparatus for predicting occurrence of an event to facilitate asset maintenance | |
| NZ757969A (en) | Quantifying robustness by analyzing a property graph data model | |
| CN111666978B (en) | Intelligent fault early warning system for IT system operation and maintenance big data | |
| CN113609770A (en) | Rolling bearing RUL prediction method based on piecewise linear fitting HI and LSTM | |
| CN111638988A (en) | Cloud host fault intelligent prediction method based on deep learning | |
| CN111191720B (en) | Service scene identification method and device and electronic equipment | |
| CN106575254A (en) | Log analysis device, log analysis system, log analysis method, and computer program | |
| CN111325255B (en) | Specific crowd delineating method and device, electronic equipment and storage medium | |
| CN112422546A (en) | Network anomaly detection method based on variable neighborhood algorithm and fuzzy clustering | |
| CN110135196B (en) | Data fusion tamper-proof method based on input data compression representation correlation analysis | |
| CN110059126B (en) | LKJ abnormal value data-based complex correlation network analysis method and system | |
| CN111797942A (en) | User information classification method and device, computer equipment and storage medium | |
| CN110874601B (en) | Method for identifying running state of equipment, state identification model training method and device | |
| CN111198979A (en) | Method and system for cleaning big data for power transmission and transformation reliability evaluation | |
| CN111160077A (en) | Large-scale dynamic face clustering method | |
| CN115189939A (en) | HMM model-based power grid network intrusion detection method and system | |
| CN115409154A (en) | Concept drift active detection method integrating meta-learning and pre-training | |
| CN114861858A (en) | Method, device and equipment for detecting road surface abnormal data and readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |